<?php
if ( ! defined( 'WPINC' ) ) {
	exit;
}
return json_decode( '{"version": "0.1142.2", "rules": {"CVE-2023-7306": {"ajax_action": "wpfm_delete_multiple_files", "conditions": [{"name": "ARGS:file_ids", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2023-7306", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "target": "plugin", "versions": "<=21.5"}, "CVE-2024-7031": {"ajax_action": "njt_fs_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "mode": "block", "severity": 7.5, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "CVE-2025-5282": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "wptravelengine/v2/trips"}, {"name": "ARGS:id", "type": "exists"}, {"name": "ARGS:package_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-5282", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.5.1"}, "CVE-2025-6814": {"action": "init", "conditions": [{"name": "ARGS:export_xml", "type": "exists"}, {"name": "ARGS:export_xml", "type": "equals", "value": "Export xml"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6814", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-x", "target": "plugin", "versions": ">=1.1.0"}, "RULE-CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/update\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-plugin"}, {"name": "FILES:pluginzip:name", "type": "regex", "value": "~^(platformist-quadendpointer|theme-js-wpcode|framework-triappment)\\\\.zip$~i"}], "cve": "CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01", "description": "Blocks upload of known fake-plugin archives at the WordPress plugin\\ninstall endpoint. Seed slugs are confirmed malicious backdoor-dropper\\nplugins (wp_org_exists=false, shared payload generator signature) that\\ninstall further payloads when activated. Fires on the plugin upload\\nstep before the zip is extracted, preventing backdoor deployment via\\nstolen or compromised admin credentials. The slug denylist should be\\nupdated as new IOC slugs are identified via the malware research\\npipeline. This rule covers the HTTP install vector; on-disk detection\\nis handled by AiBolit recognizers via the malware-team pipeline.\\n", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["fake-plugin-install", "post-compromise", "dropper", "php-bkdr-wpplugin-mal", "admin-credential-abuse", "wpplugin1-family"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-LEARNPRESS-C-ONLY-FIELDS-SQLI-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress/v1/(courses|profile/course-tab)([/?&]|$)~i"}, {"name": "ARGS:c_only_fields", "type": "detectSQLi"}], "cve": "CAMPAIGN-2026-W18-LEARNPRESS-CFIELDS-SQLI", "description": "LearnPress \\u2014 block SQL injection attempts via the \'c_only_fields\' query\\nparameter on the REST endpoints /wp-json/learnpress/v1/courses and\\n/wp-json/learnpress/v1/profile/course-tab.  The parameter is a column-name\\nprojection list; legitimate values are bare identifiers.  SQL keywords or\\nfunction-call syntax in the value indicates injection.\\n", "mode": "block", "severity": 8.5, "slug": "learnpress", "tags": ["sql-injection", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=0"}, "RULE-CAMPAIGN-TRIBE-V1-EVENTS-STATUS-SQLI-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe/events/v1/events([/?&]|$)~i"}, {"name": "ARGS:status", "type": "detectSQLi"}], "cve": "CAMPAIGN-2026-W18-TRIBE-STATUS-SQLI", "description": "The Events Calendar \\u2014 block SQL injection attempts via the \'status\' query\\nparameter on the REST endpoint /wp-json/tribe/events/v1/events.  Complements\\nexisting coverage for the documented \'s\' parameter SQLi (CVE-2025-9807,\\nCVE-2025-12197) and \'order\' parameter SQLi (CVE-2024-8275).\\n", "mode": "block", "severity": 8.5, "slug": "the-events-calendar", "tags": ["sql-injection", "rest-api", "unauthenticated"], "target": "plugin", "versions": ">=0"}, "RULE-CAMPAIGN-WP-EDITOR-AUTH-COOKIE-02": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.php$~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=)?~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~(?is)(?=.*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*=(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\bget_users(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?=[^;]{0,512}\\\\b(?:role|roles)\\\\b[^;]{0,512}\\\\badministrator\\\\b))(?=.*\\\\bwp_set_current_user(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*(?:\\\\[\\\\s*\\\\d+\\\\s*\\\\])?(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*->(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*ID\\\\b)(?=.*\\\\bwp_set_auth_cookie(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$[A-Za-z_]\\\\w*(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*(?:\\\\[\\\\s*\\\\d+\\\\s*\\\\])?(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*->(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*ID\\\\b)~"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes that select an administrator and create an authentication cookie.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "authentication-backdoor", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-WP-EDITOR-EXECUTABLE-SAVE-01": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.(?:php(?:3|4|5|7|s)?|phtml|inc|include)$~i"}, {"name": "ARGS:newcontent", "type": "exists"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes to PHP-family executable or include-bearing files.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": ">=4.9.0"}, "RULE-CAMPAIGN-WP-EDITOR-REQUEST-CALLABLE-01": {"ajax_action": "edit-theme-plugin-file", "conditions": [{"name": "ARGS:/^file$/", "type": "regex", "value": "~\\\\.php$~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=)?~i"}, {"name": "ARGS:newcontent", "type": "regex", "value": "~(?is)(?=.*\\\\bextract(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\((?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\$_(?:REQUEST|GET|POST)\\\\b)(?=.*(?:\\\\$[A-Za-z_]\\\\w*|\\\\bcall_user_func|\\\\$_(?:REQUEST|GET|POST)\\\\s*\\\\[\\\\s*[\\\\x22\\\\x27][A-Za-z_]\\\\w*[\\\\x22\\\\x27]\\\\s*\\\\]|\\\\$\\\\{\\\\s*[\\\\x22\\\\x27][A-Za-z_]\\\\w*[\\\\x22\\\\x27]\\\\s*\\\\})(?:\\\\s|/\\\\*.*?\\\\*/|(?:\\\\/\\\\/|#)[^\\\\r\\\\n]*(?:\\\\r?\\\\n|$))*\\\\()~"}], "cve": "CAMPAIGN-2026-WP-EDITOR-ABUSE", "description": "Block WordPress core editor writes that extract request variables and invoke an attacker-selected PHP callable.", "method": "POST", "mode": "block", "severity": 9.0, "tags": ["authenticated-editor-abuse", "php-backdoor", "post-compromise", "wordpress-core-entrypoint"], "target": "core", "versions": "<=999.999.999"}, "RULE-CAMPAIGN-WPMATES-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-mates\\\\.php($|\\\\?)~"}], "cve": "CAMPAIGN-WPMATES-01", "description": "Blocks requests to /wp-mates.php, a documented planted-backdoor filename\\nnot present in WordPress core or any tracked legitimate plugin or theme\\ndistribution. Any HTTP request to this path is a post-compromise callback\\nprobe from a threat actor confirming the backdoor remains reachable. The\\nfile must be removed from the filesystem and admin credentials rotated;\\nthis rule blocks the probe but does not remediate the underlying\\ncompromise.\\n", "method": "GET", "mode": "block", "severity": 9.0, "tags": ["post-compromise-probe", "dropper-survival-check", "filesystem-planted-backdoor", "core-fs-path-coverage", "wp-mates-backdoor"], "target": "core", "versions": "<=999.999.999"}, "RULE-CVE-2013-2010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<!--\\\\s*(?:mfunc|mclude)~i"}], "cve": "CVE-2013-2010", "description": "W3 Total Cache <=0.9.2.8 macro-expands dynamic markers <!--mfunc ...--> (eval, RCE) and <!--mclude ...--> (include, LFI) found literally in the rendered page buffer (lib/W3/PgCache.php _parse_dynamic L1390-1400, eval L1416). Attacker content (comment/post/excerpt/trackback body) carries the literal \\"<!--mfunc\\"/\\"<!--mclude\\" bytes in the request before storage+caching, so the marker is request-visible. Fixed 0.9.2.9 by gating behind W3TC_DYNAMIC_SECURITY.", "method": "POST", "mode": "block", "severity": 9.8, "slug": "w3-total-cache", "target": "plugin", "versions": "<=0.9.2.8"}, "RULE-CVE-2015-10133-01": {"action": "init", "conditions": [{"name": "ARGS:wp-subscription-manager", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2015-10133", "method": "GET", "mode": "block", "severity": 7.2, "slug": "subscribe-to-comments", "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2015-9458-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "searchterms-tagging2.php"}, {"name": "ARGS:stats", "type": "exists"}, {"name": "ARGS:count", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|PROCEDURE\\\\s+ANALYSE|BENCHMARK\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2015-9458", "description": "SearchTerms Tagging 2 <=1.535 SQL injection via count parameter in admin stats page", "mode": "block", "severity": 7.2, "slug": "searchterms-tagging-2", "target": "plugin", "versions": "<=1.535"}, "RULE-CVE-2015-9458-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "searchterms-tagging2.php"}, {"name": "ARGS:stats", "type": "exists"}, {"name": "ARGS:count", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|form|input|body)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2015-9458", "description": "SearchTerms Tagging 2 <=1.535 reflected XSS via count parameter in admin stats page", "mode": "block", "severity": 7.2, "slug": "searchterms-tagging-2", "target": "plugin", "versions": "<=1.535"}, "RULE-CVE-2016-10944-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mpd"}, {"name": "ARGS:duplicate-submit", "type": "exists"}, {"name": "ARGS:mdp-prefix", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on\\\\w+\\\\s*=|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>])~i"}], "cve": "CVE-2016-10944", "description": "Multisite Post Duplicator <1.1.3 CSRF with stored XSS via mdp-prefix parameter on tools.php?page=mpd", "mode": "block", "severity": 8.8, "slug": "multisite-post-duplicator", "target": "plugin", "versions": "<1.1.3"}, "RULE-CVE-2016-15033-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/plugins/delete-all-comments/delete-all-comments\\\\.php~"}, {"name": "ARGS:restorefromfileNAME", "type": "exists"}, {"name": "ARGS:restorefromfileNAME", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2016-15033", "description": "Delete All Comments <=2.0 unauthenticated arbitrary file upload via restorefromfileNAME", "mode": "block", "severity": 9.8, "slug": "delete-all-comments", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2017-20192-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS:after_html", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:iframe|svg|img|body|object|embed|video|audio|source|link|meta|form|input|details|marquee)\\\\b[^>]*\\\\bon[a-z]+\\\\s*=|on(?:load|error|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|abort|toggle|animationstart|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z0-9.+-]*\\\\s*[;,]?\\\\s*(?:base64|charset)|expression\\\\s*\\\\(|<\\\\s*style[^>]*>[^<]*expression|&#x?0*(?:6[ad]|4[ad]|3c|2f);?|%3[Cc]\\\\s*script)~i"}], "cve": "CVE-2017-20192", "description": "Formidable Form Builder <2.05.03 unauthenticated stored XSS via after_html parameter in frm_forms_preview AJAX action", "mode": "block", "severity": 6.1, "slug": "formidable", "target": "plugin", "versions": "<2.05.03"}, "RULE-CVE-2017-20192-02": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS:before_html", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:iframe|svg|img|body|object|embed|video|audio|source|link|meta|form|input|details|marquee)\\\\b[^>]*\\\\bon[a-z]+\\\\s*=|on(?:load|error|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|abort|toggle|animationstart|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z0-9.+-]*\\\\s*[;,]?\\\\s*(?:base64|charset)|expression\\\\s*\\\\(|<\\\\s*style[^>]*>[^<]*expression|&#x?0*(?:6[ad]|4[ad]|3c|2f);?|%3[Cc]\\\\s*script)~i"}], "cve": "CVE-2017-20192", "description": "Formidable Form Builder <2.05.03 unauthenticated stored XSS via before_html parameter in frm_forms_preview AJAX action", "mode": "block", "severity": 6.1, "slug": "formidable", "target": "plugin", "versions": "<2.05.03"}, "RULE-CVE-2019-13344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "facebook-like-button"}, {"name": "ARGS:update_fblb", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2019-13344", "description": "WP Like Button <=1.6.0 unauthenticated settings change via admin.php page=facebook-like-button", "mode": "block", "severity": 5.3, "slug": "wp-like-button", "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2019-15319-01": {"action": "admin_init", "conditions": [{"name": "ARGS:import_data_textarea", "type": "regex", "value": "~^(?:Tzo|Qzo)[A-Za-z0-9+/=]{20,}~"}], "cve": "CVE-2019-15319", "description": "OptionTree <2.7.0 PHP Object Injection via import_data_textarea (base64-encoded unserialize)", "mode": "block", "severity": 9.8, "slug": "option-tree", "target": "plugin", "versions": "<2.7.0"}, "RULE-CVE-2019-15319-02": {"action": "admin_init", "conditions": [{"name": "ARGS:import_layouts", "type": "regex", "value": "~^(?:Tzo|Qzo)[A-Za-z0-9+/=]{20,}~"}], "cve": "CVE-2019-15319", "description": "OptionTree <2.7.0 PHP Object Injection via import_layouts (base64-encoded unserialize)", "mode": "block", "severity": 9.8, "slug": "option-tree", "target": "plugin", "versions": "<2.7.0"}, "RULE-CVE-2019-16520-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2019-16520", "description": "All in One SEO Pack <3.2.7 stored XSS via unsafe %post_title% placeholder replacement in meta description - blocks XSS payload in post_title", "mode": "block", "severity": 5.4, "slug": "all-in-one-seo-pack", "target": "plugin", "versions": "<3.2.7"}, "RULE-CVE-2019-16520-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:aiosp_description", "type": "contains", "value": "%post_title%"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2019-16520", "description": "All in One SEO Pack <3.2.7 stored XSS via %post_title% placeholder in aiosp_description field - blocks placeholder setup by unauthorized users", "mode": "block", "severity": 5.4, "slug": "all-in-one-seo-pack", "target": "plugin", "versions": "<3.2.7"}, "RULE-CVE-2019-17237-01": {"ajax_action": "contact_form", "conditions": [{"name": "ARGS:contact_message", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|submit)\\\\s*=|<(?:iframe|object|embed|form|img|svg|link|meta|base)[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2019-17237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17237", "description": "IgniteUp <=3.4.3 CSRF + HTML injection in contact form email body via contact_message", "mode": "block", "severity": 8.8, "slug": "igniteup", "tags": ["xss", "html-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2019-17237-02": {"ajax_action": "contact_form", "conditions": [{"name": "ARGS:contact_subject", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|submit)\\\\s*=|<(?:iframe|object|embed|form|img|svg|link|meta|base)[\\\\s/>]|javascript\\\\s*:|<h[1-6][\\\\s/>])~i"}], "cve": "CVE-2019-17237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17237", "description": "IgniteUp <=3.4.3 CSRF + HTML injection in contact form email subject via contact_subject", "mode": "block", "severity": 8.8, "slug": "igniteup", "tags": ["xss", "html-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2019-17237-03": {"ajax_action": "contact_form", "conditions": [{"name": "ARGS:contact_email", "type": "regex", "value": "~(?:%0[aAdD]|%0[aAdD]%0[aAdD]|\\\\r|\\\\n|\\\\r\\\\n)~"}], "cve": "CVE-2019-17237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17237", "description": "IgniteUp <=3.4.3 CSRF + email header injection via CRLF in contact_email", "mode": "block", "severity": 8.8, "slug": "igniteup", "tags": ["header-injection", "crlf-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2019-17237-04": {"ajax_action": "subscribe_email", "conditions": [{"name": "ARGS:cs_email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|\'\\\\s*(?:OR|AND)\\\\s+(?:\'?\\\\d|\'[^\']*\'\\\\s*=\\\\s*\')|--\\\\s*$|#\\\\s*(?:$|\\\\s))~i"}], "cve": "CVE-2019-17237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2019-17237", "description": "IgniteUp <=3.4.3 CSRF + SQL injection in subscribe_email via cs_email parameter", "mode": "block", "severity": 8.8, "slug": "igniteup", "tags": ["sql-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2019-25145-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:pirate-forms-contact-name", "type": "regex", "value": "~<(?:script|iframe|img|a|div|table|form|input|object|embed|svg|style|link|meta|h[1-6])[\\\\s/>]~i"}], "cve": "CVE-2019-25145", "description": "Pirate Forms <=2.5.1 unauthenticated HTML injection/stored XSS via contact-name field (template_redirect)", "mode": "block", "severity": 6.1, "slug": "pirate-forms", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2019-25145-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:pirate-forms-contact-subject", "type": "regex", "value": "~<(?:script|iframe|img|a|div|table|form|input|object|embed|svg|style|link|meta|h[1-6])[\\\\s/>]~i"}], "cve": "CVE-2019-25145", "description": "Pirate Forms <=2.5.1 unauthenticated HTML injection/stored XSS via contact-subject field (template_redirect)", "mode": "block", "severity": 6.1, "slug": "pirate-forms", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2019-25145-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:pirate-forms-contact-message", "type": "regex", "value": "~<(?:script|iframe|img|a|div|table|form|input|object|embed|svg|style|link|meta|h[1-6])[\\\\s/>]~i"}], "cve": "CVE-2019-25145", "description": "Pirate Forms <=2.5.1 unauthenticated HTML injection/stored XSS via contact-message field (template_redirect)", "mode": "block", "severity": 6.1, "slug": "pirate-forms", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2019-25145-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jetstash/v1/send-email(?:[/?]|$)~"}, {"name": "ARGS:pirate-forms-contact-name", "type": "regex", "value": "~<(?:script|iframe|img|a|div|table|form|input|object|embed|svg|style|link|meta|h[1-6])[\\\\s/>]~i"}], "cve": "CVE-2019-25145", "description": "Pirate Forms <=2.5.1 unauthenticated HTML injection/stored XSS via contact-name field (REST API)", "mode": "block", "severity": 6.1, "slug": "pirate-forms", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2019-25145-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jetstash/v1/send-email(?:[/?]|$)~"}, {"name": "ARGS:pirate-forms-contact-subject", "type": "regex", "value": "~<(?:script|iframe|img|a|div|table|form|input|object|embed|svg|style|link|meta|h[1-6])[\\\\s/>]~i"}], "cve": "CVE-2019-25145", "description": "Pirate Forms <=2.5.1 unauthenticated HTML injection/stored XSS via contact-subject field (REST API)", "mode": "block", "severity": 6.1, "slug": "pirate-forms", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2019-25145-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jetstash/v1/send-email(?:[/?]|$)~"}, {"name": "ARGS:pirate-forms-contact-message", "type": "regex", "value": "~<(?:script|iframe|img|a|div|table|form|input|object|embed|svg|style|link|meta|h[1-6])[\\\\s/>]~i"}], "cve": "CVE-2019-25145", "description": "Pirate Forms <=2.5.1 unauthenticated HTML injection/stored XSS via contact-message field (REST API)", "mode": "block", "severity": 6.1, "slug": "pirate-forms", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2019-25214-01": {"ajax_action": "run_table_migration", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "run_table_migration"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2019-25214", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wpshopify", "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2019-25214-02": {"ajax_action": "run_table_migration", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "run_table_migration"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2019-25214", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpshopify", "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2019-25217-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/siteground-optimizer/v1/switch-php(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2019-25217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2019-25217", "description": "SG Optimizer <=5.0.12 unauthenticated PHP version switch via REST API", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sg-cachepress", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.0.12"}, "RULE-CVE-2019-25221-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2019-25221", "method": "GET", "mode": "block", "severity": 4.9, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2019-25221-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:media_type", "type": "detectSQLi"}], "cve": "CVE-2019-25221", "method": "POST", "mode": "block", "severity": 4.9, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2019-25221-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2019-25221", "method": "GET", "mode": "block", "severity": 4.9, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2019-25221-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:search_term", "type": "detectSQLi"}], "cve": "CVE-2019-25221", "method": "GET", "mode": "block", "severity": 4.9, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2019-25221-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:order_pos", "type": "detectSQLi"}], "cve": "CVE-2019-25221", "method": "GET", "mode": "block", "severity": 4.9, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2019-25221-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:order_by", "type": "detectSQLi"}], "cve": "CVE-2019-25221", "method": "GET", "mode": "block", "severity": 4.9, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2019-25314-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "duplicate_post_group"}, {"name": "ARGS:duplicate_post_title_prefix", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2019-25314", "description": "Duplicate Post <=3.2.3 authenticated admin+ stored XSS via duplicate_post_title_prefix setting", "mode": "block", "severity": 5.5, "slug": "duplicate-post", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2019-25314-02": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "duplicate_post_group"}, {"name": "ARGS:duplicate_post_title_suffix", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2019-25314", "description": "Duplicate Post <=3.2.3 authenticated admin+ stored XSS via duplicate_post_title_suffix setting", "mode": "block", "severity": 5.5, "slug": "duplicate-post", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2019-25314-03": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "duplicate_post_group"}, {"name": "ARGS:duplicate_post_increase_menu_order_by", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2019-25314", "description": "Duplicate Post <=3.2.3 authenticated admin+ stored XSS via duplicate_post_increase_menu_order_by setting", "mode": "block", "severity": 5.5, "slug": "duplicate-post", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2019-25314-04": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "duplicate_post_group"}, {"name": "ARGS:duplicate_post_blacklist", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2019-25314", "description": "Duplicate Post <=3.2.3 authenticated admin+ stored XSS via duplicate_post_blacklist setting", "mode": "block", "severity": 5.5, "slug": "duplicate-post", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2020-13641-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "real-time-find-and-replace"}, {"name": "ARGS:setup-update", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2020-13641", "description": "Real-Time Find and Replace <4.0.2 CSRF to stored XSS via farreplace parameter", "mode": "block", "severity": 8.8, "slug": "real-time-find-and-replace", "target": "plugin", "versions": "<4.0.2"}, "RULE-CVE-2020-13693-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:bbp-forum-role", "type": "regex", "value": "~(?:bbp_keymaster|bbp_moderator|bbp_spectator)~i"}], "cve": "CVE-2020-13693", "description": "bbPress <2.6.5 unauthenticated privilege escalation via bbp-forum-role parameter on wp-login.php registration", "mode": "block", "severity": 9.8, "slug": "bbpress", "target": "plugin", "versions": "<2.6.5"}, "RULE-CVE-2020-13693-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-signup\\\\.php~"}, {"name": "ARGS:bbp-forum-role", "type": "regex", "value": "~(?:bbp_keymaster|bbp_moderator|bbp_spectator)~i"}], "cve": "CVE-2020-13693", "description": "bbPress <2.6.5 unauthenticated privilege escalation via bbp-forum-role parameter on wp-signup.php (multisite)", "mode": "block", "severity": 9.8, "slug": "bbpress", "target": "plugin", "versions": "<2.6.5"}, "RULE-CVE-2020-15038-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "seed_csp4_settings_content"}, {"name": "ARGS:seed_csp4_settings_content[headline]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|img)[\\\\s/][^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2020-15038", "description": "SeedProd Coming Soon <5.1.1 stored XSS via seed_csp4_settings_content[headline]", "mode": "block", "severity": 5.4, "slug": "coming-soon", "target": "plugin", "versions": "<5.1.1"}, "RULE-CVE-2020-15038-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "seed_csp4_settings_content"}, {"name": "ARGS:seed_csp4_settings_content[description]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|img)[\\\\s/][^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2020-15038", "description": "SeedProd Coming Soon <5.1.1 stored XSS via seed_csp4_settings_content[description]", "mode": "block", "severity": 5.4, "slug": "coming-soon", "target": "plugin", "versions": "<5.1.1"}, "RULE-CVE-2020-15038-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "seed_csp4_settings_content"}, {"name": "ARGS:seed_csp4_settings_content[seo_title]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|img)[\\\\s/][^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2020-15038", "description": "SeedProd Coming Soon <5.1.1 stored XSS via seed_csp4_settings_content[seo_title]", "mode": "block", "severity": 5.4, "slug": "coming-soon", "target": "plugin", "versions": "<5.1.1"}, "RULE-CVE-2020-15038-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "seed_csp4_settings_content"}, {"name": "ARGS:seed_csp4_settings_content[seo_description]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|img)[\\\\s/][^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2020-15038", "description": "SeedProd Coming Soon <5.1.1 stored XSS via seed_csp4_settings_content[seo_description]", "mode": "block", "severity": 5.4, "slug": "coming-soon", "target": "plugin", "versions": "<5.1.1"}, "RULE-CVE-2020-15038-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "seed_csp4_settings_content"}, {"name": "ARGS:seed_csp4_settings_content[ga_analytics]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg|img)[\\\\s/][^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2020-15038", "description": "SeedProd Coming Soon <5.1.1 stored XSS via seed_csp4_settings_content[ga_analytics]", "mode": "block", "severity": 5.4, "slug": "coming-soon", "target": "plugin", "versions": "<5.1.1"}, "RULE-CVE-2020-28649-01": {"ajax_action": "orbisius_ctc_theme_editor_ajax", "conditions": [{"name": "ARGS:sub_cmd", "type": "equals", "value": "save_file"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\?(?:php|=)|<script[\\\\s/>]|<%(?: |=)~i"}], "cve": "CVE-2020-28649", "description": "Orbisius Child Theme Creator <1.5.2 CSRF via orbisius_ctc_theme_editor_manage_file allows arbitrary file write (save_file)", "mode": "block", "severity": 8.8, "slug": "orbisius-child-theme-creator", "target": "plugin", "versions": "<1.5.2"}, "RULE-CVE-2020-36730-01": {"ajax_action": "cmp_get_post_detail", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36730", "description": "CMP Coming Soon and Maintenance <=3.8.1 missing authorization on cmp_get_post_detail AJAX handler", "mode": "block", "severity": 9.3, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2020-36730-02": {"ajax_action": "niteo_export_csv", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36730", "description": "CMP Coming Soon and Maintenance <=3.8.1 missing authorization on niteo_export_csv AJAX handler", "mode": "block", "severity": 9.3, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2020-36730-03": {"ajax_action": "cmp_disable_comingsoon_ajax", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36730", "description": "CMP Coming Soon and Maintenance <=3.8.1 missing authorization on cmp_disable_comingsoon_ajax AJAX handler", "mode": "block", "severity": 9.3, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2020-36769-01": {"ajax_action": "import_widget_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "import_widget_data"}, {"name": "ARGS:import_file", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2020-36769", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widget-settings-importexport", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2020-36769-02": {"ajax_action": "import_widget_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "import_widget_data"}, {"name": "ARGS:widgets", "type": "regex", "value": "~(?i)(<\\\\s*script\\\\b|javascript\\\\s*:|on\\\\w+\\\\s*=)~"}], "cve": "CVE-2020-36769", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widget-settings-importexport", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2020-36837-01": {"action": "admin_init", "conditions": [{"name": "ARGS:do_reset_wordpress", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36837", "method": "GET", "mode": "block", "severity": 9.9, "slug": "themegrill-demo-importer", "target": "plugin", "versions": ">=1.3.4 <=1.6.1"}, "RULE-CVE-2020-36838-01": {"ajax_action": "update_options", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "update_options"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36838", "method": "POST", "mode": "block", "severity": 7.4, "slug": "facebook-messenger-customer-chat", "target": "plugin", "versions": "<1.6"}, "RULE-CVE-2020-36842-01": {"ajax_action": "wpvivid_upload_import_files", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpvivid_upload_import_files"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36842", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2020-36842", "description": "WPvivid Backup/Restore <=0.9.35 missing capability check on wpvivid_upload_import_files AJAX action allows low-privilege authenticated arbitrary ZIP upload and extraction.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpvivid-backuprestore", "tags": ["auth-arbitrary-file-upload", "missing-capability-check", "ajax"], "target": "plugin", "versions": "<=0.9.35"}, "RULE-CVE-2020-36842-02": {"ajax_action": "wpvivid_upload_files", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpvivid_upload_files"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36842", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2020-36842", "description": "WPvivid Backup/Restore <=0.9.35 missing capability check on wpvivid_upload_files AJAX action allows low-privilege authenticated arbitrary ZIP upload and extraction.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpvivid-backuprestore", "tags": ["auth-arbitrary-file-upload", "missing-capability-check", "ajax"], "target": "plugin", "versions": "<=0.9.35"}, "RULE-CVE-2020-36848-01": {"ajax_action": "boldgrid_backup_download", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2020-36848", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2020-36848", "description": "Total Upkeep by BoldGrid <=1.14.9 unauthenticated backup file download via boldgrid_backup_download AJAX action", "mode": "block", "severity": 7.5, "slug": "boldgrid-backup", "tags": ["information-disclosure", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.14.9"}, "RULE-CVE-2020-36848-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:cli/env-info\\\\.php|cron/restore-info\\\\.json)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-36848", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2020-36848", "description": "Total Upkeep by BoldGrid <=1.14.9 unauthenticated sensitive info exposure via direct access to env-info.php or restore-info.json (WordPress-routed requests only)", "mode": "block", "severity": 7.5, "slug": "boldgrid-backup", "tags": ["information-disclosure", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.14.9"}, "RULE-CVE-2020-7048-01": {"action": "init", "conditions": [{"name": "ARGS:db-reset-tables", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2020-7048", "description": "WP Database Reset <=3.1 unauthenticated database table reset via db-reset-tables[] parameter", "mode": "block", "severity": 9.1, "slug": "wordpress-database-reset", "tags": ["missing-authorization", "unauthenticated", "database-reset"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2020-9006-01": {"ajax_action": "import_popups", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2020-9006", "description": "Popup Builder <=2.6.7.6 missing authorization on import_popups allows subscriber+ SQL injection via PHP deserialization", "mode": "block", "severity": 9.8, "slug": "popup-builder", "target": "plugin", "versions": ">=2.2.8 <=2.6.7.6"}, "RULE-CVE-2020-9006-02": {"ajax_action": "import_popups", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2020-9006", "description": "Popup Builder <=2.6.7.6 PHP object injection via attachmentUrl in import_popups AJAX handler", "mode": "block", "severity": 9.8, "slug": "popup-builder", "target": "plugin", "versions": ">=2.2.8 <=2.6.7.6"}, "RULE-CVE-2021-24132-01": {"ajax_action": "WDSExport", "conditions": [{"name": "ARGS:current_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24132", "description": "Slider by 10Web <1.2.36 authenticated SQL injection via current_id in WDSExport AJAX handler", "mode": "block", "severity": 8.8, "slug": "slider-wd", "target": "plugin", "versions": "<1.2.36"}, "RULE-CVE-2021-24132-02": {"ajax_action": "WDSImport", "conditions": [{"name": "ARGS:current_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24132", "description": "Slider by 10Web <1.2.36 authenticated SQL injection via current_id in WDSImport AJAX handler", "mode": "block", "severity": 8.8, "slug": "slider-wd", "target": "plugin", "versions": "<1.2.36"}, "RULE-CVE-2021-24155-01": {"ajax_action": "backup_guard_importBackup", "conditions": [{"name": "FILES:files:name", "type": "regex", "value": "~^(?!.*\\\\.sgbp$).+$~"}], "cve": "CVE-2021-24155", "description": "Backup Guard <1.6.0 importBackup arbitrary-file upload; block filenames outside the SGBP backup format", "method": "POST", "mode": "block", "severity": 7.2, "slug": "backup", "target": "plugin", "versions": "<1.6.0"}, "RULE-CVE-2021-24188-01": {"ajax_action": "do_button_job_later", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2021-24188", "description": "WP Content Copy Protection & No Right Click <3.1.5 missing authorization on do_button_job_later allows subscriber+ plugin install/activate", "mode": "block", "severity": 8.8, "slug": "wp-content-copy-protector", "target": "plugin", "versions": "<3.1.5"}, "RULE-CVE-2021-24201-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|(?:javascript)\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)|on(?:error|load|mouseover|click|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2021-24201", "description": "Elementor Website Builder <3.1.4 contributor+ stored XSS via html_tag/header_size/title_size settings in save_builder", "mode": "block", "severity": 5.4, "slug": "elementor", "target": "plugin", "versions": "<3.1.4"}, "RULE-CVE-2021-24204-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\'](?:title_html_tag|header_size)[\\"\']\\\\s*:\\\\s*[\\"\'](?:script|style|iframe|object|embed|form|svg|math|base|link|meta|applet|[^\\"\']*[\\\\s=<>()])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2021-24204", "description": "Elementor <3.1.4 contributor+ stored XSS via unvalidated title_html_tag/header_size widget settings", "mode": "block", "severity": 5.4, "slug": "elementor", "target": "plugin", "versions": "<3.1.4"}, "RULE-CVE-2021-24205-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:title_size|title_html_tag|header_size|\\"html_tag\\")[\\"\']?\\\\s*[:\\\\]]+\\\\s*[\\"\']?(?:[^\\"\'}{]{0,60})(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2021-24205", "description": "Elementor Website Builder <3.1.4 contributor+ stored XSS via widget HTML tag settings (title_size, header_size, title_html_tag, html_tag) in save_builder request through elementor_ajax multiplexer", "mode": "block", "severity": 5.4, "slug": "elementor", "target": "plugin", "versions": "<3.1.4"}, "RULE-CVE-2021-24206-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:title_size|header_size|html_tag)[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*script[\\\\s>/]|javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2021-24206", "description": "Elementor <3.1.4 contributor+ stored XSS via title_size/header_size/html_tag widget settings", "mode": "block", "severity": 5.4, "slug": "elementor", "target": "plugin", "versions": "<3.1.4"}, "RULE-CVE-2021-24209-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpsupercache"}, {"name": "ARGS:wp_super_cache_location", "type": "regex", "value": "~(?:<\\\\?|\\\\?>|`|\\\\|\\\\s*\\\\w|;\\\\s*\\\\w|\\\\$\\\\(|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~"}], "cve": "CVE-2021-24209", "description": "WP Super Cache <1.7.2 authenticated RCE via PHP code injection in cache path (wp_super_cache_location)", "mode": "block", "severity": 7.2, "slug": "wp-super-cache", "target": "plugin", "versions": "<1.7.2"}, "RULE-CVE-2021-24217-01": {"action": "admin_post_nopriv_wp_async_send_server_event", "conditions": [{"name": "ARGS:event_data", "type": "regex", "value": "~^(?:Tzo|Qzo)[A-Za-z0-9+/]~"}], "cve": "CVE-2021-24217", "description": "Facebook for WordPress <3.0.0 unauthenticated PHP object injection via event_data deserialization in async server event handler", "mode": "block", "severity": 8.1, "slug": "official-facebook-pixel", "target": "plugin", "versions": "<3.0.0"}, "RULE-CVE-2021-24217-02": {"action": "admin_post_wp_async_send_server_event", "conditions": [{"name": "ARGS:event_data", "type": "regex", "value": "~^(?:Tzo|Qzo)[A-Za-z0-9+/]~"}], "cve": "CVE-2021-24217", "description": "Facebook for WordPress <3.0.0 authenticated PHP object injection via event_data deserialization in async server event handler", "mode": "block", "severity": 8.1, "slug": "official-facebook-pixel", "target": "plugin", "versions": "<3.0.0"}, "RULE-CVE-2021-24280-01": {"ajax_action": "import_from_debug", "conditions": [{"name": "ARGS:data[debug_info]", "type": "regex", "value": "~(?:Tzo[0-9A-Za-z+/]|Qzo[0-9A-Za-z+/]|[A-Za-z0-9+/]*[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{])~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24280", "description": "Redirection for Contact Form 7 <2.3.4 authenticated PHP object injection via import_from_debug AJAX action", "mode": "block", "severity": 8.8, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.3.4"}, "RULE-CVE-2021-24376-01": {"ajax_action": "ao_ccss_import", "conditions": [{"name": "FILES:file:content", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)~i"}], "cve": "CVE-2021-24376", "description": "Autoptimize <2.7.8 authenticated RCE via malicious ZIP upload containing nested PHP files in Import Settings", "mode": "block", "severity": 9.8, "slug": "autoptimize", "target": "plugin", "versions": "<2.7.8"}, "RULE-CVE-2021-24376-02": {"ajax_action": "ao_ccss_import", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$~i"}], "cve": "CVE-2021-24376", "description": "Autoptimize <2.7.8 authenticated RCE via direct PHP file upload in Import Settings", "mode": "block", "severity": 9.8, "slug": "autoptimize", "target": "plugin", "versions": "<2.7.8"}, "RULE-CVE-2021-24436-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "w3tc_extensions"}, {"name": "ARGS:extension", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|animationend|transitionend)\\\\s*=|javascript\\\\s*:|%22|%3[Cc]\\\\s*script)~i"}], "cve": "CVE-2021-24436", "description": "W3 Total Cache <2.1.4 reflected XSS via extension parameter on Extensions dashboard", "mode": "block", "severity": 6.1, "slug": "w3-total-cache", "target": "plugin", "versions": "<2.1.4"}, "RULE-CVE-2021-24565-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cf7sr_settings"}, {"name": "ARGS:cf7sr_save", "type": "exists"}, {"name": "ARGS:cf7sr_site_key", "type": "regex", "value": "~[\\"\'<>/=;()\\\\\\\\]|on[a-z]+=|javascript\\\\s*:|&#~i"}], "cve": "CVE-2021-24565", "description": "Contact Form 7 Captcha <0.0.9 CSRF to stored XSS via cf7sr_site_key settings parameter", "mode": "block", "severity": 8.8, "slug": "contact-form-7-simple-recaptcha", "target": "plugin", "versions": "<0.0.9"}, "RULE-CVE-2021-24565-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cf7sr_settings"}, {"name": "ARGS:cf7sr_save", "type": "exists"}, {"name": "ARGS:cf7sr_secret", "type": "regex", "value": "~[\\"\'<>/=;()\\\\\\\\]|on[a-z]+=|javascript\\\\s*:|&#~i"}], "cve": "CVE-2021-24565", "description": "Contact Form 7 Captcha <0.0.9 CSRF to stored XSS via cf7sr_secret settings parameter", "mode": "block", "severity": 8.8, "slug": "contact-form-7-simple-recaptcha", "target": "plugin", "versions": "<0.0.9"}, "RULE-CVE-2021-24565-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cf7sr_settings"}, {"name": "ARGS:cf7sr_save", "type": "exists"}, {"name": "ARGS:cf7sr_theme", "type": "regex", "value": "~[\\"\'<>/=;()\\\\\\\\]|on[a-z]+=|javascript\\\\s*:|&#~i"}], "cve": "CVE-2021-24565", "description": "Contact Form 7 Captcha <0.0.9 CSRF to stored XSS via cf7sr_theme settings parameter", "mode": "block", "severity": 8.8, "slug": "contact-form-7-simple-recaptcha", "target": "plugin", "versions": "<0.0.9"}, "RULE-CVE-2021-24584-01": {"ajax_action": "route_url", "conditions": [{"name": "ARGS:controller", "type": "equals", "value": "events"}, {"name": "ARGS:mptt_action", "type": "equals", "value": "update_event_data"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24584", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2021-24585-01": {"ajax_action": "route_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:controller", "type": "equals", "value": "events"}, {"name": "ARGS:mptt_action", "type": "equals", "value": "get_event_data"}], "cve": "CVE-2021-24585", "mode": "block", "severity": 6.5, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.3.19"}, "RULE-CVE-2021-24684-01": {"ajax_action": "_ping_import", "conditions": [{"name": "ARGS:pdf_file_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2021-24684", "description": "PDF Light Viewer <1.4.12 authenticated OS command injection via Ghostscript path in ping_import AJAX handler", "mode": "block", "severity": 8.8, "slug": "pdf-light-viewer", "target": "plugin", "versions": "<1.4.12"}, "RULE-CVE-2021-24721-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^loco[-_]~"}, {"name": "ARGS:dest", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|user\\\\.ini)(?:\\\\?|$|\\\\s)~i"}], "cve": "CVE-2021-24721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24721", "description": "Loco Translate <2.5.4 authenticated code injection via file rename to .php extension", "mode": "block", "severity": 6.5, "slug": "loco-translate", "tags": ["code-injection", "authenticated", "file-rename"], "target": "plugin", "versions": "<2.5.4"}, "RULE-CVE-2021-24721-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^loco[-_]~"}, {"name": "ARGS:path", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|user\\\\.ini)(?:\\\\?|$|\\\\s)~i"}], "cve": "CVE-2021-24721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24721", "description": "Loco Translate <2.5.4 authenticated code injection via file save to .php path", "mode": "block", "severity": 6.5, "slug": "loco-translate", "tags": ["code-injection", "authenticated", "file-save"], "target": "plugin", "versions": "<2.5.4"}, "RULE-CVE-2021-24847-01": {"ajax_action": "importFromRedirection", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2021-24847", "description": "SEO Redirection Plugin <8.2 authenticated SQL injection via offset parameter in importFromRedirection AJAX handler", "mode": "block", "severity": 8.8, "slug": "seo-redirection", "target": "plugin", "versions": "<8.2"}, "RULE-CVE-2021-24849-01": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:radius_lat", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24849", "description": "Block SQL injection via wcfm_ajax_controller \\u2013 radius_lat parameter", "mode": "block", "severity": 9.8, "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<3.4.12"}, "RULE-CVE-2021-24849-02": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:radius_lng", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24849", "description": "Block SQL injection via wcfm_ajax_controller \\u2013 radius_lng parameter", "mode": "block", "severity": 9.8, "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<3.4.12"}, "RULE-CVE-2021-24849-03": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:radius_range", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24849", "description": "Block SQL injection via wcfm_ajax_controller \\u2013 radius_range parameter", "mode": "block", "severity": 9.8, "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<3.4.12"}, "RULE-CVE-2021-24849-04": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:radius_addr", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24849", "description": "Block SQL injection via wcfm_ajax_controller \\u2013 radius_addr parameter", "mode": "block", "severity": 9.8, "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<3.4.12"}, "RULE-CVE-2021-24849-05": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:wcfmmp_store_search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24849", "description": "Block SQL injection via wcfm_ajax_controller \\u2013 wcfmmp_store_search parameter", "mode": "block", "severity": 9.8, "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<3.4.12"}, "RULE-CVE-2021-24849-06": {"ajax_action": "wcfmmp_stores_list_search", "conditions": [{"name": "ARGS:wcfmmp_store_search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2021-24849", "description": "Block SQL injection via wcfmmp_stores_list_search \\u2013 wcfmmp_store_search parameter", "mode": "block", "severity": 9.8, "slug": "wc-multivendor-marketplace", "target": "plugin", "versions": "<3.4.12"}, "RULE-CVE-2021-24862-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rm_chronos_ajax"}, {"name": "ARGS:task_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|--|/\\\\*|#)~i"}], "cve": "CVE-2021-24862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24862", "description": "RegistrationMagic <5.0.1.6 authenticated SQL injection via rm_chronos_ajax action (task_ids scalar parameter, batch task duplication)", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<5.0.1.6"}, "RULE-CVE-2021-24862-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rm_chronos_ajax"}, {"name": "ARGS:task_ids[0]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|--|/\\\\*)~i"}], "cve": "CVE-2021-24862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24862", "description": "RegistrationMagic <5.0.1.6 authenticated SQL injection via rm_chronos_ajax action (task_ids array parameter, batch task duplication)", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<5.0.1.6"}, "RULE-CVE-2021-24905-01": {"ajax_action": "acf7_db_edit_scr_file_delete", "conditions": [{"type": "missing_capability", "value": "wpcf7_read_contact_forms"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24905", "description": "Advanced Contact form 7 DB <1.8.7 authenticated arbitrary file deletion via acf7_db_edit_scr_file_delete AJAX action", "mode": "block", "severity": 8.0, "slug": "advanced-cf7-db", "tags": ["missing-authorization", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<1.8.7"}, "RULE-CVE-2021-24914-01": {"ajax_action": "tawkto_setwidget", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24914", "description": "Tawk.To Live Chat <0.6.0 missing authorization on tawkto_setwidget AJAX action allows subscriber+ to hijack live chat widget", "mode": "block", "severity": 8.0, "slug": "tawkto-live-chat", "target": "plugin", "versions": "<0.6.0"}, "RULE-CVE-2021-24914-02": {"ajax_action": "tawkto_removewidget", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24914", "description": "Tawk.To Live Chat <0.6.0 missing authorization on tawkto_removewidget AJAX action allows subscriber+ to remove live chat widget", "mode": "block", "severity": 8.0, "slug": "tawkto-live-chat", "target": "plugin", "versions": "<0.6.0"}, "RULE-CVE-2021-24922-01": {"ajax_action": "fca_pc_uninstall", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24922", "description": "Pixel Cat <=2.4.2 missing authorization on fca_pc_uninstall AJAX handler allows subscriber+ plugin data deletion", "mode": "block", "severity": 9.0, "slug": "facebook-conversion-pixel", "target": "plugin", "versions": "<2.6.2"}, "RULE-CVE-2021-24951-01": {"ajax_action": "learnpress_duplicate_post", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:[\'\\");]|\\\\s+(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2021-24951", "description": "LearnPress <4.1.4 authenticated SQL injection via id parameter in course/lesson/quiz/question duplication AJAX handler", "mode": "block", "severity": 9.8, "slug": "learnpress", "target": "plugin", "versions": "<4.1.4"}, "RULE-CVE-2021-24959-01": {"ajax_action": "weu_selected_users_1", "conditions": [{"name": "ARGS:data_raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[!+]|CONCAT\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24959", "description": "WP Email Users <=1.7.6 authenticated SQL injection via data_raw in weu_selected_users_1 AJAX action", "mode": "block", "severity": 8.8, "slug": "wp-email-users", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2021-24959-02": {"ajax_action": "weu_send_mail_selected_users", "conditions": [{"name": "ARGS:subject", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[!+]|CONCAT\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24959", "description": "WP Email Users <=1.7.6 authenticated SQL injection via subject in weu_send_mail_selected_users AJAX action", "mode": "block", "severity": 8.8, "slug": "wp-email-users", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2021-24959-03": {"ajax_action": "weu_send_mail_selected_users", "conditions": [{"name": "ARGS:template_name", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[!+]|CONCAT\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24959", "description": "WP Email Users <=1.7.6 authenticated SQL injection via template_name in weu_send_mail_selected_users AJAX action", "mode": "block", "severity": 8.8, "slug": "wp-email-users", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2021-24963-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin.php"}, {"name": "ARGS:qc_res", "type": "exists"}, {"name": "ARGS:qc_res", "type": "regex", "value": "~[<>\\"\'`]|(?:on\\\\w+=)|(?:javascript\\\\s*:)|(?:<\\\\s*script)~i"}], "cve": "CVE-2021-24963", "description": "LiteSpeed Cache < 4.4.4 - Reflected XSS via qc_res parameter in admin page (Cloud::update_is_linked_status)", "mode": "block", "severity": 4.8, "slug": "litespeed-cache", "target": "plugin", "versions": "<4.4.4"}, "RULE-CVE-2021-24994-01": {"ajax_action": "wpvivid_add_remote", "conditions": [{"name": "ARGS:remote", "type": "regex", "value": "~<(?:script|img|svg|iframe|embed|object|video|audio|body|input|details|math|marquee|a|div|p|table|form|base|link|meta|style|isindex|textarea|button|select|keygen)[^>a-zA-Z]|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|beforeunload|hashchange|unload|resize|scroll|copy|cut|paste|drag|drop|play|seeking|toggle|wheel|pointer|animation|transition)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24994", "description": "WPvivid Backup & Migration <0.9.69 unauthenticated stored XSS via wpvivid_add_remote AJAX action (remote parameter)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wpvivid-backuprestore", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<0.9.69"}, "RULE-CVE-2021-24994-02": {"ajax_action": "wpvivid_edit_remote", "conditions": [{"name": "ARGS:remote", "type": "regex", "value": "~<(?:script|img|svg|iframe|embed|object|video|audio|body|input|details|math|marquee|a|div|p|table|form|base|link|meta|style|isindex|textarea|button|select|keygen)[^>a-zA-Z]|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|beforeunload|hashchange|unload|resize|scroll|copy|cut|paste|drag|drop|play|seeking|toggle|wheel|pointer|animation|transition)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24994", "description": "WPvivid Backup & Migration <0.9.69 unauthenticated stored XSS via wpvivid_edit_remote AJAX action (remote parameter)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wpvivid-backuprestore", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<0.9.69"}, "RULE-CVE-2021-24994-03": {"ajax_action": "wpvivid_edit_remote", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~<(?:script|img|svg|iframe|embed|object|video|audio|body|input|details|math|marquee|a|div|p|table|form|base|link|meta|style|isindex|textarea|button|select|keygen)[^>a-zA-Z]|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|beforeunload|hashchange|unload|resize|scroll|copy|cut|paste|drag|drop|play|seeking|toggle|wheel|pointer|animation|transition)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-24994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-24994", "description": "WPvivid Backup & Migration <0.9.69 unauthenticated stored XSS via wpvivid_edit_remote AJAX action (id parameter)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wpvivid-backuprestore", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<0.9.69"}, "RULE-CVE-2021-25052-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "button-generation"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:data|https?|php|phar|expect|zip|ftp)://|(?:wp-config|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2021-25052", "description": "Button Generator <2.3.3 CSRF to RCE via arbitrary file inclusion in admin tab parameter", "mode": "block", "severity": 8.8, "slug": "button-generation", "target": "plugin", "versions": "<2.3.3"}, "RULE-CVE-2021-25082-01": {"ajax_action": "sgpb_autosave", "conditions": [{"name": "ARGS:allPopupData[sgpb_type]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|(?:phar|php|data|expect|zip|glob|rar|ssh2|ogg|zlib|compress\\\\.zlib|compress\\\\.bzip2)://)~i"}], "cve": "CVE-2021-25082", "description": "Popup Builder < 4.0.7 - Local File Inclusion (LFI) via sgpb_type parameter in autosave AJAX handler", "mode": "block", "severity": 8.8, "slug": "popup-builder", "target": "plugin", "versions": "<4.0.7"}, "RULE-CVE-2021-25114-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pmpro/v1/discount_code(?:/|\\\\?|$)~"}, {"name": "ARGS:discount_code", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*[0-9a-zA-Z\'\\"]+\\\\s*=\\\\s*[0-9a-zA-Z\'\\"]+|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2021-25114", "description": "Paid Memberships Pro <2.6.7 unauthenticated SQL injection via discount_code parameter in REST route /discount_code", "mode": "block", "severity": 9.8, "slug": "paid-memberships-pro", "target": "plugin", "versions": "<2.6.7"}, "RULE-CVE-2021-25114-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pmpro/v1/checkout_level(?:/|\\\\?|$)~"}, {"name": "ARGS:discount_code", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*[0-9a-zA-Z\'\\"]+\\\\s*=\\\\s*[0-9a-zA-Z\'\\"]+|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2021-25114", "description": "Paid Memberships Pro <2.6.7 unauthenticated SQL injection via discount_code parameter in REST route /checkout_level", "mode": "block", "severity": 9.8, "slug": "paid-memberships-pro", "target": "plugin", "versions": "<2.6.7"}, "RULE-CVE-2021-25114-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pmpro/v1/checkout_level(?:/|\\\\?|$)~"}, {"name": "ARGS:level_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*[0-9a-zA-Z\'\\"]+\\\\s*=\\\\s*[0-9a-zA-Z\'\\"]+|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2021-25114", "description": "Paid Memberships Pro <2.6.7 unauthenticated SQL injection via level_id parameter in REST route /checkout_level", "mode": "block", "severity": 9.8, "slug": "paid-memberships-pro", "target": "plugin", "versions": "<2.6.7"}, "RULE-CVE-2021-34624-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pp_registration"}, {"name": "FILES:profile_picture:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2021-34624", "description": "ProfilePress <=3.1.3 unauthenticated arbitrary file upload via registration profile_picture", "mode": "block", "severity": 9.8, "slug": "wp-user-avatar", "target": "plugin", "versions": ">=3.0.0 <=3.1.3"}, "RULE-CVE-2021-34624-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pp_profile_update"}, {"name": "FILES:profile_picture:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2021-34624", "description": "ProfilePress <=3.1.3 subscriber+ arbitrary file upload via profile update profile_picture", "mode": "block", "severity": 9.8, "slug": "wp-user-avatar", "target": "plugin", "versions": ">=3.0.0 <=3.1.3"}, "RULE-CVE-2021-34628-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "admin_custom_login"}, {"name": "ARGS:Action", "type": "equals", "value": "loginbgSave"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2021-34628", "description": "Admin Custom Login <=3.2.7 CSRF to stored XSS via loginbgSave settings handler", "mode": "block", "severity": 8.8, "slug": "admin-custom-login", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2021-34648-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-submissions/email-action~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-34648", "description": "Ninja Forms <= 3.5.7 - Missing Authorization on REST email-action endpoint (CWE-862). Any authenticated user (subscriber+) can send arbitrary emails via /ninja-forms-submissions/email-action because permission_callback only checks is_user_logged_in(). Patch adds current_user_can() capability check.", "mode": "block", "severity": 6.4, "slug": "ninja-forms", "target": "plugin", "versions": "<3.5.8"}, "RULE-CVE-2021-36886-01": {"action": "admin_init", "conditions": [{"name": "ARGS:cfdb7_ignore_notice", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36886", "description": "Contact Form 7 Database Addon \\u2013 CFDB7 <=1.2.5.9 CSRF via cfdb7_ignore_notice parameter allows unauthorized option update", "mode": "block", "severity": 8.8, "slug": "contact-form-cfdb7", "target": "plugin", "versions": "<=1.2.5.9"}, "RULE-CVE-2021-36913-01": {"ajax_action": "wpcf7r_add_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36913", "description": "Block unauthorized access to wpcf7r_add_action AJAX handler (missing capability check)", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.6.0"}, "RULE-CVE-2021-36913-02": {"ajax_action": "wpcf7r_delete_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36913", "description": "Block unauthorized access to wpcf7r_delete_action AJAX handler (missing capability check)", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.6.0"}, "RULE-CVE-2021-36913-03": {"ajax_action": "wpcf7r_duplicate_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36913", "description": "Block unauthorized access to wpcf7r_duplicate_action AJAX handler (missing capability check)", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.6.0"}, "RULE-CVE-2021-36913-04": {"ajax_action": "wpcf7r_set_action_menu_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36913", "description": "Block unauthorized access to wpcf7r_set_action_menu_order AJAX handler (missing capability check)", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.6.0"}, "RULE-CVE-2021-36913-05": {"ajax_action": "wpcf7r_make_api_test", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36913", "description": "Block unauthorized access to wpcf7r_make_api_test AJAX handler (missing capability check)", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.6.0"}, "RULE-CVE-2021-36913-06": {"ajax_action": "wpcf7r_get_action_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-36913", "description": "Block unauthorized access to wpcf7r_get_action_template AJAX handler (missing capability check)", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<2.6.0"}, "RULE-CVE-2021-39317-01": {"ajax_action": "plugin_offline_installer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-39317", "description": "Access Demo Importer <=1.0.6 subscriber+ arbitrary file upload and plugin activation via plugin_offline_installer AJAX action", "mode": "block", "severity": 8.8, "slug": "access-demo-importer", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2021-39352-01": {"ajax_action": "ctdi_import_demo_data", "conditions": [{"name": "FILES:content_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2021-39352", "description": "Catch Themes Demo Import <=1.7 authenticated arbitrary file upload via ctdi_import_demo_data AJAX handler", "mode": "block", "severity": 7.2, "slug": "catch-themes-demo-import", "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2021-42362-01": {"ajax_action": "add-meta", "conditions": [{"name": "ARGS:metakeyselect", "type": "equals", "value": "wpp_thumbnail"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~^https?://[^/?#\\\\s]+(?::[0-9]{1,5})?(?:/[^?#\\\\s]*)*\\\\.(?:jpe?g|gif|png)\\\\.(?:php(?:[0-9]{1,2})?|phtml|pht|phar)(?:[?#][^\\\\s]*)?$~i"}], "cve": "CVE-2021-42362", "description": "WordPress Popular Posts <=5.3.2: block the source- and published-PoC-proven WordPress core add-meta write of the configured wpp_thumbnail custom field when its external URL uses the GIF/JPEG/PNG plus PHP-family double-extension chain. Image::get later reads this field and Image::fetch_external_image writes the fetched filename.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wordpress-popular-posts", "target": "plugin", "versions": "<=5.3.2"}, "RULE-CVE-2021-42362-02": {"ajax_action": "add-meta", "conditions": [{"name": "ARGS:metakeyinput", "type": "equals", "value": "wpp_thumbnail"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~^https?://[^/?#\\\\s]+(?::[0-9]{1,5})?(?:/[^?#\\\\s]*)*\\\\.(?:jpe?g|gif|png)\\\\.(?:php(?:[0-9]{1,2})?|phtml|pht|phar)(?:[?#][^\\\\s]*)?$~i"}], "cve": "CVE-2021-42362", "description": "WordPress Popular Posts <=5.3.2: same source- and published-PoC-proven protection when WordPress receives wpp_thumbnail through the manual metakeyinput field rather than the selected-key field.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wordpress-popular-posts", "target": "plugin", "versions": "<=5.3.2"}, "RULE-CVE-2021-4333-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:activate|deactivate)$~i"}, {"name": "ARGS:plugin", "type": "exists"}], "cve": "CVE-2021-4333", "description": "WP Statistics <=13.1.1 CSRF via view() allows unauthenticated plugin activation/deactivation", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.1"}, "RULE-CVE-2021-4338-01": {"ajax_action": "jj4t3_redirect_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-4338", "description": "404 to 301 <=3.0.7 missing authorization on jj4t3_redirect_form AJAX action", "mode": "block", "severity": 5.4, "slug": "404-to-301", "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2021-4338-02": {"ajax_action": "jj4t3_redirect_thickbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-4338", "description": "404 to 301 <=3.0.7 missing authorization on jj4t3_redirect_thickbox AJAX action", "mode": "block", "severity": 5.4, "slug": "404-to-301", "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2021-4347-01": {"ajax_action": "update_shipment_status_email_status", "conditions": [{"name": "ARGS:option_name", "type": "regex", "value": "~^(?!wcast_)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-4347", "description": "Advanced Shipment Tracking for WooCommerce <=3.2.6 authenticated arbitrary options update via update_shipment_status_email_status", "mode": "block", "slug": "woo-advanced-shipment-tracking", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2021-4444-01": {"ajax_action": "woofilters_save", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "woofilters"}, {"name": "ARGS:filter_name", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-4444", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woo-product-filter", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2021-4444-02": {"ajax_action": "woofilters_update", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "woofilters"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-4444", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woo-product-filter", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2021-4444-03": {"ajax_action": "woofilters_delete", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "woofilters"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2021-4444", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woo-product-filter", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2021-4446-01": {"ajax_action": "wpdeveloper_install_plugin", "conditions": [{"name": "ARGS:slug", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2021-4446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-4446", "description": "Essential Addons for Elementor Lite <= 4.6.4 missing authorization on AJAX plugin installation via wpdeveloper_install_plugin, allowing low-privilege users to install arbitrary plugins.", "method": "POST", "mode": "block", "severity": 6.3, "slug": "essential-addons-for-elementor-lite", "tags": ["authz-bypass", "missing-capability-check", "wordpress-ajax"], "target": "plugin", "versions": "<=4.6.4"}, "RULE-CVE-2021-4446-02": {"ajax_action": "wpdeveloper_activate_plugin", "conditions": [{"name": "ARGS:basename", "type": "exists"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2021-4446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-4446", "description": "Essential Addons for Elementor Lite <= 4.6.4 missing authorization on AJAX plugin activation via wpdeveloper_activate_plugin, enabling low-privilege users to activate installed plugins.", "method": "POST", "mode": "block", "severity": 6.3, "slug": "essential-addons-for-elementor-lite", "tags": ["authz-bypass", "missing-capability-check", "wordpress-ajax"], "target": "plugin", "versions": "<=4.6.4"}, "RULE-CVE-2021-4446-03": {"ajax_action": "wpdeveloper_upgrade_plugin", "conditions": [{"name": "ARGS:basename", "type": "exists"}, {"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2021-4446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2021-4446", "description": "Essential Addons for Elementor Lite <= 4.6.4 missing authorization on AJAX plugin upgrade via wpdeveloper_upgrade_plugin, enabling low-privilege users to trigger plugin upgrades.", "method": "POST", "mode": "block", "severity": 6.3, "slug": "essential-addons-for-elementor-lite", "tags": ["authz-bypass", "missing-capability-check", "wordpress-ajax"], "target": "plugin", "versions": "<=4.6.4"}, "RULE-CVE-2021-4450-01A": {"ajax_action": "post_grid_ajax_fetch_block_hub_by_id", "conditions": [{"name": "ARGS:meta_key", "type": "exists"}, {"name": "ARGS:meta_value", "type": "exists"}, {"name": "ARGS:meta_key", "type": "detectSQLi"}], "cve": "CVE-2021-4450", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid", "target": "plugin", "versions": "<=2.1.12"}, "RULE-CVE-2021-4450-01B": {"ajax_action": "post_grid_ajax_fetch_block_hub_by_id", "conditions": [{"name": "ARGS:meta_key", "type": "exists"}, {"name": "ARGS:meta_value", "type": "exists"}, {"name": "ARGS:meta_value", "type": "detectSQLi"}], "cve": "CVE-2021-4450", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid", "target": "plugin", "versions": "<=2.1.12"}, "RULE-CVE-2021-47933-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_woo/config[_-]file(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|(?:^|\\\\.)user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2021-47933", "description": "MStore API <=2.0.6 unauthenticated arbitrary PHP file upload via REST config_file endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2022-0141-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:trash|delete|restore|untrash)$~i"}, {"name": "ARGS:entry", "type": "exists"}, {"name": "ARGS:page", "type": "contains", "value": "visual-form-builder"}], "cve": "CVE-2022-0141", "description": "Visual Form Builder <3.0.8 CSRF entry delete/restore via save_action on admin_init", "mode": "block", "severity": 8.1, "slug": "visual-form-builder", "target": "plugin", "versions": "<3.0.8"}, "RULE-CVE-2022-0141-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:trash|delete|restore|untrash)$~i"}, {"name": "ARGS:form", "type": "exists"}, {"name": "ARGS:page", "type": "contains", "value": "visual-form-builder"}], "cve": "CVE-2022-0141", "description": "Visual Form Builder <3.0.8 CSRF form trash/delete/restore via save_trash_delete_form on admin_init", "mode": "block", "severity": 8.1, "slug": "visual-form-builder", "target": "plugin", "versions": "<3.0.8"}, "RULE-CVE-2022-0165-01": {"ajax_action": "kc_get_thumbn", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:^\\\\s*(?:[a-zA-Z][a-zA-Z0-9+.-]*:|//|/\\\\\\\\|\\\\\\\\)|://|:%2[fF]%2[fF]|%5[cC]|%2[fF]%5[cC]|@)~"}], "cve": "CVE-2022-0165", "description": "KingComposer <=2.9.6 unauthenticated open redirect via kc_get_thumbn AJAX action id parameter", "mode": "block", "severity": 6.1, "slug": "kingcomposer", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2022-0165-02": {"ajax_action": "kc_get_thumbn_size", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:^\\\\s*(?:[a-zA-Z][a-zA-Z0-9+.-]*:|//|/\\\\\\\\|\\\\\\\\)|://|:%2[fF]%2[fF]|%5[cC]|%2[fF]%5[cC]|@)~"}], "cve": "CVE-2022-0165", "description": "KingComposer <=2.9.6 unauthenticated open redirect via kc_get_thumbn_size AJAX action id parameter", "mode": "block", "severity": 6.1, "slug": "kingcomposer", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2022-0228-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "sgpb-"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:SELECT|SLEEP|EXTRACTVALUE|CONCAT|IF\\\\s*\\\\(|CASE\\\\s+WHEN|BENCHMARK|0x[0-9a-fA-F]+|;|\\\\(|UNION\\\\s+(?:ALL\\\\s+)?SELECT)~i"}], "cve": "CVE-2022-0228", "description": "Popup Builder <4.0.7 authenticated SQL injection via orderby parameter in admin list table", "mode": "block", "severity": 7.2, "slug": "popup-builder", "target": "plugin", "versions": "<4.0.7"}, "RULE-CVE-2022-0228-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "sgpb-"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:SELECT|SLEEP|EXTRACTVALUE|CONCAT|IF\\\\s*\\\\(|CASE\\\\s+WHEN|BENCHMARK|0x[0-9a-fA-F]+|;|\\\\(|UNION\\\\s+(?:ALL\\\\s+)?SELECT)~i"}], "cve": "CVE-2022-0228", "description": "Popup Builder <4.0.7 authenticated SQL injection via order parameter in admin list table", "mode": "block", "severity": 7.2, "slug": "popup-builder", "target": "plugin", "versions": "<4.0.7"}, "RULE-CVE-2022-0320-01": {"ajax_action": "load_more", "conditions": [{"name": "ARGS:template_info[file_name]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[a-z]+://~i"}], "cve": "CVE-2022-0320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-0320", "description": "Essential Addons for Elementor <=5.0.4 unauthenticated LFI via load_more templateInfo[file_name]", "mode": "block", "severity": 9.8, "slug": "essential-addons-for-elementor-lite", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-0320-02": {"ajax_action": "load_more", "conditions": [{"name": "ARGS:template_info[name]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[a-z]+://~i"}], "cve": "CVE-2022-0320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-0320", "description": "Essential Addons for Elementor <=5.0.4 unauthenticated LFI via load_more template_info[name]", "mode": "block", "severity": 9.8, "slug": "essential-addons-for-elementor-lite", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-0320-03": {"ajax_action": "woo_product_pagination_product", "conditions": [{"name": "ARGS:templateInfo[file_name]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[a-z]+://~i"}], "cve": "CVE-2022-0320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-0320", "description": "Essential Addons for Elementor <=5.0.4 unauthenticated LFI via woo_product_pagination_product templateInfo[file_name]", "mode": "block", "severity": 9.8, "slug": "essential-addons-for-elementor-lite", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-0320-04": {"ajax_action": "woo_product_pagination_product", "conditions": [{"name": "ARGS:templateInfo[name]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[a-z]+://~i"}], "cve": "CVE-2022-0320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-0320", "description": "Essential Addons for Elementor <=5.0.4 unauthenticated LFI via woo_product_pagination_product templateInfo[name]", "mode": "block", "severity": 9.8, "slug": "essential-addons-for-elementor-lite", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-0320-05": {"ajax_action": "woo_product_pagination", "conditions": [{"name": "ARGS:template_info[file_name]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[a-z]+://~i"}], "cve": "CVE-2022-0320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-0320", "description": "Essential Addons for Elementor <=5.0.4 unauthenticated LFI via woo_product_pagination template_info[file_name]", "mode": "block", "severity": 9.8, "slug": "essential-addons-for-elementor-lite", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-0320-06": {"ajax_action": "woo_product_pagination", "conditions": [{"name": "ARGS:template_info[name]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[a-z]+://~i"}], "cve": "CVE-2022-0320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-0320", "description": "Essential Addons for Elementor <=5.0.4 unauthenticated LFI via woo_product_pagination template_info[name]", "mode": "block", "severity": 9.8, "slug": "essential-addons-for-elementor-lite", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-0439-01": {"ajax_action": "ajax_fetch_report_list", "conditions": [{"name": "ARGS:order", "type": "exists"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|MAKE_SET|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s)~i"}], "cve": "CVE-2022-0439", "description": "Email Subscribers & Newsletters < 5.3.2 - Blind SQL Injection via ajax_fetch_report_list (order param)", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "target": "plugin", "versions": "<5.3.2"}, "RULE-CVE-2022-0439-02": {"ajax_action": "ajax_fetch_report_list", "conditions": [{"name": "ARGS:orderby", "type": "exists"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|MAKE_SET|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s)~i"}], "cve": "CVE-2022-0439", "description": "Email Subscribers & Newsletters < 5.3.2 - Blind SQL Injection via ajax_fetch_report_list (orderby param)", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "target": "plugin", "versions": "<5.3.2"}, "RULE-CVE-2022-0441-01": {"ajax_action": "stm_lms_register", "conditions": [{"name": "ARGS:register_as", "type": "regex", "value": "~^(?!(?:student|instructor)$).+~i"}], "cve": "CVE-2022-0441", "description": "MasterStudy LMS <2.7.6 unauthenticated privilege escalation via register_as parameter in stm_lms_register", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<2.7.6"}, "RULE-CVE-2022-0479-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "sgpbSubscribers"}, {"name": "ARGS:sgpb-subscription-popup-id", "type": "regex", "value": "~(?:(?:^|[^[:alnum:]_])(?:union(?:[[:space:]]+all)?[[:space:]]+select|(?:or|and)[[:space:]]+[0-9]+[[:space:]]*=[[:space:]]*[0-9]+)|--[[:space:]]|#[[:space:]]|/[*])~i"}], "cve": "CVE-2022-0479", "description": "Popup Builder subscriber filter SQL injection via the popup ID parameter", "method": "GET", "mode": "block", "severity": 9.8, "slug": "popup-builder", "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2022-0531-01A": {"action": "admin_menu", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^(?i)wpvivid$~"}, {"name": "ARGS:sub_page", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2022-0531", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.69"}, "RULE-CVE-2022-0531-01B": {"action": "admin_menu", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^(?i)wpvivid$~"}, {"name": "ARGS:sub_tab", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2022-0531", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.69"}, "RULE-CVE-2022-0633-01": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[updraftplus]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-0633", "description": "UpdraftPlus <1.22.3 authenticated information disclosure via heartbeat API leaking backup nonce", "mode": "block", "severity": 6.5, "slug": "updraftplus", "target": "plugin", "versions": "<1.22.3"}, "RULE-CVE-2022-0633-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:action", "type": "equals", "value": "updraft_download_backup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-0633", "description": "UpdraftPlus <1.22.3 authenticated arbitrary backup download via updraft_download_backup", "mode": "block", "severity": 6.5, "slug": "updraftplus", "target": "plugin", "versions": "<1.22.3"}, "RULE-CVE-2022-0651-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?&]|$)~"}, {"name": "ARGS:current_page_id", "type": "regex", "value": "~(?:[^0-9](?:SLEEP|BENCHMARK|UNION|SELECT|IF|CASE|WHEN|CONCAT|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*|--|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2022-0651", "description": "WP Statistics <=13.1.5 unauthenticated SQL injection via current_page_id in REST hit endpoint", "mode": "block", "severity": 7.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-0651-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?&]|$)~"}, {"name": "ARGS:current_page_type", "type": "regex", "value": "~(?:\'|(?:SLEEP|BENCHMARK|UNION\\\\s+(?:ALL\\\\s+)?SELECT|IF|CASE\\\\s+WHEN|CONCAT|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*|--|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2022-0651", "description": "WP Statistics <=13.1.5 unauthenticated SQL injection via current_page_type in REST hit endpoint", "mode": "block", "severity": 7.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-0651-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?&]|$)~"}, {"name": "ARGS:ip", "type": "regex", "value": "~(?:\'|(?:SLEEP|BENCHMARK|UNION\\\\s+(?:ALL\\\\s+)?SELECT|IF|CASE\\\\s+WHEN|CONCAT|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*|--|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2022-0651", "description": "WP Statistics <=13.1.5 unauthenticated SQL injection via ip parameter in REST hit endpoint", "mode": "block", "severity": 7.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-0693-01": {"ajax_action": "remove_post_meta_condition", "conditions": [{"name": "ARGS:meta_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE|ALTER|TRUNCATE)\\\\s|\\\\b(?:AND|OR)\\\\s+[\\"\'\\\\d].*?[=<>]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|extractvalue\\\\s*\\\\(|updatexml\\\\s*\\\\(|EXP\\\\s*\\\\(\\\\s*SELECT|FLOOR\\\\s*\\\\(\\\\s*RAND|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2022-0693", "description": "Master Elements <=8.0 unauthenticated SQL injection via meta_ids in remove_post_meta_condition AJAX handler", "mode": "block", "severity": 9.8, "slug": "master-elements", "target": "plugin", "versions": "<=8.0"}, "RULE-CVE-2022-0707-01": {"ajax_action": "edd_insert_payment_note", "conditions": [{"name": "ARGS:payment_id", "type": "exists"}, {"name": "ARGS:note", "type": "exists"}, {"type": "missing_capability", "value": "edit_shop_payments"}], "cve": "CVE-2022-0707", "description": "Easy Digital Downloads <2.11.6 CSRF on payment note insertion via edd_insert_payment_note AJAX handler", "mode": "block", "severity": 4.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<2.11.6"}, "RULE-CVE-2022-0788-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wfp/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b)~i"}], "cve": "CVE-2022-0788", "description": "Block unauthenticated SQL injection via WP Fundraising Donation REST API routes. The patch replaces raw SQL concatenation with $wpdb->prepare() in multiple REST handlers in apps/fundraising.php. This rule detects SQL injection payloads in REST route parameters (id, formid, form_id, target, id-order, key) targeting the plugin REST namespace.", "mode": "block", "severity": 9.8, "slug": "wp-fundraising-donation", "target": "plugin", "versions": "<1.5.0"}, "RULE-CVE-2022-0863-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-svg-icons-custom-icons"}, {"name": "ARGS:upload_svg_icon_pack", "type": "exists"}, {"name": "FILES:zip_file_upload:content", "type": "regex", "value": "~<\\\\?(?:php|=)|<\\\\?[\\\\s\\\\n]~i"}], "cve": "CVE-2022-0863", "description": "WP SVG Icons <=3.2.3 arbitrary PHP file upload via malicious custom icon pack ZIP", "mode": "block", "severity": 7.2, "slug": "svg-vector-icon-plugin", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2022-0863-02": {"ajax_action": "svg_delete_custom_pack", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-0863", "description": "WP SVG Icons <=3.2.3 missing authorization on svg_delete_custom_pack AJAX handler", "mode": "block", "severity": 7.2, "slug": "svg-vector-icon-plugin", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2022-1091-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~<svg[^>]*>.*(?:on(?:load|error|mouseover|click|focus)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<foreignObject)~is"}], "cve": "CVE-2022-1091", "description": "Safe SVG <1.9.10 stored XSS via SVG upload with spoofed Content-Type on async-upload.php", "mode": "block", "severity": 6.1, "slug": "safe-svg", "target": "plugin", "versions": "<1.9.10"}, "RULE-CVE-2022-1091-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:content", "type": "regex", "value": "~<svg[^>]*>.*(?:on(?:load|error|mouseover|click|focus)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<foreignObject)~is"}], "cve": "CVE-2022-1091", "description": "Safe SVG <1.9.10 stored XSS via SVG upload with spoofed Content-Type on REST /wp/v2/media", "mode": "block", "severity": 6.1, "slug": "safe-svg", "target": "plugin", "versions": "<1.9.10"}, "RULE-CVE-2022-1104-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "popup"}, {"name": "ARGS:popup_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2022-1104", "description": "Popup Maker <1.16.5 stored XSS via popup_title parameter when unfiltered_html is disallowed", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<1.16.5"}, "RULE-CVE-2022-1104-02": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "popup"}, {"name": "ARGS:popup_settings[close][text]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2022-1104", "description": "Popup Maker <1.16.5 stored XSS via popup_settings[close][text] parameter when unfiltered_html is disallowed", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<1.16.5"}, "RULE-CVE-2022-1104-03": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "popup"}, {"name": "ARGS:popup_settings[title]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2022-1104", "description": "Popup Maker <1.16.5 stored XSS via popup_settings[title] parameter when unfiltered_html is disallowed", "mode": "block", "slug": "popup-maker", "target": "plugin", "versions": "<1.16.5"}, "RULE-CVE-2022-1565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp_all_import_get_gz\\\\.php~i"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)(?:[?#]|$)|[\\\\\\\\/]\\\\.htaccess(?:[?#]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1565", "description": "WP All Import <=3.6.7 authenticated arbitrary PHP file upload via wp_all_import_get_gz.php name parameter", "mode": "block", "severity": 7.2, "slug": "wp-all-import", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2022-1565-02": {"ajax_action": "pmxi_upload_file", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)(?:[?#]|$)|[\\\\\\\\/]\\\\.htaccess(?:[?#]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1565", "description": "WP All Import <=3.6.7 authenticated arbitrary PHP file upload via pmxi_upload_file AJAX action", "mode": "block", "severity": 7.2, "slug": "wp-all-import", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2022-1574-01": {"ajax_action": "html_actions", "conditions": [{"name": "FILES:html_import_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s(?:html?|htm)|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|\\\\.htaccess$|\\\\.htpasswd$~i"}], "cve": "CVE-2022-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1574", "description": "HTML2WP <=1.0.0 subscriber+ arbitrary file upload via html_actions AJAX handler", "mode": "block", "severity": 9.8, "slug": "html2wp", "tags": ["arbitrary-file-upload", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2022-1574-02": {"ajax_action": "html_actions", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2022-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1574", "description": "HTML2WP <=1.0.0 subscriber+ reflected XSS via path parameter in html_actions AJAX handler", "mode": "block", "severity": 9.8, "slug": "html2wp", "tags": ["xss", "reflected", "missing-authorization"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2022-1574-03": {"ajax_action": "html_actions", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2022-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1574", "description": "HTML2WP <=1.0.0 subscriber+ arbitrary file read/delete via path parameter in html_actions AJAX handler", "mode": "block", "severity": 9.8, "slug": "html2wp", "tags": ["path-traversal", "arbitrary-file-read", "missing-authorization"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2022-1577-01": {"ajax_action": "save_backup_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-1577", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1577", "description": "Database Backup for WordPress <2.5.2 CSRF and missing authorization on save_backup_time allows unauthorized schedule modification", "mode": "block", "severity": 5.4, "slug": "wp-db-backup", "tags": ["csrf", "missing-authorization", "schedule-modification"], "target": "plugin", "versions": "<2.5.2"}, "RULE-CVE-2022-1594-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hc-custom-wp-admin-url"}, {"name": "ARGS:hc_custom_wp_admin_url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2022-1594", "description": "HC Custom WP-Admin URL <=1.4 stored XSS via CSRF in settings update (hc_custom_wp_admin_url parameter)", "mode": "block", "severity": 4.3, "slug": "hc-custom-wp-admin-url", "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2022-1707-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]s=~"}, {"name": "ARGS:s", "type": "regex", "value": "~<(?:script|img|object|iframe|embed|svg)[^>]*>|javascript:|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2022-1707", "description": "Google Tag Manager for WordPress <=1.15 reflected XSS via s parameter", "mode": "block", "severity": 6.1, "slug": "duracelltomi-google-tag-manager", "target": "plugin", "versions": "<=1.15"}, "RULE-CVE-2022-1768-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/rsvpmaker/v1/stripesuccess(?:/[^/?&#]*)?(?:[/?&]|$)~"}, {"name": "ARGS:rsvp_id", "type": "regex", "value": "~(?i)(?:\'\\\\s*(?:OR|AND)\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|UNION(?:\\\\s+ALL)?\\\\s+SELECT|SELECT(?:\\\\s|\\\\()|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|pg_sleep\\\\s*\\\\(|WAITFOR\\\\s+DELAY|information_schema|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|--\\\\s*$|/\\\\*|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE)\\\\b)~"}], "cve": "CVE-2022-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1768", "description": "RSVPMaker <=9.3.2 unauthenticated time-based blind SQL injection via rsvp_id parameter in REST route /wp-json/rsvpmaker/v1/stripesuccess/ (confirmed in production, 190/200 proactive_queue samples targeted this endpoint with SLEEP() payloads)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "rsvpmaker", "tags": ["sql-injection", "unauthenticated", "rest-api", "time-based-blind", "prod-evidence"], "target": "plugin", "versions": "<=9.3.2"}, "RULE-CVE-2022-1768-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/rsvpmaker/v1/stripesuccess(?:/[^/?&#]*)?(?:[/?&]|$)~"}, {"name": "ARGS:rsvp_id", "type": "regex", "value": "~(?i)(?:\'\\\\s*(?:OR|AND)\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|UNION(?:\\\\s+ALL)?\\\\s+SELECT|SELECT(?:\\\\s|\\\\()|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|pg_sleep\\\\s*\\\\(|WAITFOR\\\\s+DELAY|information_schema|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|--\\\\s*$|/\\\\*|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE)\\\\b)~"}], "cve": "CVE-2022-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1768", "description": "RSVPMaker <=9.3.2 unauthenticated time-based blind SQL injection via rsvp_id parameter in REST route /wp-json/rsvpmaker/v1/stripesuccess/ (GET variant)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "rsvpmaker", "tags": ["sql-injection", "unauthenticated", "rest-api", "time-based-blind", "prod-evidence"], "target": "plugin", "versions": "<=9.3.2"}, "RULE-CVE-2022-1768-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/rsvpmaker/v1/sked(?:/[^/?&#]*)?(?:[/?&]|$)~"}, {"name": "ARGS:post_id", "type": "regex", "value": "~(?i)(?:\'\\\\s*(?:OR|AND)\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|UNION(?:\\\\s+ALL)?\\\\s+SELECT|SELECT(?:\\\\s|\\\\()|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|pg_sleep\\\\s*\\\\(|WAITFOR\\\\s+DELAY|information_schema|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|--\\\\s*$|/\\\\*|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE)\\\\b)~"}], "cve": "CVE-2022-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-1768", "description": "RSVPMaker <=9.3.2 unauthenticated time-based blind SQL injection via post_id parameter in REST route /wp-json/rsvpmaker/v1/sked/{id} (secondary sink from reference digest, Week 15 2026)", "mode": "block", "severity": 9.8, "slug": "rsvpmaker", "tags": ["sql-injection", "unauthenticated", "rest-api", "time-based-blind"], "target": "plugin", "versions": "<=9.3.2"}, "RULE-CVE-2022-1895-01": {"action": "admin_init", "conditions": [{"name": "ARGS:underConstructionDeactivate", "type": "equals", "value": "true"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-1895", "description": "Under Construction <1.20 CSRF leading to construction mode deactivation via underConstructionDeactivate parameter", "mode": "block", "severity": 4.3, "slug": "underconstruction", "target": "plugin", "versions": "<1.20"}, "RULE-CVE-2022-1985-01": {"action": "init", "conditions": [{"name": "ARGS:frameid", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2022-1985", "description": "Download Manager <=3.2.42 reflected XSS via frameid parameter in shortcode-iframe.php", "mode": "block", "severity": 6.1, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.42"}, "RULE-CVE-2022-2273-01": {"action": "init", "conditions": [{"name": "ARGS:membership_level", "type": "regex", "value": "~^[0-9]+$~"}], "cve": "CVE-2022-2273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-2273", "description": "Simple Membership <4.1.3 authenticated privilege escalation via membership_level parameter in profile edit", "mode": "block", "severity": 8.8, "slug": "simple-membership", "tags": ["privilege-escalation", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<4.1.3"}, "RULE-CVE-2022-2314-01": {"action": "init", "conditions": [{"name": "ARGS:vrc_cmd", "type": "exists"}], "cve": "CVE-2022-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-2314", "description": "VR Calendar <=2.3.2 unauthenticated arbitrary PHP function execution via vrc_cmd parameter", "mode": "block", "severity": 9.8, "slug": "vr-calendar-sync", "tags": ["code-execution", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2022-2314-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "getSingleCalendarCustome"}, {"name": "ARGS:id", "type": "regex", "value": "~.+~"}], "cve": "CVE-2022-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-2314", "description": "VR Calendar <=2.3.1 unauthenticated information disclosure via getSingleCalendarCustome AJAX handler", "mode": "block", "severity": 9.8, "slug": "vr-calendar-sync", "tags": ["information-disclosure", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<2.3.2"}, "RULE-CVE-2022-2431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpdmpro"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:^|[\\\\\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[\\\\\\\\/]etc[\\\\\\\\/]passwd)~i"}], "cve": "CVE-2022-2431", "description": "Download Manager <=3.2.50 authenticated (contributor+) arbitrary file deletion via path traversal in file[files][] parameter", "mode": "block", "severity": 8.8, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.50"}, "RULE-CVE-2022-2434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=string-locator~"}, {"name": "ARGS:string-locator-path", "type": "regex", "value": "~(?:^|(?:%0[aAdD]|\\\\s))(?:phar|zip|compress\\\\.zlib|php|data|expect|glob)(?:%3[Aa]|:)//~i"}], "cve": "CVE-2022-2434", "description": "String Locator <=2.5.0 PHAR deserialization via string-locator-path parameter on editor page", "mode": "block", "severity": 8.8, "slug": "string-locator", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2022-2436-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpdmpro"}, {"name": "ARGS:file[package_dir]", "type": "regex", "value": "~(?:p|%70)(?:h|%68)(?:a|%61)(?:r|%72)(?:%3a|:)(?:%2f|/)(?:%2f|/)~i"}], "cve": "CVE-2022-2436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-2436", "description": "Download Manager <=3.2.49 authenticated PHAR deserialization via file[package_dir] parameter", "mode": "block", "severity": 8.8, "slug": "download-manager", "tags": ["deserialization", "phar-injection", "authenticated", "contributor-plus"], "target": "plugin", "versions": "<=3.2.49"}, "RULE-CVE-2022-2439-01": {"ajax_action": "ime_test_im_path", "conditions": [{"name": "ARGS:cli_path", "type": "regex", "value": "~[;|&`$(){}\\\\n\\\\r<>]|\\\\$\\\\(~"}], "cve": "CVE-2022-2439", "method": "POST", "mode": "block", "severity": 7.2, "slug": "imagemagick-engine", "target": "plugin", "versions": "<1.7.5"}, "RULE-CVE-2022-2446-01": {"ajax_action": "wpeditor_browse_theme_root", "conditions": [{"name": "ARGS:current_theme_root", "type": "regex", "value": "~^phar://~i"}], "cve": "CVE-2022-2446", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2022-2446-02": {"ajax_action": "wpeditor_get_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~^phar://~i"}], "cve": "CVE-2022-2446", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2022-2446-03": {"ajax_action": "wpeditor_upload", "conditions": [{"name": "ARGS:complete_directory", "type": "regex", "value": "~^phar://~i"}], "cve": "CVE-2022-2446", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2022-2446-04": {"ajax_action": "wpeditor_save_file", "conditions": [{"name": "ARGS:real_file", "type": "regex", "value": "~^phar://~i"}], "cve": "CVE-2022-2446", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2022-24663-01": {"ajax_action": "parse-media-shortcode", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[php_everywhere[\\\\]\\\\s]~i"}], "cve": "CVE-2022-24663", "description": "PHP Everywhere <=2.0.3 authenticated (Subscriber+) remote code execution via php_everywhere shortcode in parse-media-shortcode AJAX handler", "mode": "block", "severity": 8.8, "slug": "php-everywhere", "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2022-24665-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:php-everywhere-block/php~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-24665", "description": "PHP Everywhere <=2.0.3 contributor+ remote code execution via Gutenberg block in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "php-everywhere", "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2022-25148-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?&]|$)~"}, {"name": "ARGS:ip", "type": "regex", "value": "~(?:\'\\\\s*(?:OR|AND|UNION|SELECT|SLEEP|BENCHMARK|IF|CASE|--|;|/\\\\*)|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2022-25148", "description": "WP Statistics <=13.1.5 unauthenticated SQL injection via ip parameter in REST hit endpoint", "mode": "block", "severity": 9.8, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-25149-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?]|$)~"}, {"name": "ARGS:/^(?:current_page_id|current_page_type|ip)$/", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:-|\\\\+|OR|AND)\\\\s*(?:SLEEP|BENCHMARK)\\\\s*\\\\(|(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|--\\\\s|#\\\\s)~i"}], "cve": "CVE-2022-25149", "description": "WP Statistics <=13.1.5 unauthenticated SQL injection via current_page_id/current_page_type/ip on REST /wp-statistics/v2/hit endpoint", "mode": "block", "severity": 9.8, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-25305-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?]|$)~"}, {"name": "ARGS:ip", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2022-25305", "description": "WP Statistics <=13.1.5 unauthenticated stored XSS via ip parameter on REST hit endpoint", "mode": "block", "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-25307-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-statistics/v2/hit(?:[/?]|$)~"}, {"name": "ARGS:platform", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)|\\\\.cookie\\\\s*[=;]|document\\\\s*\\\\.)~i"}], "cve": "CVE-2022-25307", "description": "WP Statistics <=13.1.5 unauthenticated stored XSS via platform parameter on REST hit endpoint", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.1.5"}, "RULE-CVE-2022-25602-01": {"ajax_action": "rmp_menu_theme_upload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-25602", "description": "Responsive Menu <=4.1.7 missing authorization on rmp_menu_theme_upload allows subscriber+ arbitrary file upload via nonce leak", "mode": "block", "severity": 8.8, "slug": "responsive-menu", "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2022-25602-02": {"ajax_action": "rmp_theme_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-25602", "description": "Responsive Menu <=4.1.7 missing authorization on rmp_theme_delete allows subscriber+ arbitrary theme deletion via nonce leak", "mode": "block", "severity": 8.8, "slug": "responsive-menu", "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2022-25602-03": {"ajax_action": "rmp_save_global_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-25602", "description": "Responsive Menu <=4.1.7 missing authorization on rmp_save_global_settings allows subscriber+ plugin settings change via nonce leak", "mode": "block", "severity": 8.8, "slug": "responsive-menu", "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2022-2863-01": {"ajax_action": "wpvivid_download_export_backup", "conditions": [{"name": "ARGS:file_name", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2022-2863", "description": "WPvivid Backup <0.9.76 authenticated path traversal via file_name in wpvivid_download_export_backup", "mode": "block", "severity": 4.9, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.76"}, "RULE-CVE-2022-2863-02": {"ajax_action": "wpvivid_export_download_backup", "conditions": [{"name": "ARGS:file_name", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2022-2863", "description": "WPvivid Backup <0.9.76 authenticated path traversal via file_name in wpvivid_export_download_backup", "mode": "block", "severity": 4.9, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.76"}, "RULE-CVE-2022-29451-01": {"ajax_action": "rrdi_import_demo_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-29451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-29451", "description": "Rara One Click Demo Import <=1.2.9 CSRF leading to arbitrary file upload via rrdi_import_demo_data AJAX handler - blocks non-admin users from triggering demo import", "mode": "block", "severity": 8.8, "slug": "rara-one-click-demo-import", "tags": ["missing-authorization", "arbitrary-file-upload", "csrf"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2022-3334-01": {"action": "admin_init", "conditions": [{"name": "ARGS:swpsmtp_import_settings", "type": "exists"}, {"name": "FILES:swpsmtp_import_settings_file:content", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2022-3334", "description": "Easy WP SMTP <1.5.0 PHP object injection via settings import file deserialization", "mode": "block", "severity": 7.2, "slug": "easy-wp-smtp", "target": "plugin", "versions": "<1.5.0"}, "RULE-CVE-2022-3334-02": {"ajax_action": "swpsmtp_clear_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-3334", "description": "Easy WP SMTP <1.5.0 missing authorization on swpsmtp_clear_log allows subscriber+ log clearing", "mode": "block", "severity": 7.2, "slug": "easy-wp-smtp", "target": "plugin", "versions": "<1.5.0"}, "RULE-CVE-2022-3334-03": {"ajax_action": "swpsmtp_self_destruct", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-3334", "description": "Easy WP SMTP <1.5.0 missing authorization on swpsmtp_self_destruct allows subscriber+ plugin deletion", "mode": "block", "severity": 7.2, "slug": "easy-wp-smtp", "target": "plugin", "versions": "<1.5.0"}, "RULE-CVE-2022-3384-01": {"ajax_action": "um_populate_dropdown_options", "conditions": [{"name": "ARGS:option_value", "type": "regex", "value": "~^(?:phpinfo|system|exec|shell_exec|passthru|popen|proc_open|curl_exec|curl_multi_exec|parse_str|create_function|assert|preg_replace|e(?:val)?\\\\(|call_user_func(?:_array)?)\\\\s*\\\\(~i"}], "cve": "CVE-2022-3384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-3384", "description": "Ultimate Member <=2.5.0 authenticated RCE via populate_dropdown_options callback parameter", "mode": "block", "severity": 7.2, "slug": "ultimate-member", "tags": ["rce", "code-execution", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2022-33965-01": {"ajax_action": "liveStats", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via liveStats AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-02": {"ajax_action": "refDetails", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via refDetails AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-03": {"ajax_action": "getDateWiseLocationDetail", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via getDateWiseLocationDetail AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-04": {"ajax_action": "getContentUrlDayView", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via getContentUrlDayView AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-05": {"ajax_action": "getReferralOSDetails", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via getReferralOSDetails AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-06": {"ajax_action": "refUrlDetails", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via refUrlDetails AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-07": {"ajax_action": "uoSummary", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via uoSummary AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-08": {"ajax_action": "deleteIpAddress", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via deleteIpAddress AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-09": {"ajax_action": "updateIpAddress", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via updateIpAddress AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-33965-10": {"ajax_action": "save_ipadress", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2022-33965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-33965", "description": "WP Visitor Statistics <=5.7 unauthenticated SQL injection via save_ipadress AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7"}, "RULE-CVE-2022-36376-01": {"ajax_action": "cmb2_oembed_handler", "conditions": [{"name": "ARGS:oembed_url", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|ldap|tftp|ssh2?)://|(?:^https?://)?(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|localhost|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.169\\\\.254|\\\\[::1\\\\]|0x[0-9a-f]|0177\\\\.|%30|%31%32%37))~i"}], "cve": "CVE-2022-36376", "description": "Rank Math SEO <=1.0.95 unauthenticated SSRF via cmb2_oembed_handler oembed_url parameter", "mode": "block", "severity": 9.8, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.95"}, "RULE-CVE-2022-3805-02": {"ajax_action": "jkit_create_element", "conditions": [{"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2022-3805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-3805", "description": "Jeg Elementor Kit <=2.5.6 unauthorized element creation via jkit_create_element AJAX handler", "mode": "block", "severity": 7.5, "slug": "jeg-elementor-kit", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=2.5.6"}, "RULE-CVE-2022-38074-01": {"ajax_action": "wp_statistics_delete_agents", "conditions": [{"name": "ARGS:agent-name", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-38074", "description": "SQL Injection via agent-name parameter in wp_statistics_delete_agents AJAX handler (WP Statistics <= 13.2.10)", "mode": "block", "severity": 8.8, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.2.10"}, "RULE-CVE-2022-38074-02": {"ajax_action": "wp_statistics_delete_platforms", "conditions": [{"name": "ARGS:platform-name", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-38074", "description": "SQL Injection via platform-name parameter in wp_statistics_delete_platforms AJAX handler (WP Statistics <= 13.2.10)", "mode": "block", "severity": 8.8, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.2.10"}, "RULE-CVE-2022-38074-03": {"ajax_action": "wp_statistics_delete_ip", "conditions": [{"name": "ARGS:ip-address", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-38074", "description": "SQL Injection via ip-address parameter in wp_statistics_delete_ip AJAX handler (WP Statistics <= 13.2.10)", "mode": "block", "severity": 8.8, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.2.10"}, "RULE-CVE-2022-38074-04": {"ajax_action": "wp_statistics_empty_table", "conditions": [{"name": "ARGS:table-name", "type": "regex", "value": "~(?:^(?!(?:purging|all|browsers|countries|exclusions|hits|historical|online|referer|search|search-engine|visitor|visitor_relationships)$).+)~"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-38074", "description": "SQL Injection / arbitrary table emptying via table-name parameter in wp_statistics_empty_table AJAX handler (WP Statistics <= 13.2.10)", "mode": "block", "severity": 8.8, "slug": "wp-statistics", "target": "plugin", "versions": "<=13.2.10"}, "RULE-CVE-2022-40200-01": {"ajax_action": "wpforo_profile_cover_upload", "conditions": [{"name": "FILES:cover", "type": "exists"}, {"name": "FILES:cover:name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|shtml|svg|swf)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-40200", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-40200", "description": "wpForo Forum <2.1.0 authenticated subscriber+ arbitrary file upload via profile cover upload endpoint (CWE-434)", "mode": "block", "severity": 9.9, "slug": "wpforo", "tags": ["arbitrary-file-upload", "authenticated", "remote-code-execution", "cwe-434"], "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2022-40200-02": {"ajax_action": "wpforo_profiles_default_cover_upload", "conditions": [{"name": "FILES:cover", "type": "exists"}, {"name": "FILES:cover:name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|shtml|svg|swf)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-40200", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-40200", "description": "wpForo Forum <2.1.0 authenticated subscriber+ arbitrary file upload via default profile cover upload endpoint (CWE-434)", "mode": "block", "severity": 9.9, "slug": "wpforo", "tags": ["arbitrary-file-upload", "authenticated", "remote-code-execution", "cwe-434"], "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2022-4059-01": {"ajax_action": "mcwp_table", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2022-4059", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-4059", "description": "Cryptocurrency Widgets Pack <2.0 unauthenticated SQL injection via mcwp_table AJAX action", "mode": "block", "severity": 9.8, "slug": "cryptocurrency-widgets-pack", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<2.0"}, "RULE-CVE-2022-41786-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:task", "type": "exists"}, {"name": "ARGS:task", "type": "regex", "value": "~^(deletecompanylogo|deleteUserPhoto|deleteResumeLogo|removeResumeFileById|deleteResumeSectionAjax)$~i"}], "cve": "CVE-2022-41786", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2022-42699-02": {"ajax_action": "swpsmtp_self_destruct", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-42699", "description": "Easy WP SMTP <=1.5.1 missing authorization on swpsmtp_self_destruct allows subscriber+ plugin deletion", "mode": "block", "severity": 9.1, "slug": "easy-wp-smtp", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2022-4290-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tag-name", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\b(?:SLEEP|BENCHMARK)\\\\s*\\\\(|\\\\binformation_schema\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|--\\\\s|0x[0-9a-fA-F]{4,})~i"}], "cve": "CVE-2022-4290", "description": "Cyr to Lat <=3.5 authenticated SQL injection via tag/term name in ctl_sanitize_title (edit-tags.php)", "mode": "block", "severity": 8.8, "slug": "cyr3lat", "target": "plugin", "versions": "<=3.5"}, "RULE-CVE-2022-4290-02": {"ajax_action": "add-tag", "conditions": [{"name": "ARGS:tag-name", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\b(?:SLEEP|BENCHMARK)\\\\s*\\\\(|\\\\binformation_schema\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|--\\\\s|0x[0-9a-fA-F]{4,})~i"}], "cve": "CVE-2022-4290", "description": "Cyr to Lat <=3.5 authenticated SQL injection via add-tag AJAX tag-name", "mode": "block", "severity": 8.8, "slug": "cyr3lat", "target": "plugin", "versions": "<=3.5"}, "RULE-CVE-2022-4328-01": {"ajax_action": "cfom_upload_file", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$|\\\\0~i"}], "cve": "CVE-2022-4328", "description": "N-Media WooCommerce Checkout Fields <=17.3 unauthenticated arbitrary file upload via cfom_upload_file AJAX handler", "mode": "block", "slug": "n-media-woocommerce-checkout-fields", "target": "plugin", "versions": "<=17.3"}, "RULE-CVE-2022-43453-01": {"ajax_action": "wptools_get_ajax_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-43453", "mode": "block", "severity": 8.8, "slug": "wptools", "target": "plugin", "versions": "<3.43"}, "RULE-CVE-2022-43453-03": {"ajax_action": "wptools_get_speed_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-43453", "mode": "block", "severity": 8.8, "slug": "wptools", "target": "plugin", "versions": "<3.43"}, "RULE-CVE-2022-43453-04": {"ajax_action": "wptools_dismissible_notice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-43453", "mode": "block", "severity": 8.8, "slug": "wptools", "target": "plugin", "versions": "<3.43"}, "RULE-CVE-2022-43453-05": {"ajax_action": "wptools_dismissible_notice2", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-43453", "mode": "block", "severity": 8.8, "slug": "wptools", "target": "plugin", "versions": "<3.43"}, "RULE-CVE-2022-43453-06": {"ajax_action": "wptools_bill_go_pro_hide", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-43453", "mode": "block", "severity": 8.8, "slug": "wptools", "target": "plugin", "versions": "<3.43"}, "RULE-CVE-2022-44580-01": {"ajax_action": "grw_overview_ajax", "conditions": [{"name": "ARGS:place_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|CONCAT\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-44580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-44580", "description": "Plugin for Google Reviews <=2.2.3 authenticated SQL injection via place_id in grw_overview_ajax", "mode": "block", "severity": 9.1, "slug": "widget-google-reviews", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.2.3"}, "RULE-CVE-2022-44580-02": {"ajax_action": "grw_feed_save_ajax", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|CONCAT\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-44580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-44580", "description": "Plugin for Google Reviews <=2.2.3 authenticated SQL injection via post_id in grw_feed_save_ajax", "mode": "block", "severity": 9.1, "slug": "widget-google-reviews", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.2.3"}, "RULE-CVE-2022-4501-01": {"ajax_action": "vc_save_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4501", "description": "Mega Addons For WPBakery Page Builder <=4.3.0 missing authorization on vc_save_data AJAX action allows subscriber+ to overwrite plugin settings", "mode": "block", "severity": 6.5, "slug": "mega-addons-for-visual-composer", "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2022-45354-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/download-monitor/v1/(?:download_reports|user_reports|user_data))(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-45354", "method": "GET", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.60"}, "RULE-CVE-2022-45354-02": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/download-monitor/v1/(?:download_reports|user_reports|user_data)(?:/|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-45354", "method": "GET", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.60"}, "RULE-CVE-2022-45373-01": {"ajax_action": "slimstat_delete_pageview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-45373", "description": "Slimstat Analytics <=5.0.4 authenticated SQL injection via pageview_id in slimstat_delete_pageview AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-slimstat", "target": "plugin", "versions": "<=5.0.4"}, "RULE-CVE-2022-45374-01": {"ajax_action": "yarpp_display_preview", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|file|data|expect|zip|phar)\\\\s*://|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2022-45374", "description": "YARPP <=5.30.4 authenticated local file inclusion via template parameter in yarpp_display_preview AJAX handler", "mode": "block", "severity": 7.7, "slug": "yet-another-related-posts-plugin", "target": "plugin", "versions": "<=5.30.4"}, "RULE-CVE-2022-45374-02": {"ajax_action": "yarpp_display_demo", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|file|data|expect|zip|phar)\\\\s*://|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2022-45374", "description": "YARPP <=5.30.4 authenticated local file inclusion via template parameter in yarpp_display_demo AJAX handler", "mode": "block", "severity": 7.7, "slug": "yet-another-related-posts-plugin", "target": "plugin", "versions": "<=5.30.4"}, "RULE-CVE-2022-45374-03": {"ajax_action": "yarpp_display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|file|data|expect|zip|phar)\\\\s*://|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2022-45374", "description": "YARPP <=5.30.4 authenticated local file inclusion via template parameter in yarpp_display AJAX handler", "mode": "block", "severity": 7.7, "slug": "yet-another-related-posts-plugin", "target": "plugin", "versions": "<=5.30.4"}, "RULE-CVE-2022-45830-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wp_analytify_log_out", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-45830", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-analytify", "target": "plugin", "versions": "<=4.2.3"}, "RULE-CVE-2022-45833-01": {"ajax_action": "swpsmtp_clear_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-45833", "description": "Easy WP SMTP <=1.5.1 missing authorization on swpsmtp_clear_log AJAX handler allows authenticated path traversal / arbitrary file read", "mode": "block", "severity": 6.8, "slug": "easy-wp-smtp", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2022-45833-02": {"ajax_action": "swpsmtp_self_destruct", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-45833", "description": "Easy WP SMTP <=1.5.1 missing authorization on swpsmtp_self_destruct AJAX handler allows authenticated path traversal / arbitrary file read", "mode": "block", "severity": 6.8, "slug": "easy-wp-smtp", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2022-47615-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|$)~"}, {"name": "ARGS:template_path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|proc/self))~i"}], "cve": "CVE-2022-47615", "description": "LearnPress <=4.1.7.3.2 unauthenticated LFI via template_path parameter in REST API", "mode": "block", "severity": 9.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.1.7.3.2"}, "RULE-CVE-2022-47615-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|$)~"}, {"name": "ARGS:template_path_item", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|proc/self))~i"}], "cve": "CVE-2022-47615", "description": "LearnPress <=4.1.7.3.2 unauthenticated LFI via template_path_item parameter in REST API", "mode": "block", "severity": 9.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.1.7.3.2"}, "RULE-CVE-2022-47615-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/courses/archive-course(?:/|\\\\?|$)~"}, {"name": "ARGS:template_pagination_path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|proc/self))~i"}], "cve": "CVE-2022-47615", "description": "LearnPress <=4.1.7.3.2 unauthenticated LFI via template_pagination_path parameter in REST API", "mode": "block", "severity": 9.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.1.7.3.2"}, "RULE-CVE-2022-4972-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/download_reports(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "GET", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/download_reports(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "POST", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/user_reports(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "GET", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/user_reports(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "POST", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/user_data(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "GET", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/user_data(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "POST", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/templates(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "GET", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2022-4972-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/download-monitor/v1/templates(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2022-4972", "method": "POST", "mode": "block", "severity": 7.5, "slug": "download-monitor", "target": "plugin", "versions": "<=4.7.51"}, "RULE-CVE-2023-0084-02": {"ajax_action": "mf_admin_action", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|svg\\\\s+onload=)~i"}], "cve": "CVE-2023-0084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0084", "description": "MetForm <=3.1.2 stored XSS via admin submissions list view", "mode": "block", "severity": 6.1, "slug": "metform", "tags": ["xss", "stored"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2023-0260-01": {"ajax_action": "wpfb_get_results", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|%27|\'\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2023-0260", "description": "WP Review Slider <12.2 authenticated SQL injection via search parameter in wpfb_get_results AJAX handler", "mode": "block", "slug": "wp-facebook-reviews", "target": "plugin", "versions": "<12.2"}, "RULE-CVE-2023-0260-02": {"ajax_action": "wpfb_get_results", "conditions": [{"name": "ARGS:sortby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s.*THEN)~i"}], "cve": "CVE-2023-0260", "description": "WP Review Slider <12.2 authenticated SQL injection via sortby parameter in wpfb_get_results AJAX handler", "mode": "block", "slug": "wp-facebook-reviews", "target": "plugin", "versions": "<12.2"}, "RULE-CVE-2023-0260-03": {"ajax_action": "wprp_twitter_deltweet", "conditions": [{"name": "ARGS:tid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\'\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2023-0260", "description": "WP Review Slider <12.2 authenticated SQL injection via tid parameter in wprp_twitter_deltweet AJAX handler", "mode": "block", "slug": "wp-facebook-reviews", "target": "plugin", "versions": "<12.2"}, "RULE-CVE-2023-0291-01": {"ajax_action": "qsm_remove_file_fd_question", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2023-0291", "description": "Block unauthenticated arbitrary media file deletion via qsm_remove_file_fd_question AJAX action in Quiz Master Next plugin versions <= 8.0.8 (CWE-862: Missing Authorization)", "mode": "block", "severity": 9.1, "slug": "quiz-master-next", "target": "plugin", "versions": "<=8.0.8"}, "RULE-CVE-2023-0340-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:load|file|content)\\\\s[^\\\\]]*dir\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.{2,}[\\\\\\\\/]+){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2023-0340", "description": "Custom Content Shortcode <=4.0.2 contributor+ local file inclusion via shortcode dir attribute in post content", "mode": "block", "slug": "custom-content-shortcode", "target": "plugin", "versions": "<=4.0.2"}, "RULE-CVE-2023-0340-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:load|file|content)\\\\s[^\\\\]]*dir\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.{2,}[\\\\\\\\/]+){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2023-0340", "description": "Custom Content Shortcode <=4.0.2 contributor+ local file inclusion via shortcode dir attribute in REST API content", "mode": "block", "slug": "custom-content-shortcode", "target": "plugin", "versions": "<=4.0.2"}, "RULE-CVE-2023-0579-01": {"ajax_action": "yarpp_display", "conditions": [{"name": "ARGS:ID", "type": "regex", "value": "~(?:UNION(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT\\\\b|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b|\\\\b(?:OR|AND)\\\\b(?:/\\\\*.*?\\\\*/|\\\\s)+[0-9]+\\\\s*=\\\\s*[0-9]+|(?:--|#)(?:\\\\s|$)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR(?:/\\\\*.*?\\\\*/|\\\\s)+DELAY)~i"}], "cve": "CVE-2023-0579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0579", "description": "YARPP <=5.30.2 authenticated SQL injection via yarpp_display AJAX handler ID parameter", "mode": "block", "severity": 8.8, "slug": "yet-another-related-posts-plugin", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.30.2"}, "RULE-CVE-2023-0579-02": {"ajax_action": "yarpp_display_preview", "conditions": [{"name": "ARGS:ID", "type": "regex", "value": "~(?:UNION(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT\\\\b|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b|\\\\b(?:OR|AND)\\\\b(?:/\\\\*.*?\\\\*/|\\\\s)+[0-9]+\\\\s*=\\\\s*[0-9]+|(?:--|#)(?:\\\\s|$)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR(?:/\\\\*.*?\\\\*/|\\\\s)+DELAY)~i"}], "cve": "CVE-2023-0579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0579", "description": "YARPP <=5.30.2 authenticated SQL injection via yarpp_display_preview AJAX handler ID parameter", "mode": "block", "severity": 8.8, "slug": "yet-another-related-posts-plugin", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.30.2"}, "RULE-CVE-2023-0600-01": {"ajax_action": "getContentUrlDayView", "conditions": [{"name": "ARGS:countryName", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "ARGS:currentPage", "type": "regex", "value": "~(?:UNION|SELECT|;|DROP|DELETE|INSERT|CREATE|ALTER)~i"}, {"name": "ARGS:itemsPerPage", "type": "regex", "value": "~(?:UNION|SELECT|;|DROP|DELETE|INSERT|CREATE|ALTER)~i"}], "cve": "CVE-2023-0600", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0600", "description": "WP Stats Manager <=6.8.1 authenticated SQL injection via getContentUrlDayView AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2023-0600-02": {"ajax_action": "getDateWiseLocationDetail", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "ARGS:countryName", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}, {"name": "ARGS:currentPage", "type": "regex", "value": "~(?:UNION|SELECT|;|DROP|DELETE|INSERT|CREATE|ALTER)~i"}, {"name": "ARGS:itemsPerPage", "type": "regex", "value": "~(?:UNION|SELECT|;|DROP|DELETE|INSERT|CREATE|ALTER)~i"}], "cve": "CVE-2023-0600", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0600", "description": "WP Stats Manager <=6.8.1 authenticated SQL injection via getDateWiseLocationDetail AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2023-0600-03": {"ajax_action": "liveStats", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2023-0600", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0600", "description": "WP Stats Manager <=6.8.1 authenticated SQL injection via liveStats AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-stats-manager", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2023-0630-01": {"ajax_action": "slimstat_delete_pageview", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^slimstat_delete_pageview$~i"}, {"name": "ARGS:pageview_id", "type": "regex", "value": "~(?:(?:\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b)|(?:;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b)|(?:/\\\\*[^*]*\\\\*/)|(?:(?:--|#)\\\\s*$)|(?:\\\\bOR\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+))~i"}], "cve": "CVE-2023-0630", "description": "WP Slimstat <=4.9.3.2 SQL injection via pageview_id parameter in slimstat_delete_pageview AJAX handler", "mode": "block", "severity": 8.8, "slug": "wp-slimstat", "target": "plugin", "versions": "<=4.9.3.2"}, "RULE-CVE-2023-0714-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/metform/v1/submit(?:[/?]|$)~"}, {"name": "FILES:file_attachment:name", "type": "regex", "value": "~\\\\.(?:php[0-9]?|phtml|pht|phar|t?html?|shtml?| asp|aspx|jspx?|cgi|pl|py|sh|exe|dll|bat|cmd|vbs|ps1|reg|ini|htaccess|htpasswd|user\\\\.ini)$~i"}], "cve": "CVE-2023-0714", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-0714", "description": "Metform <=3.2.4 unauthenticated arbitrary file upload via REST API submit endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "metform", "tags": ["arbitrary-file-upload", "unauthenticated", "rest-api", "cwe-434"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2023-2023-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "custom-404-pro-logs"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|focus|mouseover|click|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[\\\\s/])~i"}], "cve": "CVE-2023-2023", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-2023", "description": "Custom 404 Pro <3.7.3 reflected XSS via unescaped search parameter on admin logs page", "mode": "block", "severity": 6.1, "slug": "custom-404-pro", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<3.7.3"}, "RULE-CVE-2023-2023-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^custom-404-pro-logs.*?(?:<script[\\\\s/>]|on(?:error|load|focus|mouseover|click|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[\\\\s/])~i"}], "cve": "CVE-2023-2023", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-2023", "description": "Custom 404 Pro <3.7.3 reflected XSS via unescaped page parameter on admin logs page", "mode": "block", "severity": 6.1, "slug": "custom-404-pro", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<3.7.3"}, "RULE-CVE-2023-2027-01": {"ajax_action": "facebook_login", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-2027", "description": "ZM Ajax Login & Register <=2.0.2 unauthenticated authentication bypass via facebook_login AJAX handler", "mode": "block", "severity": 9.8, "slug": "zm-ajax-login-register", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2023-2296-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-2fa"}, {"name": "ARGS:lz_2fa_email_sub", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via lz_2fa_email_sub parameter on 2FA admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-2296-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-2fa"}, {"name": "ARGS:lz_2fa_email_msg", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via lz_2fa_email_msg parameter on 2FA admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-2296-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-passwordless"}, {"name": "ARGS:lz_passwordless_sub", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via lz_passwordless_sub parameter on passwordless admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-2296-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-passwordless"}, {"name": "ARGS:lz_passwordless_msg", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via lz_passwordless_msg parameter on passwordless admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-2296-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-passwordless"}, {"name": "ARGS:lz_passwordless_redirect", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via lz_passwordless_redirect parameter on passwordless admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-2296-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-security"}, {"name": "ARGS:wp_admin_msg", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via wp_admin_msg parameter on security admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-2296-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "loginizer-security"}, {"name": "ARGS:limit_session", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2023-2296", "description": "Loginizer <1.7.9 reflected XSS via limit_session parameter on security admin page", "mode": "block", "severity": 6.1, "slug": "loginizer", "target": "plugin", "versions": "<1.7.9"}, "RULE-CVE-2023-23715-01": {"ajax_action": "jb-delete-job", "conditions": [{"name": "ARGS:jb-delete-job", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23715", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jobboardwp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2023-23730-01": {"ajax_action": "uagb_process_forms", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:form_data", "type": "regex", "value": "~(?:^|&)g-recaptcha-response=[^&]{0,80}(?:&|$)~"}], "cve": "CVE-2023-23730", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2023-23735-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "uagb_process_forms"}, {"name": "ARGS:email", "type": "detectXSS"}], "cve": "CVE-2023-23735", "description": "Unauthenticated email HTML injection (XSS) via Spectra form processing allows HTML/script injection in email field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2023-23738-01": {"ajax_action": "uagb_process_forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~%0[dD]%0[aA].*(Bcc|Cc|From|Reply-To|Content-Type|Subject)~i"}], "cve": "CVE-2023-23738", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-23738", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.3.0 unauthenticated email header injection via CRLF in form submission", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ultimate-addons-for-gutenberg", "tags": ["email-header-injection", "content-spoofing", "unauthenticated", "crlf-injection"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2023-23825-01": {"ajax_action": "ast_block_templates_import_wpforms", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ast_block_templates_import_wpforms"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-23825", "description": "Spectra (Ultimate Addons for Gutenberg) <= 2.3.0 missing authorization/CSRF protection on AJAX WPForms import action ast_block_templates_import_wpforms, allowing low-privilege or CSRF-triggered imports.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "tags": ["wordpress", "plugin", "spectra", "ultimate-addons-for-gutenberg", "missing-authorization", "csrf"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2023-23825-02": {"ajax_action": "ast_block_templates_import_block", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ast_block_templates_import_block"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-23825", "description": "Spectra (Ultimate Addons for Gutenberg) <= 2.3.0 missing authorization/CSRF protection on AJAX block template import action ast_block_templates_import_block, allowing low-privilege or CSRF-triggered imports.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "tags": ["wordpress", "plugin", "spectra", "ultimate-addons-for-gutenberg", "missing-authorization", "csrf"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2023-23830-01": {"ajax_action": "wp_user_avatar_tinymce", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+)\\\\s*=|<\\\\s*script[\\\\s>]|javascript\\\\s*:)~i"}], "cve": "CVE-2023-23830", "description": "Block reflected XSS via the wp_user_avatar_tinymce AJAX handler by detecting script/event-handler injection in the type parameter (ProfilePress <= 4.5.4)", "mode": "block", "severity": 7.1, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2023-23834-01": {"ajax_action": "ast_block_templates_activate_plugin", "conditions": [{"name": "ARGS:ast_block_templates_activate_plugin", "type": "exists"}, {"name": "ARGS:ast_block_templates_activate_plugin", "type": "regex", "value": "~\\\\.php($|\\\\?)~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2023-23834", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2023-23990-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/profile.php"}, {"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23990", "method": "POST", "mode": "block", "severity": 7.6, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2023-23990-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/profile.php"}, {"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23990", "method": "POST", "mode": "block", "severity": 7.6, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2023-23990-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23990", "method": "POST", "mode": "block", "severity": 7.6, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2023-23990-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-23990", "method": "POST", "mode": "block", "severity": 7.6, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2023-24407-01": {"ajax_action": "wpdevart_export", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpdevart_export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-24407", "method": "POST", "mode": "block", "severity": 8.8, "slug": "booking-calendar", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2023-24407-02": {"ajax_action": "wpdevart_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpdevart_ajax"}, {"name": "ARGS:task", "type": "regex", "value": "~^wpdevart_(quick_update|add_field|export)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-24407", "method": "POST", "mode": "block", "severity": 8.8, "slug": "booking-calendar", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2023-24407-03": {"ajax_action": "wpdevart_add_field", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpdevart_add_field"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-24407", "method": "POST", "mode": "block", "severity": 8.8, "slug": "booking-calendar", "target": "plugin", "versions": "<=3.2.3"}, "RULE-CVE-2023-25050-01": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2023-25050", "description": "Shortcodes Ultimate <=5.12.6 authenticated arbitrary file download via path traversal in shortcode parameter of su_generator_settings AJAX handler", "mode": "block", "severity": 7.1, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=5.12.6"}, "RULE-CVE-2023-25988-01": {"ajax_action": "TotalSoftGallery_Video_Del", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-02": {"ajax_action": "TotalSoftGallery_Video_Clone", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-03": {"ajax_action": "TotalSoftGallery_Video_Edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-04": {"ajax_action": "TotalSoftGallery_Video_Edit_Videos", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-05": {"ajax_action": "TSoft_Vimeo_Video_Image", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-06": {"ajax_action": "TSoft_Wistia_Video_Image", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-07": {"ajax_action": "TotalSoftGallery_VideoOpt_Del", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-08": {"ajax_action": "TotalSoftGallery_VideoOpt_Edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-09": {"ajax_action": "TotalSoftGallery_VideoOpt_Edit1", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-10": {"ajax_action": "TotalSoftGalleryV_Clone_Option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-11": {"ajax_action": "TotalSoftGallery_Video_Page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-12": {"ajax_action": "TotalSoftGallery_Video_PageGO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-14": {"ajax_action": "TotalSoftGallery_Video_CP_Popup_Left", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-15": {"ajax_action": "TotalSoftGallery_Video_CP_Popup_Right", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-16": {"ajax_action": "TS_PTable_New_MTable_DisMiss_VG", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-17": {"ajax_action": "TS_VG_Question_DisMiss", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-18": {"ajax_action": "Total_Soft_GV_Prev", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-19": {"ajax_action": "TotalSoftGallery_Video_Post", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-25988-20": {"ajax_action": "TotalSoftGallery_Page_Post", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-25988", "mode": "block", "severity": 7.5, "slug": "gallery-videos", "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2023-2732-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/listings(/|\\\\?|$)~"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2023-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-2732", "description": "mstore-api <=3.9.2 authentication bypass via user_id parameter in listings REST API", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "tags": ["authentication-bypass", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2023-2733-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc/v3/coupons/validate(?:[/?]|$)~"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2023-2733", "description": "mstore-api <=3.9.0 authentication bypass via coupon validation REST API allows unauthenticated attackers to impersonate any user", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=3.9.0"}, "RULE-CVE-2023-2734-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/flutterwoo/order(/|\\\\?|$)~"}], "cve": "CVE-2023-2734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-2734", "description": "MStore API <=3.9.1 authentication bypass via unauthenticated REST cart sync", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "tags": ["authentication-bypass", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2023-27460-01": {"ajax_action": "cpcfwpp_feedback", "conditions": [{"name": "ARGS:answer", "type": "exists"}, {"name": "ARGS:oinfo", "type": "exists"}, {"name": "ARGS:opinfo", "type": "exists"}, {"name": "ARGS:anonymous", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-27460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-27460", "description": "CP Contact Form with Paypal <= 1.3.34 missing authorization on AJAX feedback submission (cpcfwpp_feedback) allows low-privileged users to misuse internal feedback functionality.", "method": "POST", "mode": "block", "severity": 4.3, "slug": "cp-contact-form-with-paypal", "tags": ["missing-authorization", "broken-access-control", "ajax", "feedback"], "target": "plugin", "versions": "<=1.3.34"}, "RULE-CVE-2023-2834-01": {"ajax_action": "bookit_book_appointment", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~^[^@]+@[^@]+\\\\.[^@]+$~"}], "cve": "CVE-2023-2834", "description": "BookIt <=2.3.7 unauthenticated authentication bypass via bookit_book_appointment email parameter", "mode": "block", "severity": 9.8, "slug": "bookit", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2023-2877-01": {"ajax_action": "frm_install_addon", "conditions": [{"name": "ARGS:file_url", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2023-2877", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "target": "plugin", "versions": "<=6.3"}, "RULE-CVE-2023-2877-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/frm-admin/v1/install-addon(/|\\\\?|$)~"}, {"name": "ARGS:file_url", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2023-2877", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "target": "plugin", "versions": "<=6.3"}, "RULE-CVE-2023-28787-01": {"ajax_action": "qmn_process_quiz", "conditions": [{"name": "ARGS:quiz_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#|/\\\\*)\\\\s*$|\'\\\\s*(?:OR|AND|UNION)\\\\b)~i"}], "cve": "CVE-2023-28787", "description": "Quiz And Survey Master <=8.1.4 unauthenticated SQL injection via quiz_id in qmn_process_quiz AJAX handler", "mode": "block", "severity": 9.3, "slug": "quiz-master-next", "target": "plugin", "versions": "<=8.1.4"}, "RULE-CVE-2023-28787-02": {"ajax_action": "qmn_process_quiz", "conditions": [{"name": "ARGS:qmn_question_list", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#|/\\\\*)\\\\s*$|\'\\\\s*(?:OR|AND|UNION)\\\\b)~i"}], "cve": "CVE-2023-28787", "description": "Quiz And Survey Master <=8.1.4 unauthenticated SQL injection via qmn_question_list in qmn_process_quiz AJAX handler", "mode": "block", "severity": 9.3, "slug": "quiz-master-next", "target": "plugin", "versions": "<=8.1.4"}, "RULE-CVE-2023-28787-03": {"ajax_action": "qsm_get_question_quick_result", "conditions": [{"name": "ARGS:quiz_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#|/\\\\*)\\\\s*$|\'\\\\s*(?:OR|AND|UNION)\\\\b)~i"}], "cve": "CVE-2023-28787", "description": "Quiz And Survey Master <=8.1.4 unauthenticated SQL injection via quiz_id in qsm_get_question_quick_result AJAX handler", "mode": "block", "severity": 9.3, "slug": "quiz-master-next", "target": "plugin", "versions": "<=8.1.4"}, "RULE-CVE-2023-28787-04": {"ajax_action": "qsm_get_question_quick_result", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#|/\\\\*)\\\\s*$|\'\\\\s*(?:OR|AND|UNION)\\\\b)~i"}], "cve": "CVE-2023-28787", "description": "Quiz And Survey Master <=8.1.4 unauthenticated SQL injection via question_id in qsm_get_question_quick_result AJAX handler", "mode": "block", "severity": 9.3, "slug": "quiz-master-next", "target": "plugin", "versions": "<=8.1.4"}, "RULE-CVE-2023-30777-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:post_status", "type": "regex", "value": "~[\\"\']\\\\s*(?:on(?:mouse(?:over|enter|leave|move|down|up|out)|load|error|focus(?:in|out)?|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|resize|scroll|unload|before(?:unload|print)|animation(?:start|end|iteration)|transition(?:end|run|start)|input|invalid|select|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste|pointer(?:down|up|move|enter|leave|over|out)|touch(?:start|end|move|cancel)|contextmenu|wheel|toggle)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\']*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2023-30777", "description": "Advanced Custom Fields <=6.1.5 reflected XSS via post_status parameter on ACF admin list screen", "mode": "block", "severity": 6.1, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2023-30868-01": {"ajax_action": "cms_tpv_get_childs", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[\\\\s/]|<iframe[\\\\s/]|<video[\\\\s/]|<embed[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2023-30868", "description": "CMS Tree Page View <=1.6.7 reflected XSS via post_type parameter in cms_tpv_get_childs AJAX handler", "mode": "block", "severity": 6.1, "slug": "cms-tree-page-view", "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2023-30868-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cms-tpv-page-~"}, {"name": "ARGS:post_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[\\\\s/]|<iframe[\\\\s/]|<video[\\\\s/]|<embed[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2023-30868", "description": "CMS Tree Page View <=1.6.7 reflected XSS via post_type parameter on admin page rendering path", "mode": "block", "severity": 6.1, "slug": "cms-tree-page-view", "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2023-3087-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "lostpassword"}, {"name": "ARGS:user_login", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|embed|object|body|input|details|video|audio)\\\\b)~i"}], "cve": "CVE-2023-3087", "description": "FluentSMTP <=2.2.4 unauthenticated stored XSS via email subject (user_login XSS in lostpassword flow)", "mode": "block", "severity": 6.1, "slug": "fluent-smtp", "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2023-3087-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|embed|object|body|input|details|video|audio)\\\\b)~i"}], "cve": "CVE-2023-3087", "description": "FluentSMTP <=2.2.4 unauthenticated stored XSS via email subject (comment author XSS in comment notification flow)", "mode": "block", "severity": 6.1, "slug": "fluent-smtp", "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2023-30873-01": {"ajax_action": "wpdocs_create_folder", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpdocs_create_folder"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-30873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2023-30873-02": {"ajax_action": "wpdocs_update_folder", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpdocs_update_folder"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-30873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2023-30873-03": {"ajax_action": "wpdocs_delete_folder", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpdocs_delete_folder"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-30873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2023-3197-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mstore/v1/products(?:[/?]|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:union\\\\s+(?:all\\\\s+)?select|;\\\\s*(?:drop|delete|insert|update)\\\\s|or\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|and\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\banalyze\\\\b|\\\\bbenchmark\\\\b|\\\\bsleep\\\\s*\\\\()~i"}], "cve": "CVE-2023-3197", "description": "mstore-api <=4.0.1 unauthenticated SQL injection via id parameter in vendor-wcfm.php REST endpoint", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2023-32117-01": {"ajax_action": "igd_download_zip", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-02": {"ajax_action": "igd_download", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-03": {"ajax_action": "igd_stream", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-04": {"ajax_action": "igd_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-05": {"ajax_action": "igd_get_share_link", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-06": {"ajax_action": "igd_get_preview_thumbnail", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-07": {"ajax_action": "igd_get_shortcodes", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-08": {"ajax_action": "igd_get_upload_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-09": {"ajax_action": "igd_file_uploaded", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-10": {"ajax_action": "igd_delete_shortcode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-32117-11": {"ajax_action": "igd_download_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-32117", "mode": "block", "severity": 9.8, "slug": "integrate-google-drive", "target": "plugin", "versions": "<=1.1.99"}, "RULE-CVE-2023-3277-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/flutter-user/login-with-apple(?:[/?]|$)~"}], "cve": "CVE-2023-3277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-3277", "description": "MStore API <=4.10.7 unauthenticated privilege escalation via Apple login token", "mode": "block", "severity": 9.8, "slug": "mstore-api", "tags": ["privilege-escalation", "authentication-bypass", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.7"}, "RULE-CVE-2023-32960-01": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:uri", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on[a-z]+=|<svg[^>]+on[a-z]+=|<iframe[\\\\s/>])~i"}], "cve": "CVE-2023-32960", "description": "UpdraftPlus <=1.23.3 CSRF to stored XSS via uri parameter in updraft_ajax handler", "mode": "block", "severity": 7.1, "slug": "updraftplus", "target": "plugin", "versions": "<=1.23.3"}, "RULE-CVE-2023-3342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "user_registration_profile_pic_upload"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)(?:[^A-Za-z0-9]|$)|[\\\\/]\\\\.htaccess~i"}], "cve": "CVE-2023-3342", "description": "User Registration <=3.0.2 arbitrary PHP file upload via profile picture upload", "mode": "block", "slug": "user-registration", "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2023-3342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_profile_details"}, {"name": "ARGS:profile_pic_url", "type": "exists"}, {"name": "ARGS:profile_pic_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)(?:[^A-Za-z0-9]|$)~i"}], "cve": "CVE-2023-3342", "description": "User Registration <=3.0.2 arbitrary file rename via profile_pic_url extension override on profile save", "mode": "block", "slug": "user-registration", "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2023-33930-01": {"ajax_action": "unlimitedelements_manager", "conditions": [{"name": "ARGS:client_action", "type": "equals", "value": "add_addon"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-33930", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-33930", "description": "Unlimited Elements for Elementor <=1.5.66 missing authorization on add_addon allows unrestricted file upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["file-upload", "missing-authorization", "rce"], "target": "plugin", "versions": "<=1.5.66"}, "RULE-CVE-2023-33930-02": {"ajax_action": "unlimitedelements_manager", "conditions": [{"name": "ARGS:client_action", "type": "equals", "value": "update_addon"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-33930", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-33930", "description": "Unlimited Elements for Elementor <=1.5.66 missing authorization on update_addon allows unrestricted file upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["file-upload", "missing-authorization", "rce"], "target": "plugin", "versions": "<=1.5.66"}, "RULE-CVE-2023-33930-03": {"ajax_action": "unlimitedelements_manager", "conditions": [{"name": "ARGS:client_action", "type": "equals", "value": "update_addons_bulk"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-33930", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-33930", "description": "Unlimited Elements for Elementor <=1.5.66 missing authorization on update_addons_bulk allows unrestricted file upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["file-upload", "missing-authorization", "rce"], "target": "plugin", "versions": "<=1.5.66"}, "RULE-CVE-2023-34007-01": {"ajax_action": "download_monitor_add_file", "conditions": [{"name": "FILES:file", "type": "exists"}, {"name": "ARGS:file_name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|pl|asp|aspx|jsp|jspx|sh|bash|py|rb|cfm|exe|dll|com|bat|cmd|ps1|psm1|vbs|vbe|hta|jar|war|jspf|jspx)$~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2023-34007", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-34007", "description": "Download Monitor <= 4.8.3 missing authorization on dlm_upload_file AJAX action allows subscriber+ arbitrary file upload. Blocks non-admin access to the upload handler.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "download-monitor", "tags": ["arbitrary-file-upload", "missing-authorization"], "target": "plugin", "versions": "<=4.8.3"}, "RULE-CVE-2023-34007-02": {"ajax_action": "download_monitor_add_file", "conditions": [{"name": "FILES:file", "type": "exists"}, {"name": "ARGS:file_name", "type": "regex", "value": "~\\\\.htaccess$~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2023-34007", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-34007", "description": "Download Monitor <= 4.8.3 arbitrary file upload via dlm_upload_file AJAX action. Blocks .htaccess uploads for non-privileged users.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "download-monitor", "tags": ["arbitrary-file-upload", "missing-authorization", "htaccess"], "target": "plugin", "versions": "<=4.8.3"}, "RULE-CVE-2023-3459-01": {"ajax_action": "hf_update_customer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-3459", "description": "Export and Import Users and Customers <=2.4.1 missing authorization on hf_update_customer AJAX handler allows authenticated user password change and admin takeover", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2023-35051-01": {"ajax_action": "accua-save-form-settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-35051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051", "description": "Block unauthorized POST accua-save-form-settings action (Broken Access Control) in Contact Forms by Cimatti <=1.5.7", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contact-forms", "tags": ["authz", "broken-access-control", "missing-authorization"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2023-35051-02": {"ajax_action": "accua_form_save_form_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-35051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051", "description": "Block unauthorized POST accua_form_save_form_settings action (Broken Access Control) in Contact Forms by Cimatti <=1.5.7", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contact-forms", "tags": ["authz", "broken-access-control", "missing-authorization"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2023-35051-03": {"ajax_action": "accua-save-form-field", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-35051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051", "description": "Block unauthorized POST accua-save-form-field action (Broken Access Control) in Contact Forms by Cimatti <=1.5.7", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contact-forms", "tags": ["authz", "broken-access-control", "missing-authorization"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2023-35051-04": {"ajax_action": "accua_forms_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-35051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051", "description": "Block unauthorized POST accua_forms_preview action (Broken Access Control) in Contact Forms by Cimatti <=1.5.7", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contact-forms", "tags": ["authz", "broken-access-control", "missing-authorization"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2023-35051-05": {"ajax_action": "accua_forms_submission_page_save_excel", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-35051", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051", "description": "Block unauthorized POST accua_forms_submission_page_save_excel action (Broken Access Control) in Contact Forms by Cimatti <=1.5.7", "method": "POST", "mode": "block", "severity": 8.8, "slug": "contact-forms", "tags": ["authz", "broken-access-control", "missing-authorization"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2023-3636-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pm/v2/users/map-name(?:[/?]|$)~"}, {"name": "ARGS:usernames", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-3636", "description": "WP Project Manager <=2.6.4 authenticated privilege escalation via save_users_map_name REST endpoint", "mode": "block", "severity": 8.8, "slug": "wedevs-project-manager", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2023-36516-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/learnpress/v1/profile/\\\\d+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-36516", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.3"}, "RULE-CVE-2023-36679-01": {"ajax_action": "ast_block_templates_importer", "conditions": [{"name": "ARGS:api_uri", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-36679", "mode": "block", "severity": 6.5, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.6.6"}, "RULE-CVE-2023-36679-02": {"ajax_action": "ast_block_templates_import_wpforms", "conditions": [{"name": "ARGS:wpforms_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-36679", "mode": "block", "severity": 6.5, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.6.6"}, "RULE-CVE-2023-36681-01": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ccpw_get_coins_list"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-36681", "mode": "block", "severity": 9.8, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2023-36681-02": {"ajax_action": "ccpw_delete_transient", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ccpw_delete_transient"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-36681", "mode": "block", "severity": 9.8, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2023-37389-01": {"ajax_action": "package_app_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(?:updateUser|createUser|updateRolesOfUser|updateRolesOfPlugin)$~i"}], "cve": "CVE-2023-37389", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-37389", "description": "Booking Package <=1.5.98 unauthenticated privilege escalation via user modification modes", "method": "POST", "mode": "block", "severity": 8.8, "slug": "booking-package", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.5.98"}, "RULE-CVE-2023-37866-01": {"ajax_action": "jfb_addon_activate_action", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2023-37866", "mode": "block", "severity": 7.2, "slug": "jetformbuilder", "target": "plugin", "versions": "<=3.0.8"}, "RULE-CVE-2023-37967-01": {"ajax_action": "directorypress_fields_delete", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-37967", "method": "POST", "mode": "block", "severity": 9.8, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2023-37967-02": {"ajax_action": "directorypress_fields_group_delete", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-37967", "method": "POST", "mode": "block", "severity": 9.8, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2023-37967-03": {"ajax_action": "directorypress_fields_config", "conditions": [{"name": "ARGS:field_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-37967", "method": "POST", "mode": "block", "severity": 9.8, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2023-38386-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/ninja-forms-submissions/v1/export(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-38386", "method": "GET", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.6.25"}, "RULE-CVE-2023-38386-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/ninja-forms-submissions/v1/export(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-38386", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.6.25"}, "RULE-CVE-2023-38393-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/ninja-forms-submissions/v1/(download-all|export)(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-38393", "mode": "block", "severity": 8.8, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.6.25"}, "RULE-CVE-2023-39920-01": {"action": "admin_init", "conditions": [{"name": "ARGS:export_leads", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-39920", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=2.9.2"}, "RULE-CVE-2023-39920-02": {"ajax_action": "send_debug_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-39920", "mode": "block", "severity": 7.5, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=2.9.2"}, "RULE-CVE-2023-39990-01": {"ajax_action": "pmpro_courses_update_course", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pmpro_courses_update_course"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-39990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "pmpro-courses", "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2023-39990-02": {"ajax_action": "pmpro_courses_remove_course", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pmpro_courses_remove_course"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-39990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "pmpro-courses", "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2023-39997-01": {"action": "init", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "subscribe"}, {"name": "ARGS:action", "type": "equals", "value": "getWpCsvList"}, {"name": "ARGS:pl", "type": "equals", "value": "pps"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-39997", "mode": "block", "severity": 9.8, "slug": "popup-by-supsystic", "target": "plugin", "versions": "<=1.10.19"}, "RULE-CVE-2023-40000-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/litespeed/v1/cdn_status(?:[/?&]|$)~"}, {"name": "ARGS:result[_msg]", "type": "regex", "value": "~(?i)<(?:script|iframe|svg|img[^>]+onerror|/?style|/?textarea)~"}], "cve": "CVE-2023-40000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-40000", "description": "LiteSpeed Cache plugin versions <5.7.0.1 \\u2014 Unauthenticated Stored XSS\\nvia the REST callback at /wp-json/litespeed/v1/cdn_status (POST). The\\npermission_callback (is_from_cloud()) returned true unconditionally,\\nwith no cryptographic validation of the QUIC.cloud CDN origin, allowing\\nany unauthenticated POST to reach Admin_Display::error() and\\nAdmin_Display::succeed(), which rendered the raw result._msg POST value\\nin wp-admin notices without esc_html() sanitization. Injected\\nJavaScript persists in the WordPress options table and fires for any\\nadmin viewing the dashboard.\\nFixed in 5.7.0.1: permission_callback now validates the QUIC.cloud\\nsignature via sodium_crypto_sign_verify_detached(); the handler was\\nrewritten to read only qc_activated against a strict whitelist\\n(anonymous/linked/cdn/deleted). The v1 endpoint was removed in 7.0+ in\\nfavour of the litespeed/v3 namespace.\\n", "method": "POST", "mode": "block", "severity": 7.2, "slug": "litespeed-cache", "tags": ["xss-stored", "unauthenticated", "rest-api", "litespeed-cache"], "target": "plugin", "versions": "<5.7.0.1"}, "RULE-CVE-2023-40203-01": {"ajax_action": "delete_widget", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_widget"}, {"name": "ARGS:widget_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-40203", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mailchimp-forms-by-mailmunch", "target": "plugin", "versions": "<=3.1.4"}, "RULE-CVE-2023-40203-02": {"ajax_action": "change_email_status", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "change_email_status"}, {"name": "ARGS:email_id", "type": "exists"}, {"name": "ARGS:email_status", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-40203", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mailchimp-forms-by-mailmunch", "target": "plugin", "versions": "<=3.1.4"}, "RULE-CVE-2023-40203-03": {"ajax_action": "delete_email", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_email"}, {"name": "ARGS:email_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-40203", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mailchimp-forms-by-mailmunch", "target": "plugin", "versions": "<=3.1.4"}, "RULE-CVE-2023-41243-01": {"ajax_action": "wpvivid_get_import_list_page", "conditions": [{"name": "ARGS:wpvivid_upload_import_files", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-41243", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.90"}, "RULE-CVE-2023-41243-02": {"ajax_action": "wpvivid_get_import_list_page", "conditions": [{"name": "ARGS:wpvivid_start_import", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-41243", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.90"}, "RULE-CVE-2023-41243-03": {"ajax_action": "wpvivid_get_import_list_page", "conditions": [{"name": "ARGS:wpvivid_delete_export_list", "type": "exists"}, {"name": "ARGS:export_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-41243", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.90"}, "RULE-CVE-2023-45074-01": {"ajax_action": "apvc_get_all_articles_sh", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2023-45074", "description": "Advanced Page Visit Counter <=7.1.1 authenticated SQL injection via apvc_get_all_articles_sh AJAX handler", "mode": "block", "severity": 9.8, "slug": "advanced-page-visit-counter", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2023-45074-02": {"ajax_action": "apvc_show_counter_options", "conditions": [{"name": "ARGS:artID", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2023-45074", "description": "Advanced Page Visit Counter <=7.1.1 authenticated SQL injection via artID in apvc_show_counter_options AJAX handler", "mode": "block", "severity": 9.8, "slug": "advanced-page-visit-counter", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2023-45074-03": {"ajax_action": "apvc_get_top_pages_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2023-45074", "description": "Advanced Page Visit Counter <=7.1.1 authenticated SQL injection via apvc_get_top_pages_data AJAX handler", "mode": "block", "severity": 9.8, "slug": "advanced-page-visit-counter", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2023-45074-04": {"ajax_action": "apvc_get_top_posts_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2023-45074", "description": "Advanced Page Visit Counter <=7.1.1 authenticated SQL injection via apvc_get_top_posts_data AJAX handler", "mode": "block", "severity": 9.8, "slug": "advanced-page-visit-counter", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2023-4719-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "simple_wp_membership_levels"}, {"name": "ARGS:level_action", "type": "equals", "value": "post_list"}, {"name": "ARGS:list_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2023-4719", "description": "Simple Membership <=4.3.5 reflected XSS via list_type parameter in admin post list view", "mode": "block", "severity": 7.2, "slug": "simple-membership", "target": "plugin", "versions": "<=4.3.5"}, "RULE-CVE-2023-4724-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxe-admin-export"}, {"name": "ARGS:wp_query", "type": "regex", "value": "~(?:[a-zA-Z_\\\\x7f-\\\\xff][a-zA-Z0-9_\\\\x7f-\\\\xff]*\\\\s*\\\\(|\\\\$\\\\{|`|;\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|eval|assert|preg_replace)\\\\b|[OCa]:\\\\d+:\\\\\\"|\\\\s*\\\\.\\\\s*\\\\$)~i"}], "cve": "CVE-2023-4724", "description": "WP All Export <1.4.0 authenticated RCE via unsanitized wp_query parameter on export options page", "mode": "block", "severity": 7.2, "slug": "wp-all-export", "target": "plugin", "versions": "<1.4.0"}, "RULE-CVE-2023-4724-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxe-admin-import"}, {"name": "ARGS:wp_query", "type": "regex", "value": "~(?:[a-zA-Z_\\\\x7f-\\\\xff][a-zA-Z0-9_\\\\x7f-\\\\xff]*\\\\s*\\\\(|\\\\$\\\\{|`|;\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|eval|assert|preg_replace)\\\\b|[OCa]:\\\\d+:\\\\\\"|\\\\s*\\\\.\\\\s*\\\\$)~i"}], "cve": "CVE-2023-4724", "description": "WP All Export <1.4.0 authenticated RCE via unsanitized wp_query parameter on import options page", "mode": "block", "severity": 7.2, "slug": "wp-all-export", "target": "plugin", "versions": "<1.4.0"}, "RULE-CVE-2023-47504-01": {"ajax_action": "elementor_system_info_download_file", "conditions": [{"name": "ARGS:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-47504", "description": "Elementor <= 3.16.4 - Contributor+ Arbitrary File Read via system-info download_file() (Missing Authorization + Missing File Allowlist)", "mode": "block", "severity": 9.8, "slug": "elementor", "target": "plugin", "versions": "<=3.16.4"}, "RULE-CVE-2023-47504-02": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2023-47504", "description": "Elementor <= 3.16.4 - Contributor+ Unauthorized Template Library Direct Actions (Missing Authorization)", "mode": "block", "severity": 9.8, "slug": "elementor", "target": "plugin", "versions": "<=3.16.4"}, "RULE-CVE-2023-4772-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[newsletter_form\\\\b[^\\\\]]*(?:on(?:focus|error|load|mouseover|click|blur)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>]|<img[^>]+onerror\\\\s*=)~i"}], "cve": "CVE-2023-4772", "description": "Newsletter <=7.8.9 stored XSS via newsletter_form shortcode attributes in post content (Classic Editor)", "mode": "block", "severity": 6.4, "slug": "newsletter", "target": "plugin", "versions": "<=7.8.9"}, "RULE-CVE-2023-47840-01": {"ajax_action": "install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2023-47840", "description": "Qode Essential Addons <=1.5.2 subscriber+ arbitrary plugin installation via install_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "qode-essential-addons", "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2023-47840-02": {"ajax_action": "import_action", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2023-47840", "description": "Qode Essential Addons <=1.5.2 subscriber+ unauthorized demo import via import_action AJAX handler", "mode": "block", "severity": 9.9, "slug": "qode-essential-addons", "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2023-47840-03": {"ajax_action": "open_demo_single", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2023-47840", "description": "Qode Essential Addons <=1.5.2 subscriber+ unauthorized single demo import via open_demo_single AJAX handler", "mode": "block", "severity": 9.9, "slug": "qode-essential-addons", "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2023-48777-01": {"ajax_action": "elementor_upload_kit", "conditions": [{"name": "FILES:e_import_file:name", "type": "regex", "value": "~\\\\.(?:php[0-9]*|phtml|phar|cgi|exe|sh|bash)$~i"}], "cve": "CVE-2023-48777", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elementor", "target": "plugin", "versions": "3.3.0 - 3.18.1"}, "RULE-CVE-2023-4994-01": {"ajax_action": "parse-media-shortcode", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[/?(?:php|allowphp)(?:\\\\s|\\\\])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-4994", "description": "Allow PHP in Posts and Pages <=3.0.4 authenticated RCE via [php] shortcode in parse-media-shortcode AJAX handler", "mode": "block", "severity": 9.9, "slug": "allow-php-in-posts-and-pages", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2023-4994-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~allow-php-in-posts-and-pages/alter\\\\.php~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+)~i"}], "cve": "CVE-2023-4994", "description": "Allow PHP in Posts and Pages <=3.0.4 SQL injection via unsanitized id parameter in alter.php", "mode": "block", "severity": 9.9, "slug": "allow-php-in-posts-and-pages", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2023-5070-01": {"ajax_action": "sfsi_save_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-5070", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5070", "description": "Ultimate Social Media Icons <=2.8.5 unauthorized settings export via sfsi_save_export exposes social media tokens and app passwords", "mode": "block", "severity": 6.5, "slug": "ultimate-social-media-icons", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2023-50837-01": {"ajax_action": "loginlockdown_run_tool", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-50837", "description": "Login Lockdown <=2.06 missing authorization on loginlockdown_run_tool AJAX handler allows subscriber+ tool execution", "mode": "block", "severity": 7.6, "slug": "login-lockdown", "target": "plugin", "versions": "<=2.06"}, "RULE-CVE-2023-50837-02": {"action": "admin_init", "conditions": [{"name": "ARGS:ll_login_ip", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|\'\\\\s*--\\\\s)~i"}], "cve": "CVE-2023-50837", "description": "Login Lockdown <=2.06 SQL injection via ll_login_ip parameter in admin IP lookup query", "mode": "block", "severity": 7.6, "slug": "login-lockdown", "target": "plugin", "versions": "<=2.06"}, "RULE-CVE-2023-50897-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/media-file-renamer/v1/rename(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[\\"\'\\\\s,}]|$)~i"}], "cve": "CVE-2023-50897", "description": "Media File Renamer <=5.7.7 authenticated (admin+) arbitrary file rename to dangerous extension via REST /rename endpoint leading to RCE", "mode": "block", "severity": 9.1, "slug": "media-file-renamer", "target": "plugin", "versions": "<=5.7.7"}, "RULE-CVE-2023-50897-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/media-file-renamer/v1/move(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[\\"\'\\\\s,}]|$)~i"}], "cve": "CVE-2023-50897", "description": "Media File Renamer <=5.7.7 authenticated (admin+) arbitrary file rename to dangerous extension via REST /move endpoint leading to RCE", "mode": "block", "severity": 9.1, "slug": "media-file-renamer", "target": "plugin", "versions": "<=5.7.7"}, "RULE-CVE-2023-51409-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/upload(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2023-51409", "description": "AI Engine <= 1.9.98 \\u2013 Arbitrary file upload via mwai-ui REST endpoint (unauthorized users)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=1.9.98"}, "RULE-CVE-2023-51409-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2023-51409", "description": "AI Engine <= 1.9.98 \\u2013 Arbitrary file delete via mwai-ui REST endpoint (unauthorized users)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=1.9.98"}, "RULE-CVE-2023-51409-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/upload(/|\\\\?|$)~"}, {"name": "FILES:filename", "type": "regex", "value": "~\\\\.ph(?:p\\\\d?|tml|ar|ps?)$~i"}], "cve": "CVE-2023-51409", "description": "AI Engine <= 1.9.98 \\u2013 PHP file upload via mwai-ui REST endpoint (block .ph* extensions)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=1.9.98"}, "RULE-CVE-2023-51682-01": {"action": "init", "conditions": [{"name": "ARGS:mc4wp_preview_form", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2023-51682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-51682", "description": "MC4WP Mailchimp for WordPress <=4.9.9 broken access control on form preview via mc4wp_preview_form", "method": "GET", "mode": "block", "severity": 6.5, "slug": "mailchimp-for-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.9.9"}, "RULE-CVE-2023-5212-01": {"ajax_action": "qcld_openai_delete_training_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-5212", "description": "Block unauthorized file deletion via qcld_openai_delete_training_file AJAX action (CWE-862/CWE-22: Missing Authorization + Path Traversal)", "mode": "block", "severity": 9.6, "slug": "chatbot", "target": "plugin", "versions": "!=4.9.1 <4.9.3"}, "RULE-CVE-2023-5212-02": {"ajax_action": "openai_file_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-5212", "description": "Block unauthorized file deletion via openai_file_delete AJAX action (CWE-862: Missing Authorization)", "mode": "block", "severity": 9.6, "slug": "chatbot", "target": "plugin", "versions": "!=4.9.1 <4.9.3"}, "RULE-CVE-2023-52204-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "randomize"}, {"name": "ARGS:cat", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|/\\\\*[\\\\s\\\\S]*?\\\\*/|--[\\\\s]|#[\\\\s]|\'\\\\s*(?:OR|AND|UNION)\\\\b|\'\\\\s*--)~i"}], "cve": "CVE-2023-52204", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-52204", "description": "Randomize <=1.4.3 authenticated (Contributor+) SQL injection via cat parameter on admin page", "method": "GET", "mode": "block", "severity": 8.8, "slug": "randomize", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2023-5241-01": {"ajax_action": "qcld_openai_upload_pagetraining_file", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-5241", "description": "AI ChatBot <=4.9.2 authenticated path traversal via filename in qcld_openai_upload_pagetraining_file allows arbitrary file append", "mode": "block", "severity": 9.6, "slug": "chatbot", "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2023-5250-01": {"ajax_action": "grid_plus_load_by_category", "conditions": [{"name": "ARGS:grid_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|data|expect|zip|phar)://)~i"}], "cve": "CVE-2023-5250", "description": "Block unauthenticated/subscriber-level LFI via grid_plus_load_by_category AJAX action. The grid_name parameter flows unsanitized through sprintf+do_shortcode to an include sink in grid.plus.base.class.php:19. This rule detects path traversal sequences and PHP stream wrappers in the grid_name parameter.", "mode": "block", "severity": 8.8, "slug": "grid-plus", "target": "plugin", "versions": "<=1.3.3"}, "RULE-CVE-2023-5250-02": {"ajax_action": "grid_plus_load_gallery", "conditions": [{"name": "ARGS:grid_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|data|expect|zip|phar)://)~i"}], "cve": "CVE-2023-5250", "description": "Block unauthenticated/subscriber-level LFI via grid_plus_load_gallery AJAX action. Same taint flow as RULE-01 but through the gallery loading endpoint (ajax_fe.php:26-27), which is also registered on wp_ajax_nopriv_ making it accessible to unauthenticated users.", "mode": "block", "severity": 8.8, "slug": "grid-plus", "target": "plugin", "versions": "<=1.3.3"}, "RULE-CVE-2023-5505-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "backwpup"}, {"name": "ARGS:backupdir", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2[Ee]){2}%2[Ff]|(?:%252[Ee]){2}%25(?:2[Ff]|5[Cc])|^[\\\\\\\\/](?!$)|^[A-Za-z]:[\\\\\\\\/])~"}], "cve": "CVE-2023-5505", "description": "BackWPup <=4.0.1 authenticated directory traversal via backupdir parameter in job settings", "mode": "block", "severity": 6.8, "slug": "backwpup", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2023-5527-01-01": {"ajax_action": "wpbdp-csv-export", "conditions": [{"name": "ARGS:listing_title", "type": "regex", "value": "~^[\\t=+\\\\-@]~i"}], "cve": "CVE-2023-5527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5527", "description": "Business Directory Plugin <=6.4.3 CSV injection via listing_title on CSV export", "mode": "block", "severity": 8.0, "slug": "business-directory-plugin", "tags": ["csv-injection", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2023-5527-01-02": {"ajax_action": "wpbdp-csv-export", "conditions": [{"name": "ARGS:short_description", "type": "regex", "value": "~^[\\t=+\\\\-@]~i"}], "cve": "CVE-2023-5527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5527", "description": "Business Directory Plugin <=6.4.3 CSV injection via short_description on CSV export", "mode": "block", "severity": 8.0, "slug": "business-directory-plugin", "tags": ["csv-injection", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2023-5527-01-03": {"ajax_action": "wpbdp-csv-export", "conditions": [{"name": "ARGS:listing_contact_name", "type": "regex", "value": "~^[\\t=+\\\\-@]~i"}], "cve": "CVE-2023-5527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5527", "description": "Business Directory Plugin <=6.4.3 CSV injection via listing_contact_name on CSV export", "mode": "block", "severity": 8.0, "slug": "business-directory-plugin", "tags": ["csv-injection", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2023-5527-01-04": {"ajax_action": "wpbdp-csv-export", "conditions": [{"name": "ARGS:listing_contact_email", "type": "regex", "value": "~^[\\t=+\\\\-@]~i"}], "cve": "CVE-2023-5527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5527", "description": "Business Directory Plugin <=6.4.3 CSV injection via listing_contact_email on CSV export", "mode": "block", "severity": 8.0, "slug": "business-directory-plugin", "tags": ["csv-injection", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2023-5527-01-05": {"ajax_action": "wpbdp-csv-export", "conditions": [{"name": "ARGS:listing_phone", "type": "regex", "value": "~^[\\t=\\\\-@]~i"}], "cve": "CVE-2023-5527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5527", "description": "Business Directory Plugin <=6.4.3 CSV injection via listing_phone on CSV export", "mode": "block", "severity": 8.0, "slug": "business-directory-plugin", "tags": ["csv-injection", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2023-5527-01-06": {"ajax_action": "wpbdp-csv-export", "conditions": [{"name": "ARGS:listing_address", "type": "regex", "value": "~^[\\t=+\\\\-@]~i"}], "cve": "CVE-2023-5527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5527", "description": "Business Directory Plugin <=6.4.3 CSV injection via listing_address on CSV export", "mode": "block", "severity": 8.0, "slug": "business-directory-plugin", "tags": ["csv-injection", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2023-5663-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php($|\\\\?)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[news-announcement[^\\\\]]*[\'\\"][^\'\\"]*(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|CONCAT\\\\s*\\\\(|CHAR\\\\s*\\\\(|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|0x[0-9a-f]{4,}|;\\\\s*(?:SELECT|DROP|DELETE|INSERT|UPDATE)\\\\s|--\\\\s|/\\\\*|\\\\*/|\\\\bINFORMATION_SCHEMA\\\\b|(?:OR|AND)\\\\s+(?:\'[^\']+\'|\\"[^\\"]+\\"|[0-9]+)\\\\s*=\\\\s*(?:\'[^\']+\'|\\"[^\\"]+\\"|[0-9]+))~i"}], "cve": "CVE-2023-5663", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5663", "description": "News Announcement Scroll <= 9.0.0 - authenticated SQL injection via shortcode content when creating/updating posts through classic editor.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "news-announcement-scroll", "tags": ["sqli", "shortcode", "authenticated"], "target": "plugin", "versions": "<=9.0.0"}, "RULE-CVE-2023-5663-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:$|\\\\?|/)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[news-announcement[^\\\\]]*[\'\\"][^\'\\"]*(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|CONCAT\\\\s*\\\\(|CHAR\\\\s*\\\\(|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|0x[0-9a-f]{4,}|;\\\\s*(?:SELECT|DROP|DELETE|INSERT|UPDATE)\\\\s|--\\\\s|/\\\\*|\\\\*/|\\\\bINFORMATION_SCHEMA\\\\b|(?:OR|AND)\\\\s+(?:\'[^\']+\'|\\"[^\\"]+\\"|[0-9]+)\\\\s*=\\\\s*(?:\'[^\']+\'|\\"[^\\"]+\\"|[0-9]+))~i"}], "cve": "CVE-2023-5663", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5663", "description": "News Announcement Scroll <= 9.0.0 - authenticated SQL injection via shortcode content when creating/updating posts through REST API.", "mode": "block", "severity": 8.8, "slug": "news-announcement-scroll", "tags": ["sqli", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=9.0.0"}, "RULE-CVE-2023-5815-01": {"ajax_action": "bdp_get_more_post", "conditions": [{"name": "ARGS:design_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2023-5815", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-5815", "description": "Blog Designer Pack <=3.4 local file inclusion via design_file parameter in bdp_get_more_post AJAX handler", "mode": "block", "severity": 9.8, "slug": "blog-designer-pack", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2023-5843-01": {"ajax_action": "dfads_ajax_load_ads", "conditions": [{"name": "ARGS:dfads_params", "type": "regex", "value": "~display_function~"}], "cve": "CVE-2023-5843", "description": "Ads by datafeedr.com <= 1.1.3 - Unauthenticated Remote Code Execution via dfads_ajax_load_ads (call_user_func sink)", "mode": "block", "severity": 9.8, "slug": "ads-by-datafeedrcom", "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2023-5886-01": {"ajax_action": "wpae_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:phar|compress\\\\.(?:zlib|bzip2)|php|expect|data|glob)://~i"}], "cve": "CVE-2023-5886", "description": "WP All Export <1.4.0 CSRF to PHAR deserialization via wpae_api AJAX handler", "mode": "block", "severity": 8.8, "slug": "wp-all-export", "target": "plugin", "versions": "<1.4.0"}, "RULE-CVE-2023-5982-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "updraftmethod-googledrive-auth"}, {"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:updraftplus_instance", "type": "regex", "value": "~[^A-Za-z0-9-]~"}], "cve": "CVE-2023-5982", "description": "UpdraftPlus <=1.23.10 CSRF on updraftmethod-googledrive-auth allows backup destination hijack via unvalidated instance_id", "mode": "block", "severity": 5.4, "slug": "updraftplus", "target": "plugin", "versions": "<=1.23.10"}, "RULE-CVE-2023-5982-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^updraftmethod-(?!googledrive)[a-z]+-auth$~"}, {"name": "ARGS:page", "type": "equals", "value": "updraftplus"}, {"name": "ARGS:updraftplus_instance", "type": "regex", "value": "~[^A-Za-z0-9-]~"}], "cve": "CVE-2023-5982", "description": "UpdraftPlus <=1.23.10 CSRF on updraftmethod-*-auth allows backup destination hijack via unvalidated instance_id on any storage method", "mode": "block", "severity": 5.4, "slug": "updraftplus", "target": "plugin", "versions": "<=1.23.10"}, "RULE-CVE-2023-6187-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/checkout/?(?:\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|s|t)|s?html?)$~i"}], "cve": "CVE-2023-6187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6187", "description": "Paid Memberships Pro <=2.12.3 unrestricted file upload via checkout user-fields file upload", "mode": "block", "severity": 8.8, "slug": "paid-memberships-pro", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2023-6187-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/checkout/?(?:\\\\?|$)~i"}, {"name": "ARGS:gateway", "type": "regex", "value": "~^(?:paypalexpress|twocheckout)$~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|s|t)|s?html?)$~i"}], "cve": "CVE-2023-6187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6187", "description": "Paid Memberships Pro <=2.12.3 unrestricted file upload via checkout flow (PayPal Express / 2Checkout payment hooks)", "mode": "block", "severity": 8.8, "slug": "paid-memberships-pro", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2023-6187-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/checkout/?(?:\\\\?|$)~i"}, {"name": "FILES:fields_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|s|t)|s?html?)$~i"}], "cve": "CVE-2023-6187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6187", "description": "Paid Memberships Pro <=2.12.3 unrestricted file upload via checkout flow with custom upload field name (fields_file)", "mode": "block", "severity": 8.8, "slug": "paid-memberships-pro", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2023-6187-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/checkout/?(?:\\\\?|$)~i"}, {"name": "FILES:pmpro_field_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|s|t)|s?html?)$~i"}], "cve": "CVE-2023-6187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6187", "description": "Paid Memberships Pro <=2.12.3 unrestricted file upload via checkout flow with pmpro_field_file upload field name", "mode": "block", "severity": 8.8, "slug": "paid-memberships-pro", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2023-6271-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]backup-backup[/\\\\\\\\]includes[/\\\\\\\\]htaccess[/\\\\\\\\]db_tables[/\\\\\\\\][^/]+\\\\.sql(?:\\\\?|$)~i"}], "cve": "CVE-2023-6271", "description": "Backup Migration <1.3.6 unauthenticated sensitive data exposure via publicly accessible SQL dump files", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<1.3.6"}, "RULE-CVE-2023-6271-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]backup-backup[/\\\\\\\\]includes[/\\\\\\\\]htaccess[/\\\\\\\\]bmi_logs_this_backup\\\\.log(?:\\\\?|$)~i"}], "cve": "CVE-2023-6271", "description": "Backup Migration <1.3.6 unauthenticated sensitive data exposure via publicly accessible backup log file", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<1.3.6"}, "RULE-CVE-2023-6271-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]backup-backup[/\\\\\\\\]includes[/\\\\\\\\]htaccess[/\\\\\\\\]bmi_backup_manifest\\\\.json(?:\\\\?|$)~i"}], "cve": "CVE-2023-6271", "description": "Backup Migration <1.3.6 unauthenticated sensitive data exposure via publicly accessible backup manifest", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<1.3.6"}, "RULE-CVE-2023-6271-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]backup-migration-[a-f0-9]+[/\\\\\\\\](?:complete_logs\\\\.log|backups[/\\\\\\\\])~i"}], "cve": "CVE-2023-6271", "description": "Backup Migration <1.3.6 unauthenticated sensitive data exposure via publicly accessible backup archive logs", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<1.3.6"}, "RULE-CVE-2023-6294-01": {"ajax_action": "check_same_origin", "conditions": [{"name": "ARGS:siteUrl", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|ldap|tftp|ssh2)://|(?:^https?://)?(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|\\\\[::1\\\\]|localhost|0x|metadata\\\\.google))~i"}], "cve": "CVE-2023-6294", "description": "Popup Builder <4.2.6 authenticated SSRF via siteUrl in check_same_origin AJAX handler", "mode": "block", "severity": 7.2, "slug": "popup-builder", "target": "plugin", "versions": "<4.2.6"}, "RULE-CVE-2023-6294-02": {"ajax_action": "check_same_origin", "conditions": [{"name": "ARGS:iframeUrl", "type": "regex", "value": "~(?:^(?:file|gopher|dict|ftp|ldap|tftp|ssh2)://|(?:^https?://)?(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|\\\\[::1\\\\]|localhost|0x|metadata\\\\.google))~i"}], "cve": "CVE-2023-6294", "description": "Popup Builder <4.2.6 authenticated SSRF via iframeUrl in check_same_origin AJAX handler", "mode": "block", "severity": 7.2, "slug": "popup-builder", "target": "plugin", "versions": "<4.2.6"}, "RULE-CVE-2023-6526-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-6526", "description": "Meta Box <=5.9.2 contributor+ stored XSS via custom post meta values displayed through rwmb_meta shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "meta-box", "target": "plugin", "versions": "<=5.9.2"}, "RULE-CVE-2023-6558-01": {"ajax_action": "upload_import_file", "conditions": [{"name": "FILES:import_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|t)|jsp|asp|aspx|cgi|fcgi|pl|py|rb|sh|exe|dll|bat|cmd|com)(?:\\\\.|$)~i"}], "cve": "CVE-2023-6558", "description": "Users/Customers Import Export <=2.4.8 arbitrary file upload via upload_import_file \\u2014 dangerous extension block", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2023-6558-02": {"ajax_action": "upload_import_file", "conditions": [{"name": "FILES:import_file:name", "type": "regex", "value": "~\\\\.(?!csv$)[a-z0-9]{1,5}$~i"}], "cve": "CVE-2023-6558", "description": "Users/Customers Import Export <=2.4.8 arbitrary file upload via upload_import_file \\u2014 non-CSV extension block", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2023-6567-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/courses/\\\\d+/statistic~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:^|,)\\\\s*\\\\(SELECT\\\\s|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK|\\\\())~i"}], "cve": "CVE-2023-6567", "description": "LearnPress SQL Injection via order_by parameter in REST API course statistics endpoint (unauthenticated)", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.5.7"}, "RULE-CVE-2023-6600-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "omgf-update"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6600", "method": "POST", "mode": "block", "severity": 5.4, "slug": "host-webfonts-local", "target": "plugin", "versions": "<=5.7.9"}, "RULE-CVE-2023-6600-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "omgf-update"}, {"name": "ARGS:omgf_cache_keys", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2023-6600", "method": "POST", "mode": "block", "severity": 5.4, "slug": "host-webfonts-local", "target": "plugin", "versions": "<=5.7.9"}, "RULE-CVE-2023-6623-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/essential-blocks/v1/queries~i"}, {"name": "ARGS:attributes", "type": "regex", "value": "~\\"__file\\"\\\\s*:~"}], "cve": "CVE-2023-6623", "description": "Essential Blocks <4.4.3 unauthenticated local file inclusion via extract() __file variable overwrite in REST template rendering", "mode": "block", "severity": 9.8, "slug": "essential-blocks", "target": "plugin", "versions": "<4.4.3"}, "RULE-CVE-2023-6629-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=post-smtp~i"}, {"name": "ARGS:msg", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|embed|object|svg|img|details|math)\\\\b)~i"}], "cve": "CVE-2023-6629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6629", "description": "Post SMTP Mailer <=2.8.6 reflected XSS via msg parameter on wizard admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "post-smtp", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2023-6634-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/lp/v1/load_content_via_ajax(?:/|\\\\?|$)|[?&]rest_route=/lp/v1/load_content_via_ajax(?:/|\\\\?|&|$))~i"}, {"name": "ARGS:callback", "type": "exists"}, {"name": "ARGS:callback", "type": "regex", "value": "~(?i)^(?!render_courses$).+~"}], "cve": "CVE-2023-6634", "description": "LearnPress <= 4.2.5.7 \\u2013 Arbitrary callback method invocation via load_content_via_ajax REST endpoint", "mode": "block", "severity": 9.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.5.7"}, "RULE-CVE-2023-6635-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:.*/)?wp-json/gutenberghub-styles/v1/.*~"}, {"name": "REQUEST_HEADERS:Content-Type", "type": "regex", "value": "~(?i)^multipart/form-data;~"}], "cve": "CVE-2023-6635", "method": "POST", "mode": "block", "severity": 7.2, "slug": "block-options", "target": "plugin", "versions": "<=1.40.3"}, "RULE-CVE-2023-6696-01": {"ajax_action": "popupbuilder_delete_subscriber", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6696", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6696", "description": "Popup Builder <=4.3.1 missing authorization on subscriber management AJAX handlers allows low-privilege users to delete subscribers", "mode": "block", "severity": 5.4, "slug": "popup-builder", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2023-6697-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "wpgmza_map_editor"}, {"name": "ARGS:action", "type": "equals", "value": "edit"}, {"name": "ARGS:map_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2023-6697", "description": "WP Google Maps <=9.0.28 reflected XSS via map_id in Atlas Novus map editor page", "mode": "block", "severity": 6.1, "slug": "wp-google-maps", "target": "plugin", "versions": ">=9.0.0 <=9.0.28"}, "RULE-CVE-2023-6701-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/]|<svg[\\\\s/][^>]*on[a-z]+=|<embed[\\\\s/]|<object[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-6701", "description": "Advanced Custom Fields <=6.2.4 contributor+ stored XSS via post.php custom fields metavalue", "mode": "block", "severity": 5.4, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.2.4"}, "RULE-CVE-2023-6701-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/]|<svg[\\\\s/][^>]*on[a-z]+=|<embed[\\\\s/]|<object[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-6701", "description": "Advanced Custom Fields <=6.2.4 contributor+ stored XSS via REST API post meta update", "mode": "block", "severity": 5.4, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.2.4"}, "RULE-CVE-2023-6708-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/async-upload\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|begin|end)\\\\s*=|javascript\\\\s*:|<foreignObject\\\\b|<use\\\\b[^>]*\\\\bhref\\\\s*=\\\\s*[\\"\']?(?:javascript:|data:)|xlink:href\\\\s*=\\\\s*[\\"\']?(?:javascript:|data:))~i"}], "cve": "CVE-2023-6708", "description": "SVG Support <=2.5.7 author+ stored XSS via malicious SVG upload to async-upload.php (sanitizer bypass via Content-Type)", "mode": "block", "severity": 5.4, "slug": "svg-support", "target": "plugin", "versions": "<=2.5.7"}, "RULE-CVE-2023-6750-01": {"ajax_action": "wpclone-ajax-delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6750", "description": "WP Clone <=2.4.2 missing authorization on wpclone-ajax-delete allows authenticated attackers to delete backups", "mode": "block", "severity": 7.5, "slug": "wp-clone-by-wp-academy", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2023-6750-02": {"ajax_action": "wpclone-ajax-dir", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6750", "description": "WP Clone <=2.4.2 missing authorization on wpclone-ajax-dir allows authenticated attackers to enumerate backup directories", "mode": "block", "severity": 7.5, "slug": "wp-clone-by-wp-academy", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2023-6750-03": {"ajax_action": "wpclone-ajax-size", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6750", "description": "WP Clone <=2.4.2 missing authorization on wpclone-ajax-size allows authenticated attackers to view backup sizes", "mode": "block", "severity": 7.5, "slug": "wp-clone-by-wp-academy", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2023-6750-04": {"ajax_action": "wpclone-ajax-uninstall", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6750", "description": "WP Clone <=2.4.2 missing authorization on wpclone-ajax-uninstall allows authenticated attackers to uninstall plugin", "mode": "block", "severity": 7.5, "slug": "wp-clone-by-wp-academy", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2023-6750-05": {"ajax_action": "wpclone-install_new", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6750", "description": "WP Clone <=2.4.2 missing authorization on wpclone-install_new allows authenticated attackers to install plugins", "mode": "block", "severity": 7.5, "slug": "wp-clone-by-wp-academy", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2023-6750-06": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6750", "description": "WP Clone <=2.4.2 missing authorization on wpclone-search-n-replace allows authenticated attackers to search/replace content", "mode": "block", "severity": 7.5, "slug": "wp-clone-by-wp-academy", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2023-6751-01": {"ajax_action": "hostinger_publish_website", "conditions": [{"name": "ARGS:maintenance", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6751", "method": "POST", "mode": "block", "severity": 6.5, "slug": "hostinger", "target": "plugin", "versions": "<=1.9.7"}, "RULE-CVE-2023-6781-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:obfx_header_scripts", "type": "regex", "value": "~(?:on(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|form|input|img|svg|details|body)\\\\b[^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?(?:data|javascript):))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-6781", "description": "Orbit Fox by ThemeIsle <=2.10.26 contributor+ stored XSS via obfx_header_scripts custom field", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.26"}, "RULE-CVE-2023-6781-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:obfx_body_scripts", "type": "regex", "value": "~(?:on(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|form|input|img|svg|details|body)\\\\b[^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?(?:data|javascript):))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-6781", "description": "Orbit Fox by ThemeIsle <=2.10.26 contributor+ stored XSS via obfx_body_scripts custom field", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.26"}, "RULE-CVE-2023-6781-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:obfx_footer_scripts", "type": "regex", "value": "~(?:on(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|form|input|img|svg|details|body)\\\\b[^>]*(?:on\\\\w+\\\\s*=|src\\\\s*=\\\\s*[\\"\']?(?:data|javascript):))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-6781", "description": "Orbit Fox by ThemeIsle <=2.10.26 contributor+ stored XSS via obfx_footer_scripts custom field", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.26"}, "RULE-CVE-2023-6827-01": {"ajax_action": "gsf_upload_fonts", "conditions": [{"name": "FILES:file_font", "type": "exists"}], "cve": "CVE-2023-6827", "method": "POST", "mode": "block", "severity": 8.8, "slug": "essential-real-estate", "target": "plugin", "versions": "<=4.3.5"}, "RULE-CVE-2023-6877-01": {"ajax_action": "feedzy_categories", "conditions": [{"name": "ARGS:feedzy_category_feed", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2023-6877", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6877", "description": "Feedzy RSS Feeds <=4.3.3 stored XSS via feedzy_category_feed AJAX handler", "mode": "block", "severity": 5.4, "slug": "feedzy-rss-feeds", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2023-6877-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "feedzy_imports"}, {"name": "ARGS:column", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2023-6877", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2023-6877", "description": "Feedzy RSS Feeds <=4.3.3 stored XSS via admin column display in feedzy_imports post type", "method": "GET", "mode": "block", "severity": 5.4, "slug": "feedzy-rss-feeds", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2023-6878-01": {"ajax_action": "dcssb_ajax_update", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "dcssb_ajax_update"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6878", "description": "Slick Social Share Buttons <= 2.4.11 dcssb_ajax_update missing capability check allows authenticated subscriber+ users to arbitrarily modify site options, enabling unauthorized configuration changes via admin-ajax.php as described by Wordfence and NVD.", "method": "POST", "mode": "block", "severity": 6.5, "slug": "slick-social-share-buttons", "tags": ["authz", "arbitrary-option-update", "privilege-escalation"], "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2023-6964-01": {"ajax_action": "kadence_import_get_new_connection_data", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://(?:api\\\\.kadenceblocks\\\\.com|cdn\\\\.kadenceblocks\\\\.com)/)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|localhost|(?:10|172\\\\.(?:1[6-9]|2\\\\d|3[01])|192\\\\.168)\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|/etc/passwd|file://|gopher://|dict://|ftp://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6964", "description": "Kadence Blocks <=3.1.26 authenticated SSRF via url parameter in kadence_import_get_new_connection_data AJAX handler", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.1.26"}, "RULE-CVE-2023-6966-04": {"ajax_action": "get_ads_txt", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6966", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve", "description": "The Moneytizer <= 9.6.3 wp_ajax_get_ads_txt missing capability/nonce checks allow subscriber+ or CSRF to read/alter ads.txt, lazy-loading, stats visibility, and tag configuration via admin-ajax.php.", "method": "POST", "mode": "block", "severity": 8.1, "slug": "the-moneytizer", "tags": ["improper-access-control", "missing-authorization", "csrf", "ajax"], "target": "plugin", "versions": "<=9.6.3"}, "RULE-CVE-2023-6966-05": {"ajax_action": "do_generate_tag", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6966", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve", "description": "The Moneytizer <= 9.6.3 wp_ajax_do_generate_tag missing capability/nonce checks allow subscriber+ or CSRF to generate/modify Moneytizer tags and formats via admin-ajax.php.", "method": "POST", "mode": "block", "severity": 8.1, "slug": "the-moneytizer", "tags": ["improper-access-control", "missing-authorization", "csrf", "ajax"], "target": "plugin", "versions": "<=9.6.3"}, "RULE-CVE-2023-6966-06": {"ajax_action": "update_bank_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6966", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve", "description": "The Moneytizer <= 9.6.3 wp_ajax_update_bank_data missing capability/nonce checks allow subscriber+ or CSRF to update billing/bank details via admin-ajax.php.", "method": "POST", "mode": "block", "severity": 8.1, "slug": "the-moneytizer", "tags": ["improper-access-control", "missing-authorization", "csrf", "ajax"], "target": "plugin", "versions": "<=9.6.3"}, "RULE-CVE-2023-6966-07": {"ajax_action": "do_reactivate_tag", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6966", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve", "description": "The Moneytizer <= 9.6.3 wp_ajax_do_reactivate_tag missing capability/nonce checks allow subscriber+ or CSRF to reactivate tags via admin-ajax.php.", "method": "POST", "mode": "block", "severity": 8.1, "slug": "the-moneytizer", "tags": ["improper-access-control", "missing-authorization", "csrf", "ajax"], "target": "plugin", "versions": "<=9.6.3"}, "RULE-CVE-2023-6966-08": {"ajax_action": "apply_conf", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-6966", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve", "description": "The Moneytizer <= 9.6.3 wp_ajax_apply_conf missing capability/nonce checks allow subscriber+ or CSRF to apply configuration via admin-ajax.php.", "method": "POST", "mode": "block", "severity": 8.1, "slug": "the-moneytizer", "tags": ["improper-access-control", "missing-authorization", "csrf", "ajax"], "target": "plugin", "versions": "<=9.6.3"}, "RULE-CVE-2023-6967-01": {"action": "init", "conditions": [{"name": "ARGS:pod", "type": "regex", "value": "~(?:UNION(?:%(?:25)*20|\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:%(?:25)*20|\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT|%2520UNION%2520SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)(?:\\\\s|%20|$))~i"}], "cve": "CVE-2023-6967", "description": "Pods <=3.3.8 authenticated SQL injection via [pods] shortcode pod parameter", "mode": "block", "severity": 8.8, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2023-6967-02": {"ajax_action": "pq_loadpod", "conditions": [{"name": "ARGS:pod", "type": "regex", "value": "~(?:UNION(?:%(?:25)*20|\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:%(?:25)*20|\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT|%2520UNION%2520SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)(?:\\\\s|%20|$))~i"}], "cve": "CVE-2023-6967", "description": "Pods <=3.3.8 authenticated SQL injection via pq_loadpod AJAX action pod parameter", "mode": "block", "severity": 8.8, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2023-6967-03": {"ajax_action": "pq_loadpod", "conditions": [{"name": "ARGS:pod_reference[pod]", "type": "regex", "value": "~(?:UNION(?:%(?:25)*20|\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:%(?:25)*20|\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT|%2520UNION%2520SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)(?:\\\\s|%20|$))~i"}], "cve": "CVE-2023-6967", "description": "Pods <=3.3.8 authenticated SQL injection via pq_loadpod AJAX pod_reference[pod] nested parameter", "mode": "block", "severity": 8.8, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2023-6979-01": {"ajax_action": "ivole_import_upload_csv", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2023-6979", "description": "Customer Reviews for WooCommerce <=5.38.9 authenticated arbitrary file upload via ivole_import_upload_csv AJAX action", "mode": "block", "severity": 8.8, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<=5.38.9"}, "RULE-CVE-2023-6983-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php$~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vg_display_data\\\\b[^\\\\]]*key\\\\s*=~i"}], "cve": "CVE-2023-6983", "method": "POST", "mode": "block", "severity": 4.3, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-6983-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/\\\\d+)?/?(?:\\\\?.*)?|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/posts(?:/\\\\d+)?/?(?:&[^#]*)?)$~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[vg_display_data\\\\b[^\\\\]]*key\\\\s*=~i"}], "cve": "CVE-2023-6983", "method": "POST", "mode": "block", "severity": 4.3, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-6983-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/\\\\d+)?/?(?:\\\\?.*)?|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/posts(?:/\\\\d+)?/?(?:&[^#]*)?)$~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[vg_display_data\\\\b[^\\\\]]*key\\\\s*=~i"}], "cve": "CVE-2023-6983", "method": "PUT", "mode": "block", "severity": 4.3, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-6983-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/\\\\d+)?/?(?:\\\\?.*)?|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/posts(?:/\\\\d+)?/?(?:&[^#]*)?)$~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[vg_display_data\\\\b[^\\\\]]*key\\\\s*=~i"}], "cve": "CVE-2023-6983", "method": "PATCH", "mode": "block", "severity": 4.3, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-6989-01": {"action": "init", "conditions": [{"name": "ARGS:render_action_template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/\\\\\\\\]|[\\\\/\\\\\\\\]\\\\.\\\\.|(?:php|phar|data|file|glob|zip|expect|zlib|ftp|https?):\\\\/\\\\/|%00|\\\\\\\\|^[\\\\/](?:etc|var|usr|bin|sbin|proc|sys|dev|home|root|tmp|opt|srv|lib|boot|run|mnt|media)(?:[\\\\/]|$)|\\\\.(?:php\\\\d?|phtml|pht|phar|inc)(?:$|[\\\\/?#]))~i"}], "cve": "CVE-2023-6989", "description": "Unauthenticated LFI/RCE in Shield Security (wp-simple-firewall <=18.5.9). Sink: .../wordpress-services/src/Utilities/Render.php:89 include($template), reached when BaseRender.php:53-59 selects the PHP engine for any non-.twig extension in the request-controlled render_action_template (BaseRender.php:108). Entrypoint: WP \'init\' -> CaptureShieldAction -> Render/GenericRender (AuthNotRequired + NonceVerifyNotRequired), unauth, no nonce (action=shield_action&ex=generic_render). Fixed 18.5.10 (forces Twig).", "mode": "block", "severity": 9.8, "slug": "wp-simple-firewall", "target": "plugin", "versions": "<=18.5.9"}, "RULE-CVE-2023-6996-01": {"action": "the_content", "conditions": [{"name": "BODY", "type": "regex", "value": "~\\\\[vg_display_data[^\\\\]]*wp_filter\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"]+[\'\\\\\\"]~i"}], "cve": "CVE-2023-6996", "mode": "block", "severity": 8.8, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-6996-02": {"action": "the_content", "conditions": [{"name": "BODY", "type": "regex", "value": "~\\\\[vg_display_data[^\\\\]]*sanitization\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"]+[\'\\\\\\"]~i"}], "cve": "CVE-2023-6996", "mode": "block", "severity": 8.8, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-6996-03": {"action": "the_content", "conditions": [{"name": "BODY", "type": "regex", "value": "~\\\\[vg_display_data\\\\b[^\\\\]]*\\\\b(user_id|field)\\\\s*=~i"}], "cve": "CVE-2023-6996", "mode": "block", "severity": 8.8, "slug": "shortcode-to-display-post-and-user-data", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2023-7002-01": {"ajax_action": "backup-migration-ajax", "conditions": [{"name": "ARGS:f", "type": "equals", "value": "download-backup"}, {"name": "ARGS:url", "type": "regex", "value": "~(%3[Bb]|%7[Cc]|%26%26|%7[Cc]%7[Cc]|%60|%24%5C%28|%3[Ee]|%3[Cc]|%0[Aa]|%0[Dd]|[;|`$><])~"}], "cve": "CVE-2023-7002", "method": "POST", "mode": "block", "severity": 7.2, "slug": "backup-backup", "target": "plugin", "versions": "<=1.3.9"}, "RULE-CVE-2023-7071-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/table-of-contents[^}]*}[^-]*-->\\\\s*(?:<script[\\\\s/>]|<[^>]+\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2023-7071", "description": "Essential Blocks <=4.4.6 contributor+ stored XSS via Table of Contents block attributes", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2023-7291-01": {"ajax_action": "paytium_mollie_create_account", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-02": {"ajax_action": "paytium_mollie_create_profile", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-03": {"ajax_action": "pt_save_profile_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-04": {"ajax_action": "pt_get_mollie_profiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2023-7291-05": {"ajax_action": "paytium_sw_save_api_keys", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2023-7291", "method": "POST", "mode": "block", "severity": 8.1, "slug": "paytium", "target": "plugin", "versions": "<=4.3.7"}, "RULE-CVE-2024-0221-01": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_new_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_new_name in addImages rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-02": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-03": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "remove_items"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages remove_items", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-deletion"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-04": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "copy"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages copy", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-copy"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-05": {"ajax_action": "addImages", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "move"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addImages move", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-move"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-06": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_new_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_new_name in addMusic rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-07": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "rename_item"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic rename_item", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "file-rename"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-08": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "remove_items"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic remove_items", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-deletion"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-09": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "copy"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic copy", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-copy"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0221-10": {"ajax_action": "addMusic", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "move"}, {"name": "ARGS:file_names", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{3,}[\\\\\\\\/])~"}], "cve": "CVE-2024-0221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0221", "description": "Photo Gallery <=1.8.19 authenticated path traversal via file_names in addMusic move", "method": "POST", "mode": "block", "severity": 7.2, "slug": "photo-gallery", "tags": ["path-traversal", "arbitrary-file-move"], "target": "plugin", "versions": "<=1.8.19"}, "RULE-CVE-2024-0378-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-json/mwai(?:-ui)?/v1/(?:chats/submit|chat|simpleChatbotQuery)(?:/|\\\\?|$)~i"}, {"name": "ARGS:newMessage", "type": "regex", "value": "~<\\\\s*script\\\\b[^>]*>.*?<\\\\/\\\\s*script\\\\s*>|<[^>]+\\\\b(?:href|src)\\\\s*=\\\\s*(?:[\\"\']?)\\\\s*(?:javascript|vbscript)\\\\s*:|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=\\\\s*[\\"\']~is"}], "cve": "CVE-2024-0378", "description": "Stored XSS via AI chat message in AI Engine plugin REST API", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-0405-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/burst/v1/data/compare(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-0405", "description": "Burst Statistics <=1.5.3 authenticated SQL injection via data/compare REST endpoint", "mode": "block", "severity": 7.2, "slug": "burst-statistics", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2024-0405-02": {"ajax_action": "burst_rest_api_fallback", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-0405", "description": "Burst Statistics <=1.5.3 authenticated SQL injection via REST API fallback AJAX handler", "mode": "block", "severity": 7.2, "slug": "burst-statistics", "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2024-0508-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:javascript|data)[ \\\\t]*:~i"}], "cve": "CVE-2024-0508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0508", "description": "Orbit Fox by ThemeIsle <=2.10.27 contributor+ stored XSS via Pricing Table widget link URL - Elementor AJAX save path", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.10.27"}, "RULE-CVE-2024-0508-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/(?:document/save|documents)(?:[/?]|$)~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:javascript|data)[ \\\\t]*:~i"}], "cve": "CVE-2024-0508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0508", "description": "Orbit Fox by ThemeIsle <=2.10.27 contributor+ stored XSS via Pricing Table widget link URL - Elementor REST save path", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored", "authenticated", "elementor", "rest-api"], "target": "plugin", "versions": "<=2.10.27"}, "RULE-CVE-2024-0608-01": {"ajax_action": "erp_crm_track_email_opened", "conditions": [{"name": "ARGS:email", "type": "detectSQLi"}], "cve": "CVE-2024-0608", "mode": "block", "severity": 8.8, "slug": "erp", "target": "plugin", "versions": "<=1.13.1"}, "RULE-CVE-2024-0659-01": {"action": "admin_init", "conditions": [{"name": "ARGS:edd-action", "type": "equals", "value": "tools_tab_debug_log"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-0659", "description": "Easy Digital Downloads <=3.1.5 unauthorized access to debug log tools action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "easy-digital-downloads", "tags": ["broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2024-0660-01A": {"ajax_action": "frm_save_form", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "frm_save_form"}, {"name": "ARGS:success_msg", "type": "detectXSS"}], "cve": "CVE-2024-0660", "description": "Formidable Forms <=6.7.2 CSRF-to-stored-XSS via admin-ajax frm_save_form (missing nonce validation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "tags": ["xss", "csrf", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.7.2"}, "RULE-CVE-2024-0660-01B": {"ajax_action": "frm_save_form", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "frm_save_form"}, {"name": "ARGS:custom_html", "type": "detectXSS"}], "cve": "CVE-2024-0660", "description": "Formidable Forms <=6.7.2 CSRF-to-stored-XSS via admin-ajax frm_save_form (missing nonce validation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "formidable", "tags": ["xss", "csrf", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.7.2"}, "RULE-CVE-2024-0668-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^advanced_db_cleaner~"}, {"name": "ARGS:aDBc_cron_elements", "type": "regex", "value": "~(?:^|%[0-9A-Fa-f]{2}|[&=\\\\[\\\\]\\"\'])[OCa]\\\\s*(?::|%3[Aa])\\\\s*[0-9]+\\\\s*(?::|%3[Aa])~"}], "cve": "CVE-2024-0668", "description": "Advanced Database Cleaner <=3.1.3 authenticated PHP object injection via process_bulk_action unserialize of aDBc_cron_elements on plugin admin page", "mode": "block", "severity": 7.2, "slug": "advanced-database-cleaner", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2024-0668-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^advanced_db_cleaner~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"[A-Za-z_\\\\\\\\][A-Za-z0-9_\\\\\\\\]*\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-0668", "description": "Advanced Database Cleaner <=3.1.3 PHP object injection payload in any plugin admin POST parameter via bulk action serialized object marker", "mode": "block", "severity": 7.2, "slug": "advanced-database-cleaner", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2024-0685-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:wp-privacy-export-personal-data|remove_personal_data)$~"}, {"name": "ARGS:email_address", "type": "regex", "value": "~(?:\'|%27|\\\\\\\\\')(?:[^@]{0,80})(?:(?:/\\\\*|%2F\\\\*)|(?:\\\\s|%20|\\\\+)(?:OR|AND|UNION)(?:\\\\s|%20|\\\\+|\\\\()|(?:--|%2D%2D|#|%23)|;|\\\\|\\\\||!=)~i"}], "cve": "CVE-2024-0685", "description": "Ninja Forms <=3.7.1 SQLi metacharacters in email_address on WP privacy export trigger reaching get_subs_by_email", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.7.1"}, "RULE-CVE-2024-0699-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php(?:[0-9s]?|t|tm)?|pht|phtml|phar|shtml|asp|aspx|jsp|cgi)(?:[?#]|$)~i"}], "cve": "CVE-2024-0699", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-0699-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^https?://169\\\\.254\\\\.169\\\\.254(?:[/:?#]|$)~i"}], "cve": "CVE-2024-0699", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-0709-01A": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0709-01B0": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist[0]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0709-01B1": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:coinslist[1]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-0709", "mode": "block", "severity": 7.5, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": ">=2.0 <=2.6.5"}, "RULE-CVE-2024-0786-01": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:conditionData", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via conditionData in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-02": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:valueData", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via valueData in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-03": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:exclude", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via exclude in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-04": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via include in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0786-05": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:productArray", "type": "regex", "value": "~(?:[\'\\")\\\\)]\\\\s*(?:OR|AND)\\\\s+[^\\\\s]+=|UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)~i"}], "cve": "CVE-2024-0786", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0786", "description": "Conversios <=7.0.7 authenticated SQL injection via productArray in ee_syncProductCategory", "method": "POST", "mode": "block", "severity": 6.5, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-0825-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vimeography/v1/galleries/\\\\d+/duplicate(/|\\\\?|$)~"}, {"name": "ARGS:vimeography_duplicate_gallery_serialized", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-0825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0825", "description": "Vimeography <=2.3.2 PHP Object Injection via deserialization of untrusted input in duplicate gallery REST endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vimeography", "tags": ["object-injection", "deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.2"}, "RULE-CVE-2024-0852-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration)\\\\s*=|javascript:~i"}], "cve": "CVE-2024-0852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0852", "description": "coreActivity <1.8.1 unauthenticated stored XSS via REQUEST_URI logged and displayed unescaped in admin dashboard", "method": "GET", "mode": "block", "severity": 8.8, "slug": "coreactivity", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<1.8.1"}, "RULE-CVE-2024-0852-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration)\\\\s*=|javascript:~i"}], "cve": "CVE-2024-0852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0852", "description": "coreActivity <1.8.1 unauthenticated stored XSS via search query parameter logged and displayed unescaped", "method": "GET", "mode": "block", "severity": 8.8, "slug": "coreactivity", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<1.8.1"}, "RULE-CVE-2024-0856-01": {"action": "init", "conditions": [{"name": "ARGS:cpabc_ipncheck", "type": "regex", "value": "~(?:\'[[:space:]]*(?:or|and|union|select|insert|update|delete|drop|--|#)|;[[:space:]]*(?:select|insert|update|delete|drop|--|sleep|benchmark)|--|/\\\\*|\\\\*/|[[:<:]]or[[:space:]]+[0-9]+=+[0-9]+|[[:<:]]union[[:space:]]+(?:all[[:space:]]+)?select|[[:<:]]select[[:space:]].*[[:space:]]from)~i"}], "cve": "CVE-2024-0856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0856", "description": "Appointment Booking Calendar <=1.3.82 SQL injection via cpabc_ipncheck on init", "mode": "block", "severity": 8.8, "slug": "appointment-booking-calendar", "tags": ["sql-injection", "csrf", "unauthenticated"], "target": "plugin", "versions": "<1.3.83"}, "RULE-CVE-2024-0952-01": {"ajax_action": "erp_acct_get_people", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|PG_SLEEP\\\\s*\\\\(|WAITFOR\\\\s+DELAY)~i"}, {"type": "missing_capability", "value": "erp_acct_manager"}], "cve": "CVE-2024-0952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-0952", "description": "WP ERP <=1.12.9 authenticated SQL injection via id parameter in erp_acct_get_people AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "erp", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.12.9"}, "RULE-CVE-2024-10002-01": {"ajax_action": "rover_idx_refresh_social", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10002", "description": "Rover IDX <=3.0.0.2905 authentication bypass to administrator via rover_idx_refresh_social AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "rover-idx", "tags": ["authentication-bypass", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=3.0.0.2905"}, "RULE-CVE-2024-10002-02": {"ajax_action": "rover_idx_social", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10002", "description": "Rover IDX <=3.0.0.2905 unauthorized social settings manipulation via rover_idx_social AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "rover-idx", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=3.0.0.2905"}, "RULE-CVE-2024-10079-01": {"ajax_action": "import_content", "conditions": [{"name": "ARGS:text", "type": "regex", "value": "~(^|[;{])\\\\s*(O|C):[0-9]+:\\"~"}], "cve": "CVE-2024-10079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10079", "description": "WP Easy Post Types <=1.4.4 PHP Object Injection via unserialize of text parameter in import_content AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-post-types", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-10124-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/vayu-site-builder(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10124", "description": "Vayu Blocks <=1.1.1 unauthenticated arbitrary plugin/theme installation via REST API /ai/v1/vayu-site-builder", "method": "POST", "mode": "block", "severity": 9.8, "slug": "vayu-blocks", "tags": ["missing-authorization", "arbitrary-plugin-install", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2024-10222-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~<script[\\\\s/>]|\\\\bon(?:load|error|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|xlink:href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript~i"}], "cve": "CVE-2024-10222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10222", "description": "SVG Support <=2.5.10 stored XSS via unsanitized SVG file upload through REST API media endpoint", "mode": "block", "severity": 6.4, "slug": "svg-support", "tags": ["xss", "stored-xss", "file-upload", "svg", "rest-api"], "target": "plugin", "versions": "<=2.5.10"}, "RULE-CVE-2024-10247-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "video-gallery"}, {"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2024-10247", "method": "GET", "mode": "block", "severity": 4.9, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2024-10247-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "video-gallery"}, {"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2024-10247", "method": "GET", "mode": "block", "severity": 4.9, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.2"}, "RULE-CVE-2024-10310-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~image_title[^}]*(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:svg|img|iframe|details|object|embed|math|audio|video|body|marquee|isindex|form|input|button|textarea|select|base|link|meta|style|applet|xml)[\\\\s/>][^}]*?\\\\bon(?:error|load|toggle|click|mouseover|focus|blur|pointerover|animationend|transitionend)\\\\s*=|<[^>]{0,50}javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10310", "description": "Element Pack Elementor Addons <=5.10.1 Contributor+ Stored XSS via Custom Gallery Widget image_title parameter", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "target": "plugin", "versions": "<=5.10.1"}, "RULE-CVE-2024-10310-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~image_accordion_title[^}]*(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:svg|img|iframe|details|object|embed|math|audio|video|body|marquee|isindex|form|input|button|textarea|select|base|link|meta|style|applet|xml)[\\\\s/>][^}]*?\\\\bon(?:error|load|toggle|click|mouseover|focus|blur|pointerover|animationend|transitionend)\\\\s*=|<[^>]{0,50}javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-10310", "description": "Element Pack Elementor Addons <=5.10.1 Contributor+ Stored XSS via Image Accordion Widget image_accordion_title parameter", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "target": "plugin", "versions": "<=5.10.1"}, "RULE-CVE-2024-10322-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/(?:async-upload|media-new)\\\\.php|^/wp-json/wp/v2/media|(?:^|&|\\\\?)rest_route=/wp/v2/media)~i"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|animationiteration|animationend|begin|end|repeat)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s>]|xlink:href\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|data):)~i"}], "cve": "CVE-2024-10322", "description": "Brizy <=2.6.8 author+ stored XSS via malicious SVG file upload (insufficient sanitization in wp_handle_upload_prefilter) - classic media upload endpoints", "mode": "block", "severity": 5.4, "slug": "brizy", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-10322-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\son(?:load|error|click|mouseover|focus|blur|animationstart|animationiteration|animationend|begin|end|repeat)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s>]|xlink:href\\\\s*=\\\\s*[\\"\']\\\\s*(?:javascript|data):)~i"}], "cve": "CVE-2024-10322", "description": "Brizy <=2.6.8 author+ stored XSS via malicious SVG upload through REST media endpoint (file field)", "mode": "block", "severity": 5.4, "slug": "brizy", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-10367-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:content", "type": "regex", "value": "~<\\\\s*script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:embed|object|iframe)[\\\\s/>]~i"}], "cve": "CVE-2024-10367", "description": "Otter Blocks <=3.0.4 stored XSS via malicious SVG file upload through REST API media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2024-1037-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^aiowpsec~i"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<|%3[Cc]|%25(?:3[Cc]|2[5%]3[Cc]))(?:script|svg|img|iframe|s[\\\\s/]*v[\\\\s/]*g|/?[a-z]+[\\\\s/]+on[a-z]+\\\\s*=)|on(?:load|error|click|mouseover|focus|submit)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*(?:script|html)~i"}], "cve": "CVE-2024-1037", "description": "All-In-One Security (AIOS) <=5.2.5 reflected XSS via tab parameter on AIOS admin pages (wp-security-list-404.php)", "mode": "block", "severity": 6.1, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.2.5"}, "RULE-CVE-2024-10392-01": {"ajax_action": "wpaicg_save_image_media", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-10392", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gpt3-ai-content-generator", "target": "plugin", "versions": "<=1.8.89"}, "RULE-CVE-2024-10400-01": {"ajax_action": "load_filtered_instructor", "conditions": [{"name": "ARGS:rating_filter", "type": "regex", "value": "~[^1-5]~"}], "cve": "CVE-2024-10400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10400", "description": "Tutor LMS <=2.7.6 unauthenticated SQLi via rating_filter POST param in the load_filtered_instructor AJAX action (Utils::get_instructors HAVING clause, Utils.php:3193)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2024-10402-01": {"ajax_action": "forminator_save_builder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10402", "description": "Forminator <=1.35.1 missing authorization on forminator_save_builder allows contributor+ form creation/editing", "mode": "block", "severity": 8.8, "slug": "forminator", "target": "plugin", "versions": "<=1.35.1"}, "RULE-CVE-2024-10453-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~global_typography_title.*?(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10453", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementor", "target": "plugin", "versions": "<=3.25.9"}, "RULE-CVE-2024-10499-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:filters[*][value]", "type": "regex", "value": "~(?:\\\\b(?:UNION(?:\\\\s|/\\\\*.*?\\\\*/)+(?:ALL(?:\\\\s|/\\\\*.*?\\\\*/)+)?SELECT|SELECT\\\\s+.+?\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+\\\\S+\\\\s+SET|DELETE\\\\s+FROM|DROP\\\\s+(?:TABLE|DATABASE|INDEX)|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|(?:--|/\\\\*)\\\\s*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP)|\\\\b(?:SLEEP|BENCHMARK|LOAD_FILE|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2024-10499", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.6.5"}, "RULE-CVE-2024-10499-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~(?:\\\\b(?:UNION(?:\\\\s|/\\\\*.*?\\\\*/)+(?:ALL(?:\\\\s|/\\\\*.*?\\\\*/)+)?SELECT|SELECT\\\\s+.+?\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+\\\\S+\\\\s+SET|DELETE\\\\s+FROM|DROP\\\\s+(?:TABLE|DATABASE|INDEX)|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|(?:--|/\\\\*)\\\\s*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP)|\\\\b(?:SLEEP|BENCHMARK|LOAD_FILE|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2024-10499", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.6.5"}, "RULE-CVE-2024-10508-01": {"action": "init", "conditions": [{"name": "ARGS:rm_form_sub_id", "type": "equals", "value": "rm_reset_password_form"}, {"name": "ARGS:token_val", "type": "regex", "value": "~^\\\\s*(?:11)?\\\\s*$~"}], "cve": "CVE-2024-10508", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.2.6"}, "RULE-CVE-2024-10542-01": {"action": "init", "conditions": [{"name": "ARGS:spbc_remote_call_action", "type": "regex", "value": "~^(?:install_plugin|activate_plugin|deactivate_plugin|uninstall_plugin|update_settings|post_api_key)$~i"}, {"name": "ARGS:plugin_name", "type": "regex", "value": "~^(?:antispam|anti-spam|apbct)$~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2024-10542", "mode": "block", "severity": 7.5, "slug": "cleantalk-spam-protect", "target": "plugin", "versions": "<=6.43.2"}, "RULE-CVE-2024-1061-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/h5vp/v1/view(?:/|\\\\?|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:AND|OR|UNION|SELECT|--|#)|/\\\\*[^*]*\\\\*/|--\\\\s)~i"}], "cve": "CVE-2024-1061", "description": "HTML5 Video Player <2.5.25 unauthenticated SQL injection via id parameter in REST API get_view endpoint", "mode": "block", "severity": 9.8, "slug": "html5-video-player", "target": "plugin", "versions": "<2.5.25"}, "RULE-CVE-2024-10687-01": {"ajax_action": "post_cg_get_raw_data_from_galleries", "conditions": [{"name": "ARGS:collectedIds", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-10687", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "target": "plugin", "versions": "<=24.0.3"}, "RULE-CVE-2024-1070-01": {"ajax_action": "so_widgets_setting_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|body|input|details|marquee)[\\\\s>])~i"}], "cve": "CVE-2024-1070", "description": "SiteOrigin Widgets Bundle <=1.58.2 contributor+ stored XSS via Features widget instance fields on so_widgets_setting_save", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.2"}, "RULE-CVE-2024-1070-02": {"ajax_action": "so_widgets_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mouseenter|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|body|input|details|marquee)[\\\\s>])~i"}], "cve": "CVE-2024-1070", "description": "SiteOrigin Widgets Bundle <=1.58.2 contributor+ stored XSS via Features widget rendered through so_widgets_preview AJAX", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.2"}, "RULE-CVE-2024-1071-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:sorting", "type": "detectSQLi"}], "cve": "CVE-2024-1071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1071", "description": "Ultimate Member >=2.1.3 <=2.8.2 unauthenticated SQL injection via sorting parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": ">=2.1.3 <=2.8.2"}, "RULE-CVE-2024-10711-02": {"action": "admin_post_itwr_activation_plugin", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "itwr_activation_plugin"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2024-10711", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ithemelandco-woo-report", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2024-10715-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:mappress/map[\\\\s\\\\S]{0,4000}?(?:<script[\\\\s/>]|on(?:load|error|click|mouseover|focus|mouseenter|mouseout|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-10715", "description": "MapPress Maps for WordPress <=2.94.1 contributor+ stored XSS via mappress/map Gutenberg block attributes (REST posts endpoint)", "mode": "block", "severity": 5.4, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.94.1"}, "RULE-CVE-2024-10715-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:mappress/map[\\\\s\\\\S]{0,4000}?(?:<script[\\\\s/>]|on(?:load|error|click|mouseover|focus|mouseenter|mouseout|submit|change|input|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-10715", "description": "MapPress Maps for WordPress <=2.94.1 contributor+ stored XSS via mappress/map Gutenberg block attributes (classic post.php editor submit)", "mode": "block", "severity": 5.4, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.94.1"}, "RULE-CVE-2024-1072-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seedprod_lite_template"}, {"name": "ARGS:id", "type": "equals", "value": "0"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-1072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1072", "description": "SeedProd (Coming Soon) <=6.15.21 missing authorization on seedprod_lite_new_lpage via admin_init", "mode": "block", "severity": 8.2, "slug": "coming-soon", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.15.21"}, "RULE-CVE-2024-10728-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "install_required_plugin"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-10728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10728", "description": "PostX \\u2013 Post Grid Gutenberg Blocks <=4.1.16 missing authorization on install_required_plugin AJAX action allows Subscriber+ arbitrary plugin installation/activation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-post", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2024-10871-01A": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10871-01B": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~(?i)^(?:php|data|zip|phar)://~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10871-01C": {"ajax_action": "get_filter_posts", "conditions": [{"name": "ARGS:params[caf-post-layout]", "type": "regex", "value": "~^(?:/|[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2024-10871", "method": "POST", "mode": "block", "severity": 9.8, "slug": "category-ajax-filter", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-10873-01": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-10873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-10873-02": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2024-10873", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-10899-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~\\\\[/?[a-zA-Z]~"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated arbitrary shortcode execution via id parameter in wcpt_ajax handler", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["code-injection", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-01B": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "wcpt_ajax"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\[/?[a-zA-Z]~"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated arbitrary shortcode execution via id parameter in wc-ajax wcpt_ajax endpoint", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["code-injection", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-02": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[<\\"\']|\\\\b(?:on(?:error|load|click|mouseover|focus)|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated reflected XSS via id parameter in wcpt_ajax handler", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10899-02B": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "wcpt_ajax"}, {"name": "ARGS:id", "type": "regex", "value": "~[<\\"\']|\\\\b(?:on(?:error|load|click|mouseover|focus)|javascript\\\\s*:)~i"}], "cve": "CVE-2024-10899", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10899", "description": "WC Product Table Lite <=3.8.6 unauthenticated reflected XSS via id parameter in wc-ajax wcpt_ajax endpoint", "mode": "block", "severity": 7.3, "slug": "wc-product-table-lite", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.8.6"}, "RULE-CVE-2024-10913-01": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 unauthenticated PHP Object Injection - capability gate on search-n-replace AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "missing-authorization", "deserialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-02": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 PHP Object Injection via serialized payload in search parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "deserialization", "php-serialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-03": {"ajax_action": "wpclone-search-n-replace", "conditions": [{"name": "ARGS:replace", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 PHP Object Injection via serialized payload in replace parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "deserialization", "php-serialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10913-04": {"ajax_action": "wpclone-install_new", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-10913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10913", "description": "Clone (WP Clone) <=2.4.6 unauthenticated PHP Object Injection - capability gate on install_new AJAX action (indirect vector via backup restore)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-clone-by-wp-academy", "tags": ["object-injection", "missing-authorization", "deserialization"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2024-10924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/reallysimplessl/v1/two_fa/skip_onboarding(?:/|\\\\?|$)~"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-10924", "description": "Really Simple Security >=9.0.0 <=9.1.1.1 unauthenticated authentication bypass via two-factor REST API skip_onboarding endpoint", "mode": "block", "severity": 9.8, "slug": "really-simple-ssl", "target": "plugin", "versions": ">=9.0.0 <=9.1.1.1"}, "RULE-CVE-2024-10932-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~O:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{|s:[0-9]+:\\"O:[0-9]+:\\\\\\\\\\"[^\\"]+\\\\\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-10932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10932", "description": "Backup Migration <=1.4.6 PHP object injection payload planting via comment content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "backup-backup", "tags": ["object-injection", "deserialization", "comments", "unauthenticated"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2024-10932-02": {"ajax_action": "backup_migration", "conditions": [{"name": "ARGS:f", "type": "equals", "value": "startLocalStagingCreation"}, {"name": "ARGS", "type": "regex", "value": "~O:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{|s:[0-9]+:\\"O:[0-9]+:\\\\\\\\\\"[^\\"]+\\\\\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-10932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10932", "description": "Backup Migration <=1.4.6 PHP object injection via backup_migration staging request payloads", "method": "POST", "mode": "block", "severity": 8.8, "slug": "backup-backup", "tags": ["object-injection", "deserialization", "ajax", "staging"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2024-10936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:O|C):\\\\d+:\\\\\\"~"}], "cve": "CVE-2024-10936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-10936", "description": "String Locator <=2.6.6 unauthenticated PHP Object Injection via comment content planting", "method": "POST", "mode": "block", "severity": 8.8, "slug": "string-locator", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=2.6.6"}, "RULE-CVE-2024-10942-01": {"ajax_action": "ai1wm_import", "conditions": [{"name": "FILES:import:content", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2024-10942", "description": "All in One WP Migration <=7.89 unauthenticated PHP object injection via backup file import", "mode": "block", "severity": 7.5, "slug": "all-in-one-wp-migration", "target": "plugin", "versions": "<=7.89"}, "RULE-CVE-2024-10960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^brizy[-_]upload[-_]blocks$~i"}, {"name": "FILES:files", "type": "exists"}], "cve": "CVE-2024-10960", "method": "POST", "mode": "block", "severity": 8.8, "slug": "brizy", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-10960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^brizy[-_]upload[-_]layouts$~i"}, {"name": "FILES:files", "type": "exists"}], "cve": "CVE-2024-10960", "method": "POST", "mode": "block", "severity": 8.8, "slug": "brizy", "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-11052-02": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:calculations", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|body|input|object|embed)\\\\b)~i"}], "cve": "CVE-2024-11052", "description": "Ninja Forms <=3.8.19 stored XSS via calculations parameter on nf_ajax_submit unauthenticated handler", "mode": "block", "severity": 6.1, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.8.19"}, "RULE-CVE-2024-11103-01": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "ARGS:pass1", "type": "exists"}], "cve": "CVE-2024-11103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11103", "description": "Contest Gallery <=24.0.7 unauthenticated arbitrary password reset via post_cg_login AJAX handler (user_id + pass1)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "account-takeover", "unauthenticated"], "target": "plugin", "versions": "<=24.0.7"}, "RULE-CVE-2024-11103-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordSiteUrl", "type": "exists"}], "cve": "CVE-2024-11103", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11103", "description": "Contest Gallery <=24.0.7 unauthenticated URL injection in password reset email via cgLostPasswordSiteUrl", "method": "POST", "mode": "block", "severity": 9.8, "slug": "contest-gallery", "tags": ["phishing", "url-injection", "unauthenticated", "weak-password-recovery"], "target": "plugin", "versions": "<=24.0.7"}, "RULE-CVE-2024-11180-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~ekit_countdown_timer_title[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/][^>]*on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11180", "description": "ElementsKit Elementor Addons <=3.4.7 Stored XSS via Countdown Timer ekit_countdown_timer_title (Elementor AJAX save)", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2024-11180-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~ekit_countdown_timer_title[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/][^>]*on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11180", "description": "ElementsKit Elementor Addons <=3.4.7 Stored XSS via Countdown Timer ekit_countdown_timer_title (Elementor REST save)", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2024-11188-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "frm_forms_preview"}, {"name": "ARGS:frm_action", "type": "equals", "value": "preview"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]~i"}], "cve": "CVE-2024-11188", "description": "Formidable Forms <=6.16.1.2 stored XSS via form item parameters in preview", "method": "POST", "mode": "block", "severity": 6.5, "slug": "formidable", "tags": ["xss", "stored-xss", "form-builder"], "target": "plugin", "versions": "<=6.16.1.2"}, "RULE-CVE-2024-11270-01": {"ajax_action": "sync-import-imgs", "conditions": [{"type": "missing_capability", "value": "_wswebinar_createwebinars"}], "cve": "CVE-2024-11270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11270", "description": "WebinarPress <=1.33.24 missing authorization on sync-import-imgs AJAX allowing subscriber+ arbitrary file creation (RCE)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-webinarsystem", "tags": ["missing-authorization", "arbitrary-file-upload", "remote-code-execution"], "target": "plugin", "versions": "<=1.33.24"}, "RULE-CVE-2024-11270-02": {"ajax_action": "sync-import-imgs", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2024-11270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11270", "description": "WebinarPress <=1.33.24 arbitrary file upload via sync-import-imgs with executable file extension", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-webinarsystem", "tags": ["arbitrary-file-upload", "remote-code-execution", "file-extension-bypass"], "target": "plugin", "versions": "<=1.33.24"}, "RULE-CVE-2024-11323-01": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:colors", "type": "exists"}, {"name": "ARGS:colors", "type": "regex", "value": "~[\\"\'](?:default_role|users_can_register|siteurl|home|admin_email|blogname|blogdescription|template|stylesheet|active_plugins|permalink_structure|mailserver_url|hack_file|db_version)[\\"\']\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated arbitrary options update via ai_quiz_update_style AJAX handler - dangerous option names in colors JSON", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11323-02": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:colors", "type": "regex", "value": "~<\\\\s*/\\\\s*style|<\\\\s*script|on(?:error|load|click|mouseover)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated stored XSS via ai_quiz_update_style colors parameter - style tag breakout", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "stored-xss"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11323-03": {"ajax_action": "ai_quiz_update_style", "conditions": [{"name": "ARGS:phrase", "type": "regex", "value": "~<\\\\s*/\\\\s*style|<\\\\s*script|on(?:error|load|click|mouseover)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11323", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11323", "description": "AI Quiz <=1.1 authenticated stored XSS via ai_quiz_update_style phrase parameter - style tag breakout", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-quiz", "tags": ["missing-authorization", "stored-xss"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2024-11415-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-orphanage-extended"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wporphanageex_role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2024-11415", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11415", "description": "WP-Orphanage Extended <=1.2 CSRF to orphan account privilege escalation via settings page role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-orphanage-extended", "tags": ["csrf", "privilege-escalation", "settings-update"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2024-11429-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stars[_-]testimonials(?:-with-slider-and-masonry-grid)?|testimonial[_-]stars)[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|phar://|data://)~i"}], "cve": "CVE-2024-11429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11429", "description": "Stars Testimonials <=3.3.3 Local File Inclusion via shortcode attribute in post_content (post.php)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "stars-testimonials-with-slider-and-masonry-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-11429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:stars[_-]testimonials(?:-with-slider-and-masonry-grid)?|testimonial[_-]stars)[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|phar://|data://)~i"}], "cve": "CVE-2024-11429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11429", "description": "Stars Testimonials <=3.3.3 Local File Inclusion via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "stars-testimonials-with-slider-and-masonry-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-11582-01": {"ajax_action": "subscribe2_submit", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|input|video|audio|source|link|style|meta|form|button|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|focusin|focusout|blur|change|submit|input|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|wheel|keydown|keyup|keypress|drag|drop|dragstart|dragend|dragover|copy|paste|cut)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z/+0-9-]*(?:base64|;)|expression\\\\s*\\\\(|%3[Cc](?:script|svg|img|iframe|body)|&#0*60;?(?:script|svg|img|iframe))~i"}], "cve": "CVE-2024-11582", "description": "Subscribe2 <=10.43 unauthenticated stored XSS via ip parameter on subscribe2_submit AJAX action", "mode": "block", "severity": 7.2, "slug": "subscribe2", "target": "plugin", "versions": "<=10.43"}, "RULE-CVE-2024-11582-02": {"ajax_action": "subscribe2_form", "conditions": [{"name": "ARGS:ip", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|body|object|embed|input|video|audio|source|link|style|meta|form|button|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|focusin|focusout|blur|change|submit|input|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|wheel|keydown|keyup|keypress|drag|drop|dragstart|dragend|dragover|copy|paste|cut)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z/+0-9-]*(?:base64|;)|expression\\\\s*\\\\(|%3[Cc](?:script|svg|img|iframe|body)|&#0*60;?(?:script|svg|img|iframe))~i"}], "cve": "CVE-2024-11582", "description": "Subscribe2 <=10.43 unauthenticated stored XSS via ip parameter on subscribe2_form AJAX action", "mode": "block", "severity": 7.2, "slug": "subscribe2", "target": "plugin", "versions": "<=10.43"}, "RULE-CVE-2024-11642-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[grid_style]", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]{1,}){2,}~"}], "cve": "CVE-2024-11642", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ajax-filter-posts", "target": "plugin", "versions": "<=3.4.11"}, "RULE-CVE-2024-11642-02": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[filter_style]", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]{1,}){2,}~"}], "cve": "CVE-2024-11642", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ajax-filter-posts", "target": "plugin", "versions": "<=3.4.11"}, "RULE-CVE-2024-11643-01": {"ajax_action": "AllAccessible_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11643", "method": "POST", "mode": "block", "severity": 8.8, "slug": "allaccessible", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2024-1166-01": {"ajax_action": "eihe_top_notice", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2024-1166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1166", "description": "Image Hover Effects Addon for Elementor <=1.4.1 missing authorization on eihe_top_notice AJAX handler", "mode": "block", "severity": 6.4, "slug": "image-hover-effects-addon-for-elementor", "tags": ["missing-authorization", "csrf"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-11689-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - users_can_register escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - default_role escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:siteurl", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - siteurl hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:home", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - home URL hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:admin_email", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - admin_email hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "account-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:blogdescription", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - blogdescription defacement", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-defacement"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:permalink_structure", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - permalink_structure manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-defacement"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:template", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - template/theme hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:stylesheet", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - stylesheet/theme hijack", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-11689-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hq-rental-software"}, {"name": "ARGS:active_plugins", "type": "exists"}], "cve": "CVE-2024-11689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11689", "description": "HQ Rental Software <=1.5.29 CSRF to arbitrary options update - active_plugins manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hq-rental-software", "tags": ["csrf", "arbitrary-options-update", "site-takeover"], "target": "plugin", "versions": "<=1.5.29"}, "RULE-CVE-2024-1171-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eael-filterable-gallery[\\\\s\\\\S]*?(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-1171", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.8"}, "RULE-CVE-2024-1172-01": {"ajax_action": "eael_save_elements", "conditions": [{"name": "ARGS:eael_adv_accordion_tab_title_icon", "type": "regex", "value": "~(?i)(?:<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*iframe\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~"}], "cve": "CVE-2024-1172", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.8"}, "RULE-CVE-2024-1172-02": {"ajax_action": "eael_save_elements", "conditions": [{"name": "ARGS:eael_adv_accordion_tab_title_icon_opened", "type": "regex", "value": "~(?i)(?:<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*iframe\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~"}], "cve": "CVE-2024-1172", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.8"}, "RULE-CVE-2024-1172-03": {"ajax_action": "eael_save_elements", "conditions": [{"name": "ARGS:eael_adv_accordion_tab_id", "type": "regex", "value": "~(?i)(?:<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*iframe\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~"}], "cve": "CVE-2024-1172", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.8"}, "RULE-CVE-2024-11725-01": {"action": "admin_post_wc_warranty_settings_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11725", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sms-alert", "target": "plugin", "versions": "<=3.7.6"}, "RULE-CVE-2024-11731-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ms_slider\\\\b[^\\\\]]*(?:on(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|leave|move)|key(?:up|down|press)|change|submit|input)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|&#(?:0*(?:10[69]|74|[xX]0*(?:6[Aa9]|4[1a]))|x0*(?:6[Aa]|4[1Aa]));)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-11731", "description": "Master Slider <=3.10.7 stored XSS via ms_slider shortcode class/css_class attributes", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.7"}, "RULE-CVE-2024-11816-01": {"ajax_action": "handle_snippet_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:snippet_id", "type": "exists"}, {"name": "ARGS:snippet_code", "type": "exists"}], "cve": "CVE-2024-11816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11816", "description": "WP Extended <=3.0.11 authenticated RCE via missing authorization on handle_snippet_update AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpextended", "tags": ["missing-authorization", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.0.11"}, "RULE-CVE-2024-11848-01": {"ajax_action": "nitropack_dismiss_notice_forever", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11848", "mode": "block", "severity": 8.1, "slug": "nitropack", "target": "plugin", "versions": "<=1.17.0"}, "RULE-CVE-2024-11868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/material/\\\\d+(?:[/?&]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-11868", "method": "GET", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.3"}, "RULE-CVE-2024-11921-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:donor", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-donors~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-payment-history~"}, {"name": "ARGS:donor", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-reports~"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-12": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=give-tools~"}, {"name": "ARGS:per_page", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-13": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:start-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11921-14": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]post_type=give_forms~"}, {"name": "ARGS:end-date", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-11921", "method": "GET", "mode": "block", "severity": 4.8, "slug": "give", "target": "plugin", "versions": "<3.19.0"}, "RULE-CVE-2024-11974-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:smc_settings_tab", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via smc_settings_tab parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-11974-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:unattachfixit-action", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via unattachfixit-action parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-11974-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|\\\\?|&)page=mla-menu(?:&|$)~"}, {"name": "ARGS:woofixit-action", "type": "regex", "value": "~(?:on(?:click|load|error|mouse(?:over|out|down|up)|focus|blur|change|submit|reset|select|key(?:down|up|press))\\\\s*=|<(?:script|iframe|object|embed|applet|svg|math|link|base|meta|style)|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2024-11974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-11974", "description": "Media Library Assistant <=3.23 reflected XSS via woofixit-action parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "media-library-assistant", "tags": ["xss", "reflected", "admin"], "target": "plugin", "versions": "<=3.23"}, "RULE-CVE-2024-1203-01": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:valueData", "type": "regex", "value": "~(?:\'\\\\s*(?:OR|AND)\\\\b|\\\\b(?:OR|AND)\\\\s+\\\\d+=\\\\d+|UNION\\\\s+SELECT|SELECT\\\\s+.+\\\\s+FROM|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|--\\\\s*$|/\\\\*|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via valueData in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-02": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:conditionData", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via conditionData in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-03": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:productArray", "type": "detectSQLi"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+SELECT|SELECT\\\\s+.+\\\\s+FROM|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|OR\\\\s+\\\\d+=\\\\d+|AND\\\\s+\\\\d+=\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+\'|--\\\\s*$|;\\\\s*(?:DROP|ALTER|INSERT|UPDATE|DELETE))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via productArray in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-04": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:exclude", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via exclude in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-1203-05": {"ajax_action": "ee_syncProductCategory", "conditions": [{"name": "ARGS:include", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1203", "description": "Conversios Google Analytics 4 for WooCommerce <=7.0.7 authenticated SQL injection via include in ee_syncProductCategory AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "enhanced-e-commerce-for-woocommerce-store", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2024-12040-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\.\\\\\\\\)[^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) Local File Inclusion via [wcpcsu] shortcode theme attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?(?:php|data|expect|zip|phar)://~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) Local File Inclusion via [wcpcsu] shortcode theme attribute with PHP wrapper in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\.\\\\\\\\)[^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) LFI via REST API post content with [wcpcsu] shortcode theme traversal", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-12040-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wcpcsu\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\']?(?:php|data|expect|zip|phar)://~i"}], "cve": "CVE-2024-12040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12040", "description": "Product Carousel Slider & Grid Ultimate for WooCommerce <=1.9.10 authenticated (Contributor+) LFI via REST API post content with [wcpcsu] shortcode theme PHP wrapper", "method": "POST", "mode": "block", "severity": 8.8, "slug": "woo-product-carousel-slider-and-grid-ultimate", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.10"}, "RULE-CVE-2024-1206-01": {"ajax_action": "wprm_import_recipes", "conditions": [{"name": "ARGS:recipes", "type": "regex", "value": "~[^0-9,\\\\s]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1206", "description": "WP Recipe Maker <=9.1.2 authenticated SQL injection via recipes parameter (scalar) in wprm_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-recipe-maker", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2024-1206-02": {"ajax_action": "wprm_import_recipes", "conditions": [{"name": "ARGS:recipes[0]", "type": "regex", "value": "~[^0-9,\\\\s]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1206", "description": "WP Recipe Maker <=9.1.2 authenticated SQL injection via recipes[] array element in wprm_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-recipe-maker", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2024-1207-01": {"ajax_action": "WPBC_AJX_CALENDAR_LOAD", "conditions": [{"name": "ARGS:calendar_request_params[dates_ddmmyy_csv]", "type": "regex", "value": "~[^0-9.,\\\\-\\\\s;]~"}], "cve": "CVE-2024-1207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1207", "description": "WP Booking Calendar <=9.9 unauthenticated SQL injection via calendar_request_params[dates_ddmmyy_csv] in WPBC_AJX_CALENDAR_LOAD", "method": "POST", "mode": "block", "severity": 9.8, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=9.9"}, "RULE-CVE-2024-1207-02": {"ajax_action": "WPBC_AJX_BOOKING__CREATE", "conditions": [{"name": "ARGS:calendar_request_params[dates_ddmmyy_csv]", "type": "regex", "value": "~[^0-9.,\\\\-\\\\s;]~"}], "cve": "CVE-2024-1207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1207", "description": "WP Booking Calendar <=9.9 unauthenticated SQL injection via calendar_request_params[dates_ddmmyy_csv] in WPBC_AJX_BOOKING__CREATE", "method": "POST", "mode": "block", "severity": 9.8, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=9.9"}, "RULE-CVE-2024-12171-01": {"ajax_action": "eh_crm_agent_add_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12171", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2024-12238-01": {"ajax_action": "nf_preview_update", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-12238", "description": "Ninja Forms <=3.8.22 authenticated (subscriber+) arbitrary shortcode execution via nf_preview_update AJAX action (do_shortcode on attacker-controlled preview content in includes/Display/Preview.php)", "mode": "block", "severity": 6.3, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.8.22"}, "RULE-CVE-2024-12259-01": {"ajax_action": "wc_update_user_data", "conditions": [{"name": "ARGS:update_user", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12259", "method": "POST", "mode": "block", "severity": 8.8, "slug": "computer-repair-shop", "target": "plugin", "versions": "<=3.8120"}, "RULE-CVE-2024-12264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/get-shipping-cost(?:[/?&]|$)~"}, {"name": "ARGS:username", "type": "exists"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/get-shipping-cost(?:[/?&]|$)~"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12264-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/payu/v1/generate-user-token(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12264", "method": "POST", "mode": "block", "severity": 9.8, "slug": "payu-india", "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2024-12304-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/singlebtn[^}]*\\"link\\"\\\\s*:\\\\s*\\"(?:javascript\\\\s*:|[^\\"]*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12304", "description": "Kadence Blocks <=3.4.2 contributor+ stored XSS via singlebtn block link attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-12304-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/singlebtn[^}]*\\"link\\"\\\\s*:\\\\s*\\"(?:javascript\\\\s*:|[^\\"]*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|<\\\\s*script))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-12304", "description": "Kadence Blocks <=3.4.2 contributor+ stored XSS via singlebtn block link attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-12322-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "theperfectweddingnl-widget/tpw.php"}, {"name": "ARGS:tpwKey", "type": "regex", "value": "~(?:<script|<iframe|<svg|javascript:|on(?:error|load|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-12322", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-12322", "description": "ThePerfectWedding.nl Widget <=2.8 CSRF to Stored XSS via tpwKey parameter on settings page", "method": "POST", "mode": "block", "severity": 8.8, "slug": "theperfectweddingnl-widget", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2024-12402-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/tc_user/update_user_profile(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-12402", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tc-ecommerce", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2024-12583-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[msdyncrm_twig\\\\].*(?:\\\\|\\\\s*(?:filter|map|sort|reduce)\\\\s*\\\\(|source\\\\s*\\\\()~si"}], "cve": "CVE-2024-12583", "method": "POST", "mode": "block", "severity": 9.9, "slug": "integration-dynamics", "target": "plugin", "versions": "<=1.3.23"}, "RULE-CVE-2024-12583-02": {"action": "init", "conditions": [{"name": "JSON:content", "type": "regex", "value": "~\\\\[msdyncrm_twig\\\\].*(?:\\\\|\\\\s*(?:filter|map|sort|reduce)\\\\s*\\\\(|source\\\\s*\\\\()~si"}], "cve": "CVE-2024-12583", "method": "POST", "mode": "block", "severity": 9.9, "slug": "integration-dynamics", "target": "plugin", "versions": "<=1.3.23"}, "RULE-CVE-2024-12594-01": {"ajax_action": "lps_generate_temp_access_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12594", "method": "POST", "mode": "block", "severity": 8.8, "slug": "login-page-styler", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-12594-02": {"ajax_action": "lps_revoke_access", "conditions": [{"type": "missing_capability", "value": "administrator"}], "cve": "CVE-2024-12594", "method": "POST", "mode": "block", "severity": 8.8, "slug": "login-page-styler", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-12594-03": {"ajax_action": "lps_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12594", "method": "POST", "mode": "block", "severity": 8.8, "slug": "login-page-styler", "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-12635-01": {"ajax_action": "wpdocs_update_folder", "conditions": [{"name": "ARGS:dir_id", "type": "detectSQLi"}], "cve": "CVE-2024-12635", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-12635-02": {"ajax_action": "wpdocs_delete_folder", "conditions": [{"name": "ARGS:dir_id", "type": "detectSQLi"}], "cve": "CVE-2024-12635", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-12635-03": {"ajax_action": "wpdocs_delete_files", "conditions": [{"name": "ARGS:dir_id", "type": "detectSQLi"}], "cve": "CVE-2024-12635", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2024-12771-01": {"ajax_action": "customer_panel_password_reset", "conditions": [{"name": "ARGS:new_password", "type": "exists"}, {"name": "ARGS:repeat_new_password", "type": "exists"}], "cve": "CVE-2024-12771", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.3.43"}, "RULE-CVE-2024-1278-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[efb_likebox\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousedown|mouseup|keydown|keyup|keypress|submit|change|input)\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b[^>]*on|<\\\\s*img\\\\b[^>]*on|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1278", "description": "Easy Facebook Likebox <=6.5.4 contributor+ stored XSS via efb_likebox shortcode attributes in post content (classic editor save)", "mode": "block", "severity": 5.4, "slug": "easy-facebook-likebox", "target": "plugin", "versions": "<=6.5.4"}, "RULE-CVE-2024-1278-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[efb_likebox\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousedown|mouseup|keydown|keyup|keypress|submit|change|input)\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b[^>]*on|<\\\\s*img\\\\b[^>]*on|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1278", "description": "Easy Facebook Likebox <=6.5.4 contributor+ stored XSS via efb_likebox shortcode attributes in REST post create/update", "mode": "block", "severity": 5.4, "slug": "easy-facebook-likebox", "target": "plugin", "versions": "<=6.5.4"}, "RULE-CVE-2024-12875-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "download"}, {"name": "ARGS:/^edd_download_files$/", "type": "regex", "value": "~(?i)(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|\\\\.\\\\.\\\\.\\\\.//)~i"}], "cve": "CVE-2024-12875", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-12877-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:firstName", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:lastName", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12877-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:gateway", "type": "regex", "value": "~(?:O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{|a:\\\\d+:\\\\{)~i"}], "cve": "CVE-2024-12877", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.2"}, "RULE-CVE-2024-12881-01": {"ajax_action": "eos_plugin_reviews_restore_version", "conditions": [{"name": "ARGS:dir", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-12881", "method": "POST", "mode": "block", "severity": 8.8, "slug": "plugversions", "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2024-1289-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:profile|user-profile)/[^/]+/orders/.*~"}, {"name": "ARGS:view-order", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1289", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.3"}, "RULE-CVE-2024-12919-01": {"action": "init", "conditions": [{"name": "ARGS:pms_payment_id", "type": "regex", "value": "~^0*[1-9][0-9]*$~"}, {"name": "ARGS:pms_autologin_before_redirect", "type": "equals", "value": "true"}], "cve": "CVE-2024-12919", "mode": "block", "severity": 9.8, "slug": "paid-member-subscriptions", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-13127-01": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/lp/v1/settings~i"}], "cve": "CVE-2024-13127", "description": "Broken access control allows non-admin users to modify LearnPress display settings via REST API", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.5"}, "RULE-CVE-2024-13128-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~i"}, {"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:primary_color", "type": "detectXSS"}, {"name": "ARGS:secondary_color", "type": "detectXSS"}, {"name": "ARGS:width_container", "type": "detectXSS"}, {"name": "ARGS:learn_press[primary_color]", "type": "detectXSS"}, {"name": "ARGS:learn_press[secondary_color]", "type": "detectXSS"}, {"name": "ARGS:learn_press[width_container]", "type": "detectXSS"}], "cve": "CVE-2024-13128", "description": "Broken access control allows non-admin users to modify LearnPress color settings via REST API", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.7.5"}, "RULE-CVE-2024-1315-01": {"ajax_action": "rtcl_update_user_account", "conditions": [{"name": "ARGS:email", "type": "exists"}, {"name": "ARGS:pass1", "type": "exists"}], "cve": "CVE-2024-1315", "method": "POST", "mode": "block", "severity": 8.8, "slug": "classified-listing", "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2024-1317-01": {"ajax_action": "feedzy", "conditions": [{"name": "ARGS:search_key", "type": "detectSQLi"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1317", "method": "POST", "mode": "block", "severity": 8.8, "slug": "feedzy-rss-feeds", "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2024-13183-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"title_tag\\"\\\\s*:\\\\s*\\"(?!(?:h[1-6]|p)\\")[^\\"]*(?:[<>\\"=/\\\\s]|on[a-z]+\\\\s*=|javascript\\\\s*:|script|svg|iframe|img|onerror|onload|onmouseover)~i"}], "cve": "CVE-2024-13183", "description": "Orbit Fox by ThemeIsle (themeisle-companion) <=2.10.43 contributor+ stored XSS via Pricing Table widget title_tag parameter", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2024-13183-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"subtitle_tag\\"\\\\s*:\\\\s*\\"(?!(?:h[1-6]|p)\\")[^\\"]*(?:[<>\\"=/\\\\s]|on[a-z]+\\\\s*=|javascript\\\\s*:|script|svg|iframe|img|onerror|onload|onmouseover)~i"}], "cve": "CVE-2024-13183", "description": "Orbit Fox by ThemeIsle (themeisle-companion) <=2.10.43 contributor+ stored XSS via Pricing Table widget subtitle_tag parameter", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2024-13227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/rank-math(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-13227", "mode": "block", "severity": 5.4, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.235"}, "RULE-CVE-2024-13227-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/rank-math(/|\\\\?|$)~"}, {"name": "ARGS:is_new", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-13227", "mode": "block", "severity": 5.4, "slug": "seo-by-rank-math", "target": "plugin", "versions": "<=1.0.235"}, "RULE-CVE-2024-13315-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "shopwarden"}, {"name": "ARGS:action", "type": "equals", "value": "save_setting"}, {"name": "ARGS:key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-13315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13315", "description": "Shopwarden <=1.0.11 CSRF to arbitrary WordPress options update via admin.php page=shopwarden action=save_setting", "mode": "block", "severity": 8.8, "slug": "shopwarden", "tags": ["csrf", "broken-access-control", "options-update", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.11"}, "RULE-CVE-2024-13353-01": {"ajax_action": "rael_products_pagination_product", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_products_pagination_product AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13353-02": {"ajax_action": "rael_woo_product_pagination", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_woo_product_pagination AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13353-03": {"ajax_action": "rael_load_more", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|zip|phar|data|expect|glob)://)~i"}], "cve": "CVE-2024-13353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13353", "description": "Responsive Addons for Elementor <=1.6.4 Local File Inclusion via template parameter in rael_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2024-13362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~freemius-pricing\\\\.js~"}, {"name": "ARGS:url", "type": "regex", "value": "~(<script|javascript:|onerror=|onload=|<img|<svg|<iframe|<object|<embed|\\\\%3Cscript|\\\\%3Cimg|\\\\%3Csvg|\\\\%253Cscript|\\\\%253Cimg|\\\\%25253Cscript|\\\\%25253Cimg)~i"}], "cve": "CVE-2024-13362", "description": "[UNPROTECTABLE] Client-side DOM XSS - WAF cannot block browser JS execution", "mode": "block", "severity": 6.1, "slug": "add-search-to-menu", "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2024-13365-01": {"ajax_action": "spbc_check_file_block", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-13365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13365", "description": "Security & Malware scan by CleanTalk <=2.149 unauthenticated arbitrary file upload via spbc_check_file_block AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "security-malware-firewall", "tags": ["arbitrary-file-upload", "unauthenticated", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=2.149"}, "RULE-CVE-2024-13487-01": {"ajax_action": "wmc_get_products_price", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[[a-zA-Z_][a-zA-Z0-9_\\\\-]*(?:[\\\\s\\\\]\\\\/]|$)~"}], "cve": "CVE-2024-13487", "description": "Woo Multi Currency <=2.2.5 unauthenticated arbitrary shortcode execution via wmc_get_products_price AJAX handler (do_shortcode sink in frontend/cache.php)", "mode": "block", "severity": 7.3, "slug": "woo-multi-currency", "target": "plugin", "versions": "<=2.2.5"}, "RULE-CVE-2024-13496-01": {"ajax_action": "gamipress_get_logs", "conditions": [{"name": "ARGS:orderby", "type": "exists"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN)~i"}], "cve": "CVE-2024-13496", "description": "Blocks unauthenticated SQL injection via the orderby parameter in the gamipress_get_logs AJAX handler (GamiPress <= 7.3.1).", "mode": "block", "severity": 7.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.3.1"}, "RULE-CVE-2024-13508-01": {"action": "init", "conditions": [{"name": "ARGS:locale", "type": "detectXSS"}], "cve": "CVE-2024-13508", "method": "GET", "mode": "block", "severity": 6.1, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.72"}, "RULE-CVE-2024-13508-02": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:locale", "type": "detectXSS"}], "cve": "CVE-2024-13508", "method": "POST", "mode": "block", "severity": 6.1, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.72"}, "RULE-CVE-2024-13508-03": {"ajax_action": "package_app_action", "conditions": [{"name": "ARGS:locale", "type": "detectXSS"}], "cve": "CVE-2024-13508", "method": "POST", "mode": "block", "severity": 6.1, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.72"}, "RULE-CVE-2024-13517-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "download"}, {"name": "ARGS:post_title", "type": "detectXSS"}], "cve": "CVE-2024-13517", "method": "POST", "mode": "block", "severity": 4.0, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-13517-02": {"ajax_action": "inline-save", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_type", "type": "equals", "value": "download"}, {"name": "ARGS:post_title", "type": "detectXSS"}], "cve": "CVE-2024-13517", "method": "POST", "mode": "block", "severity": 4.0, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-13714-01": {"ajax_action": "select_image_for_library", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[?#]|$)|[\\\\\\\\/]\\\\.htaccess(?:[?#]|$)|[\\\\\\\\/]\\\\.htpasswd(?:[?#]|$)~i"}], "cve": "CVE-2024-13714", "method": "POST", "mode": "block", "severity": 8.8, "slug": "all-images-ai", "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2024-13714-02": {"ajax_action": "select_image_for_post", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[?#]|$)|[\\\\\\\\/]\\\\.htaccess(?:[?#]|$)|[\\\\\\\\/]\\\\.htpasswd(?:[?#]|$)~i"}], "cve": "CVE-2024-13714", "method": "POST", "mode": "block", "severity": 8.8, "slug": "all-images-ai", "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2024-13742-01": {"action": "init", "conditions": [{"name": "ARGS:reqpars", "type": "regex", "value": "~(?:Tzo|Qzo|VHp|UXp)[A-Za-z0-9+/_-]~"}], "cve": "CVE-2024-13742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13742", "description": "iControlWP <=4.4.5 unauthenticated PHP Object Injection via reqpars parameter deserialization", "mode": "block", "severity": 9.8, "slug": "worpit-admin-dashboard-plugin", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=4.4.5"}, "RULE-CVE-2024-13757-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ms_layer\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<[^>]+on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-13757", "description": "Master Slider <=3.10.6 stored XSS via ms_layer shortcode effect attribute in post content", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.6"}, "RULE-CVE-2024-13789-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/__ravpage/api([#?]|$)~"}, {"name": "ARGS:paramsv2", "type": "regex", "value": "~(?:Tzo|Qzo)~"}], "cve": "CVE-2024-13789", "mode": "block", "severity": 9.8, "slug": "ravpage", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2024-13803-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/[a-z-]+[^}]*[\\"\']dataMarker[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|</[a-z]+>\\\\s*<script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-13803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13803", "description": "Essential Blocks <=5.2.3 authenticated (Contributor+) stored XSS via data-marker block attribute in REST API post save", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-13803-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~essential-blocks/[a-z-]+[^}]*[\\"\']dataMarker[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|</[a-z]+>\\\\s*<script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-13803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13803", "description": "Essential Blocks <=5.2.3 authenticated (Contributor+) stored XSS via data-marker block attribute in classic editor post save", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-1382-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~nd_rst_layout\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|data://|phar://|expect://)~i"}], "cve": "CVE-2024-1382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1382", "description": "Restaurant Reservations <=1.9 Local File Inclusion via nd_rst_layout shortcode attribute in post_content (post.php save)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nd-restaurant-reservations", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.9"}, "RULE-CVE-2024-1382-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~nd_rst_layout\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|data://|phar://|expect://)~i"}], "cve": "CVE-2024-1382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1382", "description": "Restaurant Reservations <=1.9 Local File Inclusion via nd_rst_layout shortcode attribute in content (REST API post creation)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nd-restaurant-reservations", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9"}, "RULE-CVE-2024-13869-01": {"ajax_action": "wpvivid_upload_files", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|shtml|cgi)(?:\\\\.|$)~i"}], "cve": "CVE-2024-13869", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.112"}, "RULE-CVE-2024-13913-01": {"action": "init", "conditions": [{"name": "ARGS:instawp_database_manager", "type": "exists"}, {"name": "ARGS:instawp_database_manager", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2024-13913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13913", "description": "InstaWP Connect <=0.1.0.83 CSRF to Local File Inclusion via instawp_database_manager query var - path traversal and sensitive file detection", "method": "GET", "mode": "block", "severity": 8.8, "slug": "instawp-connect", "tags": ["local-file-inclusion", "path-traversal", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=0.1.0.83"}, "RULE-CVE-2024-13913-02": {"action": "init", "conditions": [{"name": "ARGS:instawp_database_manager", "type": "exists"}, {"name": "ARGS:instawp_database_manager", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|ps|tml?|t|ar))(?:\\\\?|$|%00)~i"}], "cve": "CVE-2024-13913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13913", "description": "InstaWP Connect <=0.1.0.83 CSRF to Local PHP File Inclusion via instawp_database_manager query var - PHP file extension detection", "method": "GET", "mode": "block", "severity": 8.8, "slug": "instawp-connect", "tags": ["local-file-inclusion", "csrf", "unauthenticated", "php-inclusion"], "target": "plugin", "versions": "<=0.1.0.83"}, "RULE-CVE-2024-13913-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php(?:\\\\?|$)~i"}, {"name": "ARGS:action", "type": "equals", "value": "instawp-database-manager-auto-login"}, {"name": "ARGS:auth_key", "type": "exists"}], "cve": "CVE-2024-13913", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-13913", "description": "InstaWP Connect <=0.1.0.83 CSRF on unauthenticated auto-login endpoint removed in fix", "method": "POST", "mode": "block", "severity": 8.8, "slug": "instawp-connect", "tags": ["csrf", "unauthenticated", "auto-login-abuse"], "target": "plugin", "versions": "<=0.1.0.83"}, "RULE-CVE-2024-1409-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[reg-select-role[^\\\\]]*default_role\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1409", "description": "ProfilePress <=4.15.0 contributor+ stored XSS via [reg-select-role] shortcode default_role attribute", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.0"}, "RULE-CVE-2024-1424-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1424-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[give_(form|donor_wall|donor_dashboard|goal|form_grid)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2024-1424", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2024-1463-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "accept-request"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-1463", "method": "GET", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.6.4"}, "RULE-CVE-2024-1463-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "deny-request"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2024-1463", "method": "GET", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.6.4"}, "RULE-CVE-2024-1497-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~addr2_width[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1497", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via addr2_width widget attribute in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~addr2_width[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1497", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via addr2_width widget attribute in Elementor REST API save", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1499-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~title_tags[^}]*(?:on(?:mouse(?:over|enter|move|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run|start)|change|input|submit|resize|scroll|contextmenu|pointerdown|pointermove|pointerup|pointerenter|pointerleave|touchstart|touchmove|touchend|wheel|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste)\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|form|base|link|meta|style)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1499", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via Pricing Table widget title_tags parameter", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1499-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document(/|\\\\?|$)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~title_tags[^}]*(?:on(?:mouse(?:over|enter|move|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run|start)|change|input|submit|resize|scroll|contextmenu|pointerdown|pointermove|pointerup|pointerenter|pointerleave|touchstart|touchmove|touchend|wheel|drag(?:start|end|over|enter|leave)?|drop|copy|cut|paste)\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|form|base|link|meta|style)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1499", "description": "Orbit Fox by ThemeIsle <=2.10.30 contributor+ stored XSS via Pricing Table widget title_tags parameter (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "target": "plugin", "versions": "<=2.10.30"}, "RULE-CVE-2024-1510-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_tooltip\\\\b[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1510", "description": "Shortcodes Ultimate <=7.0.2 contributor+ stored XSS via su_tooltip shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.2"}, "RULE-CVE-2024-1510-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_tooltip\\\\b[^\\\\]]*tag\\\\s*=\\\\s*[\\"\']?(?:script|img|iframe|svg|object|embed|details|body|marquee|video|audio|math)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1510", "description": "Shortcodes Ultimate <=7.0.2 contributor+ stored XSS via su_tooltip tag attribute injection in post content", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.2"}, "RULE-CVE-2024-1512-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user", "type": "detectSQLi"}], "cve": "CVE-2024-1512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1512", "description": "MasterStudy LMS <=3.2.5 unauthenticated SQL injection via user parameter in /stm-lms/order/items REST endpoint", "method": "GET", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2024-1535-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[profilepress-(?:registration|edit-profile|login|user-profile|melange|member-directory|my-account)\\\\b[^\\\\]]*(?:on(?:focus|blur|click|error|load|mouseover|animationstart|animationend|transitionend|pointerover)\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1535", "description": "ProfilePress <=4.15.2 contributor+ stored XSS via shortcode attribute injection in REST API post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.2"}, "RULE-CVE-2024-1536-01A": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\\\"widgetType\\\\\\"\\\\s*:\\\\s*\\\\\\"eael-event-calendar\\\\\\"~"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\\\\\"eael_event_(?:calendar_first_day|details_link_hide)\\\\\\"\\\\s*:\\\\s*\\\\\\"\\\\\\\\\\\\\\"\\\\s+on[a-z]+\\\\s*=~"}], "cve": "CVE-2024-1536", "method": "POST", "mode": "block", "severity": 7.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1536-01B": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\\\\\"widgetType\\\\\\"\\\\s*:\\\\s*\\\\\\"eael-event-calendar\\\\\\"~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\\\\\"eael_event_(?:calendar_first_day|details_link_hide)\\\\\\"\\\\s*:\\\\s*\\\\\\"\\\\\\\\\\\\\\"\\\\s+on[a-z]+\\\\s*=~"}], "cve": "CVE-2024-1536", "method": "POST", "mode": "block", "severity": 7.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1537-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2024-1537", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2024-1570-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*login-password\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*(?:(?:&quot;|%22|\\")\\\\s*(?:on[a-z]+|style|formaction)\\\\s*=|javascript\\\\s*:|<script|<svg\\\\b|<img\\\\s)|\'[^\']*(?:(?:&#0*39;|%27|\')\\\\s*(?:on[a-z]+|style|formaction)\\\\s*=|javascript\\\\s*:|<script|<svg\\\\b|<img\\\\s))~i"}], "cve": "CVE-2024-1570", "description": "ProfilePress (wp-user-avatar) <=4.14.4 contributor+ stored XSS via [login-password] shortcode title attribute breakout in post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.14.4"}, "RULE-CVE-2024-1582-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpgmza\\\\b[^\\\\]]*?(?:<script[\\\\s/>]|on(?:load|error|click|mouseover|focus|blur|input|submit|change|toggle|animationend)\\\\s*=|javascript\\\\s*:|srcdoc\\\\s*=|formaction\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-1582", "description": "WP Go Maps (formerly WP Google Maps) <=9.0.32 contributor+ stored XSS via wpgmza shortcode attributes in post content", "mode": "block", "severity": 5.4, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.32"}, "RULE-CVE-2024-1685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_button"}, {"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in save_button handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-02": {"ajax_action": "import_buttons", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in import_buttons AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "export_button"}, {"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in export_button handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1685-04": {"ajax_action": "clone_button", "conditions": [{"name": "ARGS:attachmentUrl", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2024-1685", "description": "Social Media Share Buttons <=2.1.0 authenticated PHP Object Injection via attachmentUrl in clone_button AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-media-builder", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-1698-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics(?:/|\\\\?|&|$)~"}, {"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2024-1698", "mode": "block", "severity": 9.8, "slug": "notificationx", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2024-1710-01": {"ajax_action": "unitecreator_ajax_action", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^unitecreator_ajax_action$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1710", "description": "Addon Library <=1.3.76 missing authorization on AJAX handler allows subscriber+ arbitrary actions including file upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "addon-library", "tags": ["missing-authorization", "arbitrary-file-upload", "broken-access-control"], "target": "plugin", "versions": "<=1.3.76"}, "RULE-CVE-2024-1723-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:widget-sow-headline[instance][headline_tag]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1723", "description": "SiteOrigin Widgets Bundle <=1.58.7 contributor+ stored XSS via headline widget tag fields (headline_tag, sub_headline_tag, title_options tag)", "mode": "block", "severity": 6.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.7"}, "RULE-CVE-2024-1723-02": {"ajax_action": "so_widgets_links_get_title", "conditions": [{"name": "ARGS:postId", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\s|<svg[\\\\s/>]|[\\"\']>)~i"}], "cve": "CVE-2024-1723", "description": "SiteOrigin Widgets Bundle <=1.58.7 authenticated reflected XSS via postId in so_widgets_links_get_title", "mode": "block", "severity": 6.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.58.7"}, "RULE-CVE-2024-1751-01": {"ajax_action": "tutor_qna_single_action", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tutor_qna_single_action"}, {"name": "ARGS:question_id", "type": "detectSQLi"}], "cve": "CVE-2024-1751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1751", "description": "Tutor LMS <=2.6.1 authenticated SQL injection via question_id in tutor_qna_single_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-1751-02": {"ajax_action": "tutor_q_and_a_load_more", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tutor_q_and_a_load_more"}, {"name": "ARGS:question_id", "type": "detectSQLi"}], "cve": "CVE-2024-1751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1751", "description": "Tutor LMS <=2.6.1 authenticated SQL injection via question_id in tutor_q_and_a_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-1755-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nps-plugin-options"}, {"name": "ARGS:event", "type": "equals", "value": "delete_all"}], "cve": "CVE-2024-1755", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nps-computy", "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2024-1755-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nps-plugin-options"}, {"name": "ARGS:event", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "regex", "value": "~^[0-9]+$~i"}], "cve": "CVE-2024-1755", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nps-computy", "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2024-1770-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_tags[0]", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1770", "method": "POST", "mode": "block", "severity": 8.8, "slug": "meta-tag-manager", "target": "plugin", "versions": "<3.1"}, "RULE-CVE-2024-1775-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|\\\\beval\\\\b|\\\\balert\\\\()~i"}], "cve": "CVE-2024-1775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1775", "description": "Nextend Facebook Connect <=3.1.12 reflected XSS via error_description OAuth parameter", "method": "GET", "mode": "block", "severity": 5.4, "slug": "nextend-facebook-connect", "tags": ["xss", "reflected", "oauth", "authenticated"], "target": "plugin", "versions": "<=3.1.12"}, "RULE-CVE-2024-1797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_ulike(?:_counter)?\\\\s[^\\\\]]*(?:id|status)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\'|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP\\\\s*\\\\(|BENCHMARK|EXTRACTVALUE|CONCAT\\\\s*\\\\(|information_schema|/\\\\*)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1797", "description": "WP ULike <=4.6.9 authenticated (Contributor+) SQL injection via wp_ulike/wp_ulike_counter shortcode attributes in post content submitted to post.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-ulike", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.9"}, "RULE-CVE-2024-1797-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_ulike(?:_counter)?\\\\s[^\\\\]]*(?:id|status)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\'|--|;|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP\\\\s*\\\\(|BENCHMARK|EXTRACTVALUE|CONCAT\\\\s*\\\\(|information_schema|/\\\\*)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1797", "description": "WP ULike <=4.6.9 authenticated (Contributor+) SQL injection via wp_ulike/wp_ulike_counter shortcode attributes in post content submitted to REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-ulike", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.6.9"}, "RULE-CVE-2024-1806-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:profilepress-edit-profile|profilepress-login|profilepress-password-reset|profilepress-melange-password-reset|ppress_content_condition)\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-1806", "description": "ProfilePress <=4.15.1 stored XSS via shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "wp-user-avatar", "target": "plugin", "versions": "<=4.15.1"}, "RULE-CVE-2024-1808-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 contributor+ stored XSS via su_qrcode shortcode attributes (placeholder, alt, title, content) on post save", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1808-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 contributor+ stored XSS via su_qrcode shortcode in REST API post content", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1808-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_qrcode[^\\\\]]*?(?:\\\\b(?:placeholder|alt|title|content)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)|(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|<\\\\s*script|javascript\\\\s*:)))~i"}], "cve": "CVE-2024-1808", "description": "Shortcodes Ultimate <=7.0.3 reflected XSS via su_qrcode in su_generator_preview AJAX shortcode parameter", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2024-1815-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr[paginateArrow]", "type": "detectXSS"}], "cve": "CVE-2024-1815", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.8"}, "RULE-CVE-2024-1815-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr[captionDisplayType]", "type": "detectXSS"}], "cve": "CVE-2024-1815", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.8"}, "RULE-CVE-2024-1859-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "slider_responsive"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-1859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-1859", "description": "Slider Responsive Slideshow <=1.3.8 authenticated (Contributor+) PHP Object Injection via save_post slider data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "slider-responsive-slideshow", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-1981-01": {"ajax_action": "wpvividstg_start_staging_free", "conditions": [{"name": "ARGS:table_prefix", "type": "exists"}, {"name": "ARGS:table_prefix", "type": "regex", "value": "~[\'\\"`;]|--|#|(?i)\\\\bunion\\\\b|(?i)\\\\bselect\\\\b~"}], "cve": "CVE-2024-1981", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-01": {"ajax_action": "wpvivid_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-02": {"ajax_action": "wpvivid_get_restore_progress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-03": {"ajax_action": "wpvividstg_start_staging_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1982-04": {"ajax_action": "wpvividstg_get_staging_progress_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1982", "method": "POST", "mode": "block", "severity": 9.1, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.68"}, "RULE-CVE-2024-1990-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02a": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02b": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-02c": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03a": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03b": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1990-03c": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|[?&]|$)~"}, {"name": "JSON:content", "type": "regex", "value": "~\\\\[(?:RM_Form|CRF_Form)\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?\\\\s*[^\\"\'\\\\]]*[^0-9\\"\'\\\\]\\\\s][^\\"\'\\\\]]*~i"}], "cve": "CVE-2024-1990", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.1.0"}, "RULE-CVE-2024-1991-01": {"ajax_action": "rm_update_users_role", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-1991", "method": "POST", "mode": "block", "severity": 8.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.0.0"}, "RULE-CVE-2024-2006-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pgcu_shortcode"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2024-2006", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid-carousel-ultimate", "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2024-2025-01": {"ajax_action": "wc4bp_add_page", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_add_page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2025-02": {"ajax_action": "wc4bp_delete_page", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_delete_page AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2025-03": {"ajax_action": "wc4bp_edit_entry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:(?:\\\\\\\\)?[\\"\\\\{]~"}], "cve": "CVE-2024-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2025", "description": "WC4BP <=3.4.20 PHP Object Injection via maybe_unserialize() in wc4bp_edit_entry AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wc4bp", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=3.4.20"}, "RULE-CVE-2024-2088-01": {"ajax_action": "nxs_getExpSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2088", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2088", "description": "NextScripts Social Networks Auto-Poster <=3.8.8 authenticated sensitive information exposure via nxs_getExpSettings", "mode": "block", "severity": 6.5, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["sensitive-data-exposure", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=3.8.8"}, "RULE-CVE-2024-2115-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "accept-request"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-2115", "method": "GET", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2024-2115-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/users\\\\.php~"}, {"name": "ARGS:lp-action", "type": "equals", "value": "deny-request"}, {"name": "ARGS:user_id", "type": "exists"}], "cve": "CVE-2024-2115", "method": "GET", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2024-2122-01": {"ajax_action": "foogallery_save_gallery_details", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2122", "description": "FooGallery <=2.4.15 contributor+ stored XSS via album gallery custom URLs in save_gallery_details", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=2.4.15"}, "RULE-CVE-2024-2122-02": {"ajax_action": "foogallery_get_gallery_details", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2122", "description": "FooGallery <=2.4.15 contributor+ stored XSS via album gallery custom URLs in get_gallery_details", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=2.4.15"}, "RULE-CVE-2024-2123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/members~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 stored XSS in member directory via display_name", "method": "GET", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "shortcode"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:user_login", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 unauthenticated stored XSS via registration form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2123-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-2123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2123", "description": "Ultimate Member <=2.8.3 authenticated stored XSS via profile update", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2024-2125-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envialosimple/v1/gallery/add(?:/|\\\\?|&|$)~"}, {"name": "FILES:file", "type": "exists"}], "cve": "CVE-2024-2125", "method": "POST", "mode": "block", "severity": 8.8, "slug": "envialosimple-email-marketing-y-newsletters-gratis", "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2024-21751-01": {"ajax_action": "rabbitloader_ajax_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-02": {"ajax_action": "rabbitloader_mode_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-03": {"ajax_action": "rabbitloader_ajax_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-21751-04": {"ajax_action": "rabbitloader_ajax_survey_dismissed", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-21751", "mode": "block", "severity": 8.8, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.19.13"}, "RULE-CVE-2024-22144-01": {"ajax_action": "GOTMLS_load_update", "conditions": [{"name": "ARGS:GOTMLS_update_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-22144", "description": "Anti-Malware Security and Brute-Force Firewall <=4.21.96 unauthenticated RCE via malicious definition injection through GOTMLS_load_update AJAX handler", "mode": "block", "severity": 9.0, "slug": "gotmls", "target": "plugin", "versions": "<=4.21.96"}, "RULE-CVE-2024-22144-03": {"ajax_action": "GOTMLS_log_session", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-22144", "description": "Anti-Malware Security and Brute-Force Firewall <=4.21.96 unauthenticated server microtime disclosure via GOTMLS_log_session AJAX handler", "mode": "block", "severity": 9.0, "slug": "gotmls", "target": "plugin", "versions": "<=4.21.96"}, "RULE-CVE-2024-22144-04": {"ajax_action": "GOTMLS_lognewkey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-22144", "description": "Anti-Malware Security and Brute-Force Firewall <=4.21.96 unauthenticated nonce brute-force via GOTMLS_mt array submission on GOTMLS_lognewkey AJAX handler", "mode": "block", "severity": 9.0, "slug": "gotmls", "target": "plugin", "versions": "<=4.21.96"}, "RULE-CVE-2024-22152-01": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-22152", "description": "Product Import Export for WooCommerce <=2.3.7 missing authorization on import AJAX handler allows subscriber+ file upload", "mode": "block", "severity": 8.0, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-22152-02": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2024-22152", "description": "Product Import Export for WooCommerce <=2.3.7 unrestricted file upload of dangerous types via import AJAX handler", "mode": "block", "severity": 8.0, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-22288-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wf_woocommerce_packlist"}, {"name": "ARGS:tab", "type": "equals", "value": "debug"}, {"name": "ARGS:wt_status_message", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-22288", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-22288", "description": "WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <=4.4.0 reflected XSS via wt_status_message on debug settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "print-invoices-packing-slip-labels-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=4.4.0"}, "RULE-CVE-2024-22296-01": {"ajax_action": "csv", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-22296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-22296", "description": "12 Step Meeting List <=3.14.28 missing authorization on CSV export via csv AJAX action", "mode": "block", "severity": 4.3, "slug": "12-step-meeting-list", "tags": ["missing-authorization", "broken-access-control", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.14.28 >=3.14.0"}, "RULE-CVE-2024-2242-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpcf7"}, {"name": "ARGS:action", "type": "equals", "value": "edit"}, {"name": "ARGS:active-tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|svg|img|video|audio|body|input|form|details|math|isindex|marquee)[\\\\s/>])~i"}], "cve": "CVE-2024-2242", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2242", "description": "Contact Form 7 <=5.9 reflected XSS via active-tab parameter on admin edit page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "contact-form-7", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=5.9"}, "RULE-CVE-2024-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/uploads/edd(?:-logs)?/.*\\\\.(?:log|log\\\\.[0-9]+|log\\\\.bak|log\\\\.old)(?:/)?(?:\\\\?|$)~i"}], "cve": "CVE-2024-2302", "method": "GET", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2024-2302-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/uploads/edd(?:-logs)?(?:/)?(?:\\\\?.*)?$~i"}], "cve": "CVE-2024-2302", "method": "GET", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2024-2341-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:keys", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via keys parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:appointment_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via appointment_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:meta_key", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via meta_key parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:customer_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via customer_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2341-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:group_id", "type": "detectSQLi"}], "cve": "CVE-2024-2341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2341", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via group_id parameter in REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:booking|appointments?|upcoming_appointments?|admin_app)[^\\\\]]*customer_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|CONCAT)\\\\b|--\\\\s|/\\\\*|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via malicious shortcode customer_id attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:booking|appointments?|upcoming_appointments?|admin_app)[^\\\\]]*group_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|CONCAT)\\\\b|--\\\\s|/\\\\*|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via malicious shortcode group_id attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_[^\\\\]]*customer_id\\\\s*=\\\\s*[\\"\'][^\\"\']*[^\\\\d\\\\s\\"\'\\\\]][^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via non-numeric customer_id shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2342-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_[^\\\\]]*group_id\\\\s*=\\\\s*[\\"\'][^\\"\']*[^\\\\d\\\\s\\"\'\\\\]][^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-2342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2342", "description": "Simply Schedule Appointments <=1.6.7.7 authenticated SQL injection via non-numeric group_id shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.6.7.7"}, "RULE-CVE-2024-2345-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2345", "description": "FileBird <=5.6.3 authenticated (author+) stored XSS via folder name parameter in REST API", "mode": "block", "severity": 6.4, "slug": "filebird", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-2350-01": {"action": "elementor_save", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_save"}, {"name": "ARGS:data", "type": "contains", "value": "\\"widgetType\\":\\"clever-"}, {"name": "ARGS:data", "type": "regex", "value": "~(?i)(<script\\\\b[^>]*>|javascript:|onerror\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-2350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2350", "description": "Clever Addons for Elementor (cafe-lite) <= 2.1.9 \\u2013 Contributor+ stored XSS via CAFE Icon, CAFE Team Member, and CAFE Slider Elementor widget settings; blocks script-style payloads in widget JSON for users without unfiltered_html.\\n", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cafe-lite", "tags": ["xss", "stored", "elementor", "widgets", "wordpress"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2024-23500-01": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-23500", "description": "Kadence Blocks <=3.2.19 authenticated SSRF via kadence_import_process_image_data AJAX handler", "mode": "block", "severity": 7.7, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-23500-02": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-23500", "description": "Kadence Blocks <=3.2.19 authenticated SSRF via kadence_import_process_pattern AJAX handler", "mode": "block", "severity": 7.7, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-2417-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "user_registration_form_save_action"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2417", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2417", "description": "User Registration <=3.1.5 missing authorization in form_save_action allows subscriber+ privilege escalation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "user-registration", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=3.1.5"}, "RULE-CVE-2024-2441-01": {"ajax_action": "vikbooking", "conditions": [{"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2024-2441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2441", "description": "VikBooking <=1.6.7 IDOR via wp_ajax_vikbooking allows authenticated low-privilege users to access admin settings", "method": "POST", "mode": "block", "severity": 8.1, "slug": "vikbooking", "tags": ["idor", "missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2024-24934-01": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"name": "ARGS:library_action", "type": "regex", "value": "~^(delete_library_template|delete_kit|update_kit|import_kit)$~i"}, {"name": "ARGS:source", "type": "regex", "value": "~(^|/|\\\\\\\\|%2f|%5c)(\\\\.\\\\.|%2e%2e)(/|\\\\\\\\|%2f|%5c)~i"}], "cve": "CVE-2024-24934", "mode": "block", "severity": 8.1, "slug": "elementor", "target": "plugin", "versions": "<=3.19.0"}, "RULE-CVE-2024-24934-02": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"name": "ARGS:library_action", "type": "regex", "value": "~^(import_kit|import_template|sync_library)$~i"}, {"name": "ARGS:source", "type": "regex", "value": "~phar://~i"}], "cve": "CVE-2024-24934", "mode": "block", "severity": 8.1, "slug": "elementor", "target": "plugin", "versions": "<=3.19.0"}, "RULE-CVE-2024-25935-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-25935", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.2.5.9"}, "RULE-CVE-2024-2667-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/instawp-connect/v1/config(?:/|\\\\?|&|$)~"}, {"name": "ARGS:override_plugin_zip", "type": "exists"}], "cve": "CVE-2024-2667", "method": "POST", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.22"}, "RULE-CVE-2024-2702-01": {"ajax_action": "olive_demo_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2702", "description": "Olive One Click Demo Import <=1.1.1 missing authorization on demo import allowing unauthenticated stored XSS via olive_demo_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "olive-one-click-demo-import", "tags": ["missing-authorization", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2024-2771-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/managers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "fluentform_full_access"}], "cve": "CVE-2024-2771", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fluentform", "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-2771-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/managers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "fluentform_full_access"}], "cve": "CVE-2024-2771", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "fluentform", "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-2782-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluentform/v1/global-settings(?:[/?]|$)~"}, {"type": "missing_capability", "value": "fluentform_settings_manager"}], "cve": "CVE-2024-2782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-2782", "description": "Fluent Forms <=5.1.16 missing authorization on global-settings REST API endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "fluentform", "tags": ["missing-authorization", "rest-api", "unauthorized"], "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2024-27956-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-content/plugins/wp-automatic/inc/csv\\\\.php~i"}, {"name": "ARGS:q", "type": "detectSQLi"}], "cve": "CVE-2024-27956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27956", "description": "wp-automatic (Automatic) <=3.92.0 unauthenticated SQL injection via the q parameter of the direct-access inc/csv.php script (CVE-2024-27956, mass-exploited 2024). The script builds a SQL query from the attacker-controlled q parameter after a bypassable auth/integ check. Blocks requests to /wp-content/plugins/wp-automatic/inc/csv.php whose q parameter contains a SQL-injection payload; legitimate CSV-export calls carry a benign q and are unaffected.", "mode": "block", "severity": 9.8, "slug": "wp-automatic", "tags": ["sql-injection", "unauthenticated", "direct-script-access"], "target": "plugin", "versions": "<=3.92.0"}, "RULE-CVE-2024-27987-01": {"action": "init", "conditions": [{"name": "ARGS:form_id", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via form_id parameter in shortcode rendering", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:status", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via status parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:donor", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via donor parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-donors"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via order parameter in admin donors table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:status", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via status parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-payment-history"}, {"name": "ARGS:donor", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via donor parameter in admin payments table", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-11": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via s (search) parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-12": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:start-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via start-date parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-27987-13": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "give_forms"}, {"name": "ARGS:end-date", "type": "detectXSS"}], "cve": "CVE-2024-27987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-27987", "description": "GiveWP <=3.3.1 reflected XSS via end-date parameter in admin forms list", "method": "GET", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "reflected-xss", "admin"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-28000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/users(?:/|\\\\?|$|$)~"}, {"name": "REQUEST_COOKIES:litespeed_hash", "type": "exists"}], "cve": "CVE-2024-28000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-28000", "description": "LiteSpeed Cache >=1.9 <=6.3.0.1 unauthenticated privilege escalation via cookie-based role simulation on WP REST /wp/v2/users endpoint (litespeed_hash brute-force)", "mode": "block", "severity": 9.8, "slug": "litespeed-cache", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.9 <=6.3.0.1"}, "RULE-CVE-2024-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[calendar[^\\\\]]*categories\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|GROUP_CONCAT|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|BENCHMARK|SLEEP|OR\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|AND\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|--|;|/\\\\*)[^\\\\]]*[\\\\\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2831", "method": "POST", "mode": "block", "severity": 8.8, "slug": "calendar", "target": "plugin", "versions": "<=1.3.14"}, "RULE-CVE-2024-2831-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[calendar[^\\\\]]*categories\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|GROUP_CONCAT|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|BENCHMARK|SLEEP|OR\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|AND\\\\s+(?:\\\\d|[\\\\\\"\']\\\\d)|--|;|/\\\\*)[^\\\\]]*[\\\\\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-2831", "method": "POST", "mode": "block", "severity": 8.8, "slug": "calendar", "target": "plugin", "versions": "<=1.3.14"}, "RULE-CVE-2024-2876-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:method", "type": "regex", "value": "~^get_matching_recipients_count$~"}, {"name": "ARGS", "type": "regex", "value": "~\'\\\\s*(\\\\)|;|union\\\\b|select\\\\b|insert\\\\b|update\\\\b|delete\\\\b|drop\\\\b|--|#|/\\\\*)|\'\\\\s+(?:or|and)\\\\b~i"}], "cve": "CVE-2024-2876", "description": "SQL injection in Email Subscribers & Newsletters (Icegram Express) <=5.7.14: non-numeric elements of a _click_link condition value are interpolated unescaped into \\"link IN (\'<value>\')\\" in IG_ES_Subscribers_Query::run() (SINK class-ig-es-subscriber-query.php:304; fixed 5.7.15 esc_sql). ENTRYPOINT wp_ajax_nopriv_icegram-express -> ES_Router::handle_ajax_request -> ES_Campaign_Controller::get_matching_recipients_count, payload data[list_conditions][..][value][..].", "method": "POST", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "target": "plugin", "versions": "<=5.7.14"}, "RULE-CVE-2024-29090-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/settings/update(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-29090", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29100-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai(-ui)?/v1/~i"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-29100", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29100-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai(-ui)?/v1/~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml|phar|pht|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-29100", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.1.4"}, "RULE-CVE-2024-29113-01": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-02": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-03": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29113-04": {"action": "admin_init", "conditions": [{"name": "ARGS:rm_sort", "type": "regex", "value": "~^(?!(?:latest|oldest|0toz|zto0)$).+~"}], "cve": "CVE-2024-29113", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<5.2.6.0"}, "RULE-CVE-2024-29117-01": {"ajax_action": "accua_form_submit", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~<(?:script|iframe|img|svg)[^>]*>~i"}], "cve": "CVE-2024-29117", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contact-forms", "target": "plugin", "versions": "<=1.7.0"}, "RULE-CVE-2024-29931-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:map_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via map_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:poly_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via poly_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:circle_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via circle_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-29931-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-google-maps-menu"}, {"name": "ARGS:rectangle_id", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2024-29931", "description": "WP Go Maps <=9.0.29 reflected XSS via rectangle_id parameter on admin page", "mode": "block", "severity": 7.1, "slug": "wp-google-maps", "target": "plugin", "versions": "<=9.0.29"}, "RULE-CVE-2024-3020-01": {"ajax_action": "wpcp_import_shortcodes", "conditions": [{"name": "ARGS:shortcode", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3020", "description": "WP Carousel <=2.6.3 authenticated PHP object injection via wpcp_import_shortcodes AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-carousel-free", "target": "plugin", "versions": "<=2.6.3"}, "RULE-CVE-2024-30226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/betterdocs/faq/(?:create_post|update_post|delete_post|create_category|update_category|delete_category|category_order|update_order_by_category|category_search|category_status|sample_data|uncategorised|posts/)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2024-30226", "description": "BetterDocs <=3.3.3 unauthenticated PHP object injection via FAQBuilder REST API routes", "mode": "block", "severity": 9.0, "slug": "betterdocs", "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-30229-01": {"ajax_action": "give_donation_import", "conditions": [{"name": "ARGS:mapto", "type": "exists"}, {"name": "ARGS:mapto", "type": "regex", "value": "~(?i)O:\\\\+?\\\\d+:\\"[^\\"]*\\":\\\\+?\\\\d+:\\\\{~"}], "cve": "CVE-2024-30229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-30229", "description": "GiveWP <= 3.4.2 \\u2013 PHP Object Injection via mapto in give_donation_import AJAX action (CWE-502, CVSS 7.2)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "give", "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2024-30231-01": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-30231", "description": "Product Import Export for WooCommerce <=2.4.1 authenticated arbitrary file upload via iew_import_ajax_basic AJAX handler \\u2014 missing authorization", "mode": "block", "severity": 9.1, "slug": "product-import-export-for-woo", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-30464-01": {"ajax_action": "zoom_ajax_set_pointer_transient", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-30464", "description": "Social Icons Widget & Block by WPZOOM <=4.2.15 missing authorization on zoom_ajax_set_pointer_transient AJAX handler", "mode": "block", "severity": 8.8, "slug": "social-icons-widget-by-wpzoom", "target": "plugin", "versions": "<=4.2.15"}, "RULE-CVE-2024-30485-01": {"ajax_action": "xl_addon_installation", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-30485", "description": "Finale Lite <=2.18.0 subscriber+ arbitrary plugin installation/activation via xl_addon_installation AJAX handler", "mode": "block", "severity": 8.8, "slug": "finale-woocommerce-sales-countdown-timer-discount", "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2024-30501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json)?/download-monitor/v1/~"}, {"name": "ARGS:limit", "type": "detectSQLi"}], "cve": "CVE-2024-30501", "method": "GET", "mode": "block", "severity": 7.2, "slug": "download-monitor", "target": "plugin", "versions": "<=4.9.4"}, "RULE-CVE-2024-30501-02": {"ajax_action": "dlm_top_downloads_reports", "conditions": [{"name": "ARGS:limit", "type": "detectSQLi"}], "cve": "CVE-2024-30501", "method": "POST", "mode": "block", "severity": 7.2, "slug": "download-monitor", "target": "plugin", "versions": "<=4.9.4"}, "RULE-CVE-2024-30516-01": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:scheduleCost", "type": "regex", "value": "~^\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|[+-]?(?:0+(?:\\\\.0*)?|0*\\\\.0+)(?:[eE][+-]?0+)?)\\\\s*$~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-02": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:cost", "type": "regex", "value": "~^\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|[+-]?(?:0+(?:\\\\.0*)?|0*\\\\.0+)(?:[eE][+-]?0+)?)\\\\s*$~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-03": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:guests", "type": "regex", "value": "~\\"cost\\"\\\\s*:\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|0(?:\\\\.0+)?)(?!\\\\.)(?=\\\\s*[,\\\\}\\\\]])~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30516-04": {"ajax_action": "package_app_public_action", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~^(sendBooking|intentForStripe|updateIntentForStripe)$~"}, {"name": "ARGS:services", "type": "regex", "value": "~\\"cost\\"\\\\s*:\\\\s*(?:-(?:\\\\d+(?:\\\\.\\\\d+)?|\\\\.\\\\d+)|0(?:\\\\.0+)?)(?!\\\\.)(?=\\\\s*[,\\\\}\\\\]])~"}], "cve": "CVE-2024-30516", "method": "POST", "mode": "block", "severity": 7.5, "slug": "booking-package", "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2024-30549-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "accua-forms-edit"}, {"name": "ARGS:edit-fid", "type": "detectXSS"}], "cve": "CVE-2024-30549", "method": "GET", "mode": "block", "severity": 4.8, "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2024-30549-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "accua-forms-submissions"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2024-30549", "method": "GET", "mode": "block", "severity": 4.8, "slug": "contact-forms", "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2024-3055-01": {"ajax_action": "unitecreator_elementor_export_template", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-3055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3055", "description": "Unlimited Elements For Elementor <=1.5.102 authenticated (Contributor+) time-based SQL injection via id parameter in export template AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.5.102"}, "RULE-CVE-2024-3055-02": {"ajax_action": "unitecreator_elementor_import_template", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9,\\\\s]~"}], "cve": "CVE-2024-3055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3055", "description": "Unlimited Elements For Elementor <=1.5.102 authenticated (Contributor+) time-based SQL injection via id parameter in import template AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.5.102"}, "RULE-CVE-2024-3105-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[[]insert_php([^a-zA-Z0-9_][^]]*|)[]]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3105", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3105", "description": "Starter Templates by suspended developer (Insert PHP) <=2.5.0 authenticated (Contributor+) RCE via insert_php shortcode in post content", "method": "POST", "mode": "block", "severity": 9.9, "slug": "insert-php", "tags": ["remote-code-execution", "shortcode", "missing-authorization"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-3107-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/spectra/v1/editor(?:/|\\\\?|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|\\\\.\\\\.%2f|\\\\.\\\\.%5c|%2e%2e%5c)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3107", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.12.6"}, "RULE-CVE-2024-31113-01": {"ajax_action": "edd_recapture_remote_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-31113", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2024-3136-01": {"ajax_action": "stm_lms_load_content", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC])~"}], "cve": "CVE-2024-3136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3136", "description": "MasterStudy LMS <=3.3.3 unauthenticated Local File Inclusion via template parameter in stm_lms_load_content AJAX handler", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-3136-02": {"ajax_action": "stm_lms_load_modal", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC])~"}], "cve": "CVE-2024-3136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3136", "description": "MasterStudy LMS <=3.3.3 unauthenticated Local File Inclusion via template parameter in stm_lms_load_modal AJAX handler", "mode": "block", "severity": 9.8, "slug": "masterstudy-lms-learning-management-system", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2024-3161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:jkit[-_]countdown|sg_countdown|sg_expire).*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3161", "description": "Jeg Elementor Kit <=2.6.4 contributor+ stored XSS via countdown widget attributes in Elementor editor save (elementor_ajax)", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-3161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:jkit[-_]countdown|sg_countdown|sg_expire).*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3161", "description": "Jeg Elementor Kit <=2.6.4 contributor+ stored XSS via countdown widget attributes in Elementor REST API document save", "mode": "block", "severity": 6.4, "slug": "jeg-elementor-kit", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.4"}, "RULE-CVE-2024-3211-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ec_addtocart\\\\b[^\\\\]]*productid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CONCAT|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|OR\\\\s+\\\\d|AND\\\\s+\\\\d|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-3211", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3211", "description": "Shopping Cart & eCommerce Store <=5.6.3 SQL Injection via ec_addtocart shortcode productid attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-easycart", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-3211-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ec_addtocart\\\\b[^\\\\]]*productid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CONCAT|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|OR\\\\s+\\\\d|AND\\\\s+\\\\d|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-3211", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3211", "description": "Shopping Cart & eCommerce Store <=5.6.3 SQL Injection via ec_addtocart shortcode productid attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-easycart", "tags": ["sql-injection", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-3217-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:attribute_id", "type": "regex", "value": "~[^0-9a-zA-Z_\\\\-]~"}], "cve": "CVE-2024-3217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3217", "description": "WP Directory Kit <=1.3.0 SQL Injection via attribute_id parameter in wdk_public_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpdirectorykit", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2024-3217-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:attribute_value", "type": "regex", "value": "~[^0-9a-zA-Z_\\\\-]~"}], "cve": "CVE-2024-3217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3217", "description": "WP Directory Kit <=1.3.0 SQL Injection via attribute_value parameter in wdk_public_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpdirectorykit", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2024-32505-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-32505", "description": "ElementsKit Lite <=3.0.6 Contributor+ stored XSS via ekit_admin_action settings injection", "mode": "block", "severity": 6.5, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2024-32567-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "detectXSS"}], "cve": "CVE-2024-32567", "method": "GET", "mode": "block", "severity": 6.1, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2024-3293-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rtmedia_gallery\\\\b[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|\\\\(\\\\s*SELECT)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3293", "method": "POST", "mode": "block", "severity": 8.8, "slug": "buddypress-media", "target": "plugin", "versions": "<=4.6.18"}, "RULE-CVE-2024-3293-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rtmedia_gallery\\\\b[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|SELECT|UNION|INSERT|UPDATE|DELETE|DROP|ALTER|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|\\\\(\\\\s*SELECT)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3293", "method": "POST", "mode": "block", "severity": 8.8, "slug": "buddypress-media", "target": "plugin", "versions": "<=4.6.18"}, "RULE-CVE-2024-3342-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mp-timetable[^\\\\]]*\\\\bevents\\\\s*=\\\\s*(?:[\'\\"][^\'\\"]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\'\\"]*[\'\\"]|[^\\\\s\\\\]]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\\\\s\\\\]]*)~i"}], "cve": "CVE-2024-3342", "mode": "block", "severity": 9.9, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2024-3342-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mp-timetable[^\\\\]]*\\\\bevents\\\\s*=\\\\s*(?:[\'\\"][^\'\\"]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\'\\"]*[\'\\"]|[^\\\\s\\\\]]*(?:UNION(?:\\\\s+|/\\\\*\\\\*/)+(?:ALL(?:\\\\s+|/\\\\*\\\\*/)+)?SELECT|SELECT(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+FROM|INSERT(?:\\\\s+|/\\\\*\\\\*/)+INTO|UPDATE(?:\\\\s+|/\\\\*\\\\*/)+\\\\S+(?:\\\\s+|/\\\\*\\\\*/)+SET|DELETE(?:\\\\s+|/\\\\*\\\\*/)+FROM|DROP(?:\\\\s+|/\\\\*\\\\*/)+(?:TABLE|DATABASE|INDEX)|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|INTO(?:\\\\s+|/\\\\*\\\\*/)+(?:OUT|DUMP)FILE)[^\\\\s\\\\]]*)~i"}], "cve": "CVE-2024-3342", "mode": "block", "severity": 9.9, "slug": "mp-timetable", "target": "plugin", "versions": "<=2.4.11"}, "RULE-CVE-2024-3343-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~themeisle-blocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on\\\\w+\\\\s*=|<\\\\s*img[^>]*on\\\\w+\\\\s*=)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3343", "description": "Otter Blocks <=2.6.8 contributor+ stored XSS via block attributes in post content", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-3344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:async-upload|media-new)\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|click|mouseover|focus|begin|end|activate)\\\\s*=|javascript\\\\s*:|<foreignObject\\\\b|xlink:href\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data:))~i"}], "cve": "CVE-2024-3344", "description": "Otter Blocks <=2.6.8 author+ stored XSS via unsanitized SVG upload to wp-admin/async-upload.php and media-new.php", "mode": "block", "severity": 5.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-3344-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|click|mouseover|focus|begin|end|activate)\\\\s*=|javascript\\\\s*:|<foreignObject\\\\b|xlink:href\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data:))~i"}], "cve": "CVE-2024-3344", "description": "Otter Blocks <=2.6.8 author+ stored XSS via unsanitized SVG upload to REST wp/v2/media endpoint", "mode": "block", "severity": 5.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.8"}, "RULE-CVE-2024-33644-01": {"ajax_action": "cs_download_files", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ arbitrary file download via cs_download_files AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33644-02": {"ajax_action": "cs_import_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ code injection via cs_import_options AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33644-03": {"ajax_action": "cs_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ arbitrary plugin installation via cs_install_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33644-04": {"ajax_action": "cs_active_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ unauthorized plugin activation via cs_active_plugin AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33644-05": {"ajax_action": "cs_import_content", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ unauthorized content import via cs_import_content AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33644-06": {"ajax_action": "cs_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ unauthorized site export via cs_export AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33644-07": {"ajax_action": "cs_import__check", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-33644", "description": "Customify Site Library <=0.0.9 subscriber+ unauthorized import check via cs_import__check AJAX handler", "mode": "block", "severity": 9.9, "slug": "customify-sites", "target": "plugin", "versions": "<=0.0.9"}, "RULE-CVE-2024-33947-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-33947-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-33947-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-33947", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=5.3.2.0"}, "RULE-CVE-2024-34440-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/upload(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-03-DELETE": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/delete(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "method": "DELETE", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-34440-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai-ui/v1/files/list(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-34440", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<2.2.70"}, "RULE-CVE-2024-3495-01": {"ajax_action": "tc_csca_get_states", "conditions": [{"name": "ARGS:cnt", "type": "detectSQLi"}], "cve": "CVE-2024-3495", "method": "POST", "mode": "block", "severity": 9.8, "slug": "country-state-city-auto-dropdown", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2024-3495-02": {"ajax_action": "tc_csca_get_cities", "conditions": [{"name": "ARGS:sid", "type": "detectSQLi"}], "cve": "CVE-2024-3495", "method": "POST", "mode": "block", "severity": 9.8, "slug": "country-state-city-auto-dropdown", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2024-3499-01": {"ajax_action": "generate_navigation_markup", "conditions": [{"name": "ARGS:nav_style", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2024-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3499", "description": "ElementsKit Elementor Addons <=3.1.0 authenticated Local File Inclusion via generate_navigation_markup AJAX nav_style parameter", "mode": "block", "severity": 8.8, "slug": "elementskit-lite", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2024-3548-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?iframe[\\\\s>]|<svg[/\\\\s>].*?on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-3548", "description": "Shortcodes Ultimate <7.1.2 authenticated reflected XSS via shortcode parameter in su_generator_preview AJAX handler", "mode": "block", "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<7.1.2"}, "RULE-CVE-2024-3549-01": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:b2sSortPostType", "type": "detectSQLi"}], "cve": "CVE-2024-3549", "method": "POST", "mode": "block", "severity": 9.9, "slug": "blog2social", "target": "plugin", "versions": "<=7.4.1"}, "RULE-CVE-2024-3550-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_(?:lightbox|dailymotion|service|anchor|heading|button|tab|spoiler|accordion|audio|video|animate|tooltip|permalink|members|guests|feed|menu|subpages|siblings|carousel|custom_gallery|slider|gmap|posts)\\\\s[^\\\\]]*(?:on(?:error|load|mouse(?:over|out|enter|move|down|up)|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 stored XSS via shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3550-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_(?:lightbox|dailymotion|service|anchor|heading|button|tab|spoiler|accordion|audio|video|animate|tooltip|permalink|members|guests|feed|menu|subpages|siblings|carousel|custom_gallery|slider|gmap|posts)\\\\s[^\\\\]]*(?:on(?:error|load|mouse(?:over|out|enter|move|down|up)|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 stored XSS via shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3550-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouse(?:over|out|enter)|focus|blur|click|dblclick)\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s+on[a-z]+=)~i"}], "cve": "CVE-2024-3550", "description": "Shortcodes Ultimate <=7.1.2 reflected XSS via su_generator_preview AJAX shortcode parameter", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.2"}, "RULE-CVE-2024-3552-01": {"ajax_action": "w2dc_get_map_marker_info", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.+\\\\s+FROM|AND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|OR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+)~"}], "cve": "CVE-2024-3552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3552", "description": "Web Directory Free <=1.6.9 unauthenticated SQL injection via locations_ids parameter in w2dc_get_map_marker_info AJAX handler", "mode": "block", "severity": 9.8, "slug": "web-directory-free", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2024-3560-01": {"action": "init", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-3560-02": {"action": "init", "conditions": [{"name": "ARGS:c_level", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-3560-03": {"action": "init", "conditions": [{"name": "ARGS:c_authors", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed)\\\\b|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-3560", "method": "GET", "mode": "block", "severity": 5.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.4"}, "RULE-CVE-2024-35683-01": {"ajax_action": "send-card-check", "conditions": [{"name": "ARGS:donation_id", "type": "exists"}], "cve": "CVE-2024-35683", "method": "POST", "mode": "block", "severity": 5.3, "slug": "leyka", "target": "plugin", "versions": "<=3.31.1"}, "RULE-CVE-2024-35690-01": {"ajax_action": "widgetopts_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_users AJAX handler (Subscriber+ User Meta Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-35690-02": {"ajax_action": "widgetopts_get_settings_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_settings_ajax AJAX handler (Subscriber+ Settings Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-35690-03": {"ajax_action": "widgetopts_get_legacy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-35690", "description": "Block unauthorized access to widgetopts_get_legacy_data AJAX handler (Subscriber+ Legacy Data Exposure)", "mode": "block", "severity": 6.5, "slug": "widget-options", "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2024-3592-01": {"ajax_action": "qsm_bulk_delete_question_from_database", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "delete_published_posts"}], "cve": "CVE-2024-3592", "method": "POST", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "target": "plugin", "versions": "<=9.0.1"}, "RULE-CVE-2024-3592-02": {"ajax_action": "qsm_delete_question_from_database", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "delete_published_posts"}], "cve": "CVE-2024-3592", "method": "POST", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "target": "plugin", "versions": "<=9.0.1"}, "RULE-CVE-2024-3605-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wphb/v1/rooms/search-rooms(/|\\\\?|&|$)~"}, {"name": "ARGS:room_type", "type": "detectSQLi"}], "cve": "CVE-2024-3605", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-hotel-booking", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2024-37099-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "exists"}, {"name": "ARGS:give-form-title", "type": "regex", "value": "~[OaCd]:[0-9]+:~i"}], "cve": "CVE-2024-37099", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-3715-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "contact-form-listings"}, {"name": "ARGS:start_date", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on[a-zA-Z]+\\\\s*=|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2024-3715", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3715", "description": "Database for Contact Form 7 <=1.3.8 reflected XSS via start_date parameter on admin leads page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "contact-form-entries", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-3715-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "contact-form-listings"}, {"name": "ARGS:end_date", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on[a-zA-Z]+\\\\s*=|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2024-3715", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3715", "description": "Database for Contact Form 7 <=1.3.8 reflected XSS via end_date parameter on admin leads page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "contact-form-entries", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2024-3725-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~themeisle-blocks/posts-grid[^}]*\\"titleTag\\"\\\\s*:\\\\s*\\"(?!h[1-6]\\")[^\\"]*(?:<|on[a-z]+=|javascript:|%3[Cc])~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3725", "description": "Otter Blocks <=2.6.9 stored XSS via Post Grid widget titleTag block attribute", "mode": "block", "severity": 6.4, "slug": "otter-blocks", "target": "plugin", "versions": "<=2.6.9"}, "RULE-CVE-2024-3728-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:actions", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3728", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3728-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|/wp-json/elementor/)~"}, {"name": "ARGS:elements", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-3728", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.15"}, "RULE-CVE-2024-3729-03": {"ajax_action": "frontend_admin/form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author)$~i"}], "cve": "CVE-2024-3729", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2024-3729-04": {"ajax_action": "frontend_admin/validate_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author)$~i"}], "cve": "CVE-2024-3729", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2024-37489-01": {"ajax_action": "owp_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_name in owp_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-02": {"ajax_action": "owp_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_type in owp_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-03": {"ajax_action": "owp_wizard_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_name in owp_wizard_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37489-04": {"ajax_action": "owp_wizard_ajax_get_demo_data", "conditions": [{"name": "ARGS:demo_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2024-37489", "description": "Ocean Extra <=2.2.9 authenticated reflected XSS via demo_type in owp_wizard_ajax_get_demo_data", "mode": "block", "severity": 6.5, "slug": "ocean-extra", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2024-37517-01": {"ajax_action": "ast-block-templates-regenerate", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37517-02": {"ajax_action": "ast-block-templates-ai-content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37517-03": {"ajax_action": "ast-block-templates-reset-business-details", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-37517", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.7"}, "RULE-CVE-2024-37922-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|iframe)[\\\\s/>]|javascript\\\\s*:[^/]~i"}], "cve": "CVE-2024-37922", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-37922", "description": "Premium Addons for Elementor <=4.10.34 Contributor+ stored XSS via Elementor widget settings", "mode": "block", "severity": 6.5, "slug": "premium-addons-for-elementor", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=4.10.34"}, "RULE-CVE-2024-3820-01": {"ajax_action": "wdt_delete_table_row", "conditions": [{"name": "ARGS:id_key", "type": "detectSQLi"}], "cve": "CVE-2024-3820", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.1"}, "RULE-CVE-2024-3821-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_table_config AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_plugin_settings AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-03": {"ajax_action": "wpdatatables_duplicate_table", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_duplicate_table AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-04": {"ajax_action": "wpdatatables_create_simple_table", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_create_simple_table AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-05": {"ajax_action": "wpdatatables_save_simple_table_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_save_simple_table_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-06": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_save_chart_get_shortcode AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-07": {"ajax_action": "wpdatatables_duplicate_chart", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_duplicate_chart AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-08": {"ajax_action": "wpdatatables_get_handsontable_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_handsontable_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-09": {"ajax_action": "wpdatatables_get_columns_data_by_table_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_columns_data_by_table_id AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-10": {"ajax_action": "wpdatatables_delete_log_errors_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_delete_log_errors_cache AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-11": {"ajax_action": "wpdatatable_list_all_tables", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_list_all_tables AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-12": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_show_chart_from_data AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-13": {"ajax_action": "wpdatatable_list_all_charts", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatable_list_all_charts AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-3821-14": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-3821", "description": "Block unauthorized access to wpdatatables_get_nested_json_roots AJAX action (missing capability check, CWE-862)", "mode": "block", "slug": "wpdatatables", "target": "plugin", "versions": "<=6.3.2"}, "RULE-CVE-2024-38755-01": {"ajax_action": "directorypress_fields_edit_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_edit_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-02": {"ajax_action": "directorypress_fields_edit_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_edit_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-03": {"ajax_action": "directorypress_fields_config_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_config_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-04": {"ajax_action": "directorypress_fields_options_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_options_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-05": {"ajax_action": "directorypress_fields_search_settings_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_search_settings_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-06": {"ajax_action": "directorypress_fields_search_settings_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_search_settings_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-07": {"ajax_action": "directorypress_fields_group_edit_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_edit_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-08": {"ajax_action": "directorypress_fields_group_edit_callback", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_edit_callback AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-09": {"ajax_action": "directorypress_fields_delete_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_delete_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-10": {"ajax_action": "directorypress_fields_group_delete_form", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via id parameter in directorypress_fields_group_delete_form AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38755-11": {"ajax_action": "directorypress_terms_configuration_html", "conditions": [{"name": "ARGS:term_id", "type": "detectSQLi"}], "cve": "CVE-2024-38755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-38755", "description": "DirectoryPress <=3.6.10 SQL Injection via term_id parameter in directorypress_terms_configuration_html AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "directorypress", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.6.10"}, "RULE-CVE-2024-38791-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleVisionQuery(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|ldap|tftp|ssh2)://|^https?://(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|localhost|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|\\\\[::1\\\\]|0177\\\\.0\\\\.0\\\\.1|2130706433|0x7f000001|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2024-38791", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-38791-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleVisionQuery(/|\\\\?|$)~i"}, {"name": "ARGS:path", "type": "exists"}], "cve": "CVE-2024-38791", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-38793-01": {"ajax_action": "brm_edit_group", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_edit_group AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-02": {"ajax_action": "brm_delete_group", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_delete_group AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-03": {"ajax_action": "brm_edit_item", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_edit_item AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-04": {"ajax_action": "brm_delete_item", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 authenticated SQL injection via brm_delete_item AJAX handler", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-05": {"ajax_action": "brm_save_group", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_save_group allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-06": {"ajax_action": "brm_save_item", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_save_item allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-38793-07": {"ajax_action": "brm_order_nesting_groups_items", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-38793", "description": "Best Restaurant Menu by PriceListo <=1.4.1 missing authorization on brm_order_nesting_groups_items allows subscriber+ SQL injection", "mode": "block", "severity": 8.8, "slug": "best-restaurant-menu-by-pricelisto", "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2024-3894-01": {"ajax_action": "robo_gallery_get_images_from_ids", "conditions": [{"name": "ARGS:idstring", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2024-3894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-3894", "description": "Robo Gallery <=3.2.19 stored XSS via idstring parameter in robo_gallery_get_images_from_ids AJAX handler", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=3.2.19"}, "RULE-CVE-2024-3954-01": {"ajax_action": "ditty_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\\\"[^\\\\\\"]+\\\\\\":[0-9]+:~"}], "cve": "CVE-2024-3954", "description": "Ditty News Ticker <=3.1.38 authenticated PHP object injection via ditty_init AJAX handler", "mode": "block", "severity": 8.8, "slug": "ditty-news-ticker", "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2024-39635-01": {"ajax_action": "youzify_admin_data_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-39635", "method": "POST", "mode": "block", "severity": 5.4, "slug": "youzify", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2024-39635-02": {"ajax_action": "youzify_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-39635", "method": "POST", "mode": "block", "severity": 5.4, "slug": "youzify", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2024-39643-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-39643-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-39643-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^rm_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-39643", "method": "GET", "mode": "block", "severity": 6.1, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.0.1"}, "RULE-CVE-2024-4010-03": {"ajax_action": "ig_es_get_subscribers_stats", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4010", "description": "Email Subscribers <=5.7.19 subscriber+ unauthorized access to subscriber stats via ig_es_get_subscribers_stats", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=5.7.19"}, "RULE-CVE-2024-4010-04": {"ajax_action": "ig_es_trigger_mailing_queue_sending", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4010", "description": "Email Subscribers <=5.7.19 missing authorization on mailing queue trigger via ig_es_trigger_mailing_queue_sending", "mode": "block", "severity": 8.8, "slug": "email-subscribers", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.7.19"}, "RULE-CVE-2024-4033-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "aiovg_videos"}, {"name": "ARGS:image", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:\\\\?|#|$)|\\\\.htaccess(?:\\\\?|#|$)~i"}], "cve": "CVE-2024-4033", "description": "All-in-One Video Gallery <=3.6.4 authenticated (contributor+) arbitrary file upload via image parameter in aiovg_videos post save", "mode": "block", "severity": 8.8, "slug": "all-in-one-video-gallery", "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2024-4095-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:expand|colomat|expandsub[0-9]{1,2})\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|%\\\\(%[^%]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4095", "description": "Collapse-O-Matic <=1.8.5.7 contributor+ stored XSS via expand/expandsub/colomat shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "jquery-collapse-o-matic", "target": "plugin", "versions": "<=1.8.5.7"}, "RULE-CVE-2024-4095-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:expand|colomat|expandsub[0-9]{1,2})\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|%\\\\(%[^%]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4095", "description": "Collapse-O-Matic <=1.8.5.7 contributor+ stored XSS via expand/expandsub/colomat shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "jquery-collapse-o-matic", "target": "plugin", "versions": "<=1.8.5.7"}, "RULE-CVE-2024-4098-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shariff/v1/share_counts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:services", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2024-4098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4098", "description": "Shariff Wrapper <=4.6.13 unauthenticated Local File Inclusion via services parameter in REST API share_counts endpoint", "method": "GET", "mode": "block", "severity": 9.8, "slug": "shariff", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.6.13"}, "RULE-CVE-2024-4160-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm[_-](?:all[_-]packages|categories)[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4160", "description": "Download Manager <=3.2.90 stored XSS via wpdm-all-packages shortcode attributes", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.90"}, "RULE-CVE-2024-4180-01": {"ajax_action": "tribe_events_views_v2_fallback", "conditions": [{"name": "ARGS:view", "type": "equals", "value": "reflector"}], "cve": "CVE-2024-4180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4180", "description": "The Events Calendar <=6.4.0 reflected XSS via view=reflector in AJAX fallback handler (POST)", "method": "POST", "mode": "block", "severity": 9.1, "slug": "the-events-calendar", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.4.0"}, "RULE-CVE-2024-4180-02": {"ajax_action": "tribe_events_views_v2_fallback", "conditions": [{"name": "ARGS:view", "type": "equals", "value": "reflector"}], "cve": "CVE-2024-4180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4180", "description": "The Events Calendar <=6.4.0 reflected XSS via view=reflector in AJAX fallback handler (GET)", "method": "GET", "mode": "block", "severity": 9.1, "slug": "the-events-calendar", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.4.0"}, "RULE-CVE-2024-4223-01": {"ajax_action": "addon_enable_disable", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on addon_enable_disable AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-02": {"ajax_action": "tutor_get_all_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_get_all_addons AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-03": {"ajax_action": "tutor_course_delete", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_course_delete AJAX action allowing arbitrary course deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-04": {"ajax_action": "tutor_announcement_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_announcement_create AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-05": {"ajax_action": "tutor_announcement_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on tutor_announcement_delete AJAX action allowing arbitrary announcement deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-06": {"ajax_action": "delete_tutor_review", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 missing authorization on delete_tutor_review AJAX action allowing arbitrary review deletion", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4223-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tutor/v1/course-by-terms(/|\\\\?|&|$)~"}], "cve": "CVE-2024-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4223", "description": "Tutor LMS <=2.7.0 unauthorized access to removed REST route /tutor/v1/course-by-terms", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-4277-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:_elementor_data", "type": "detectXSS"}], "cve": "CVE-2024-4277", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4295-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:hash", "type": "regex", "value": "~(?:\'|%27|%2527)[\\\\s)]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|\\\\d\\\\s*[=<>])~i"}], "cve": "CVE-2024-4295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4295", "description": "Email Subscribers by Icegram Express <=5.7.20 unauthenticated SQL injection via hash parameter on icegram-express AJAX handler", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.7.20"}, "RULE-CVE-2024-43141-01": {"ajax_action": "pdb_list_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2024-43141", "description": "Participants Database <=2.5.9.2 unauthenticated PHP object injection via unsanitized cookie deserialization in pdb_list_filter AJAX handler", "mode": "block", "severity": 9.8, "slug": "participants-database", "target": "plugin", "versions": "<=2.5.9.2"}, "RULE-CVE-2024-43160-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optifer/v1/store-webp(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43160", "description": "BerqWP <=1.7.6 unauthenticated arbitrary file upload via optifer/v1/store-webp REST route", "method": "POST", "mode": "block", "severity": 10.0, "slug": "searchpro", "tags": ["missing-authorization", "arbitrary-file-upload", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2024-43162-01": {"ajax_action": "edd_customer_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-02": {"ajax_action": "edd_customer_addresses", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-03": {"ajax_action": "edd_search_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-43162-04": {"ajax_action": "edd_customer_search", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43162", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<3.3.1"}, "RULE-CVE-2024-4318-01": {"ajax_action": "review_quiz_answer", "conditions": [{"name": "ARGS:question_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s|(?:^|[\\\\s\'\\"])(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+)~i"}], "cve": "CVE-2024-4318", "description": "Tutor LMS <=2.7.0 authenticated (Instructor+) time-based SQL injection via question_id in review_quiz_answer AJAX handler", "mode": "block", "severity": 6.5, "slug": "tutor", "target": "plugin", "versions": "<=2.7.0"}, "RULE-CVE-2024-43302-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "reset"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit reset action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43302-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "disable"}, {"name": "ARGS:kit_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit disable action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43302-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "fonts-plugin-typekit"}, {"name": "ARGS:action", "type": "equals", "value": "enable"}, {"name": "ARGS:kit_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43302", "description": "Fonts Plugin | Google Fonts Typography <=3.7.7 missing authorization on Typekit enable action via admin_init", "method": "GET", "mode": "block", "severity": 8.8, "slug": "olympus-google-fonts", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.7.7"}, "RULE-CVE-2024-43304-01": {"ajax_action": "ccpw_get_coins_list", "conditions": [{"name": "ARGS:requiredCurrencies", "type": "detectXSS"}], "cve": "CVE-2024-43304", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cryptocurrency-price-ticker-widget", "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-43314-01": {"action": "admin_post", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-43314", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-asset-clean-up", "target": "plugin", "versions": "<=1.3.9.3"}, "RULE-CVE-2024-43328-01": {"ajax_action": "get_viewer", "conditions": [{"name": "ARGS:fid", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2024-43328", "description": "EmbedPress <=4.0.9 unauthenticated PHP local file inclusion via fid parameter in get_viewer AJAX handler", "mode": "block", "severity": 9.8, "slug": "embedpress", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2024-43328-02": {"ajax_action": "youtube_rest_api", "conditions": [{"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43328", "description": "EmbedPress <=4.0.9 unauthenticated access to youtube_rest_api AJAX handler (nopriv removed in patch)", "mode": "block", "severity": 9.8, "slug": "embedpress", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2024-4334-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~dsm_typing_effect[^\\\\]]*typing_cursor\\\\s*=\\\\s*(?:\\"[^\\"]*|\'[^\']*|[^\\\\s\\\\]]*)(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4334", "description": "Supreme Modules Lite <=2.5.3 contributor+ DOM-Based Stored XSS via typing_cursor in TypingEffect module shortcode", "mode": "block", "severity": 6.4, "slug": "supreme-modules-for-divi", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2024-4347-01": {"ajax_action": "wpfc_delete_cache", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2024-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4347", "description": "WP Fastest Cache <=1.2.6 authenticated arbitrary file deletion via path traversal in wpfc_delete_cache", "mode": "block", "severity": 7.2, "slug": "wp-fastest-cache", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2024-4362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new|admin-ajax)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[siteorigin_widget\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\\"\\\\s+[a-z])|\'[^\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\'\\\\s+[a-z])|[^\\\\s\\\\]\\"\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2024-4362", "description": "SiteOrigin Widgets Bundle <=1.60.0 contributor+ stored XSS via siteorigin_widget shortcode class attribute (post.php save path)", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.60.0"}, "RULE-CVE-2024-4362-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[siteorigin_widget\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\\"\\\\s+[a-z])|\'[^\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:|\'\\\\s+[a-z])|[^\\\\s\\\\]\\"\']*(?:[<>]|on[a-z]+\\\\s*=|javascript\\\\s*:))~i"}], "cve": "CVE-2024-4362", "description": "SiteOrigin Widgets Bundle <=1.60.0 contributor+ stored XSS via siteorigin_widget shortcode in REST post update", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.60.0"}, "RULE-CVE-2024-4366-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:block_id", "type": "detectXSS"}], "cve": "CVE-2024-4366", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2024-4366-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:block_id", "type": "detectXSS"}], "cve": "CVE-2024-4366", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.13.0"}, "RULE-CVE-2024-4375-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ms_layer\\\\b[^\\\\]]*css_id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on\\\\w+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<img\\\\b|<iframe\\\\b|<svg[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4375", "description": "Master Slider <=3.9.10 contributor+ stored XSS via ms_layer shortcode css_id attribute", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.9.10"}, "RULE-CVE-2024-43924-01": {"ajax_action": "save-attachment-compat", "conditions": [{"name": "ARGS:attachment_ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-43924-02": {"ajax_action": "rl-folders-move-attachments", "conditions": [{"name": "ARGS:attachment_ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-43924-03": {"ajax_action": "rl-deactivate-plugin", "conditions": [{"name": "ARGS:section", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2024-43924", "mode": "block", "severity": 9.8, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-4397-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/(?:material/)?item-materials/[0-9]+(?:/|\\\\?|$)~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|jsp|as(?:p|px)|exe|sh|bat)$~i"}], "cve": "CVE-2024-4397", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4397", "description": "LearnPress <=4.2.6.5 authenticated arbitrary file upload via REST item-materials endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-43977-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"video_date\\" *: *\\"[^\\"]*(?:\\\\\\\\\\"[^\\"]*?(?:on[a-zA-Z0-9_]+ *=|autofocus|style *=|src *=|href *=)|[<>])~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via video_date in tp-video-player widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"carousel_direction\\" *: *\\"[^\\"]*[ =<>]~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via carousel_direction in tp-testimonial-listout widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"res_width_value\\" *: *\\"[^\\"]*\'~"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via res_width_value in tp-page-scroll widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-43977-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"nav_dots_tooltips\\" *: *\\"[^\\"]*\'(?: {0,3}(?:on[a-zA-Z0-9_]+ *=|style *=|src *=|href *=)| *autofocus(?:[ /]|$)|><)~i"}], "cve": "CVE-2024-43977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-43977", "description": "The Plus Addons for Elementor <=5.6.2 Stored XSS via nav_dots_tooltips in tp-page-scroll widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2024-4413-01": {"action": "init", "conditions": [{"name": "ARGS:mphb_rooms_details", "type": "regex", "value": "~[OC]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-4413", "method": "POST", "mode": "block", "severity": 9.8, "slug": "motopress-hotel-booking-lite", "target": "plugin", "versions": "<=4.11.1"}, "RULE-CVE-2024-4434-01": {"action": "init", "conditions": [{"name": "ARGS:term_id", "type": "exists"}, {"name": "ARGS:term_id", "type": "detectSQLi"}], "cve": "CVE-2024-4434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4434", "description": "LearnPress <= 4.2.6.5 unauthenticated time-based SQL injection via term_id in public course/category listings (Wordfence/NVD: term_id SQLi, unauthenticated, CWE-89)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "learnpress", "tags": ["sqli", "unauth", "learnpress", "term_id"], "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~listingfields(?:%5[Bb]|\\\\[)(?![0-9]+(?:%5[Dd]|\\\\]))~"}], "cve": "CVE-2024-4443", "method": "GET", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4443-02": {"action": "init", "conditions": [{"name": "ARGS:listingfields", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT)|(?:SELECT\\\\s+.+FROM)|(?:INSERT\\\\s+INTO)|(?:DELETE\\\\s+FROM)|(?:UPDATE\\\\s+.+SET)|(?:DROP\\\\s+TABLE)|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE)~"}], "cve": "CVE-2024-4443", "method": "POST", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4443-03": {"action": "init", "conditions": [{"name": "ARGS:listingfields", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT)|(?:SELECT\\\\s+.+FROM)|(?:INSERT\\\\s+INTO)|(?:DELETE\\\\s+FROM)|(?:UPDATE\\\\s+.+SET)|(?:DROP\\\\s+TABLE)|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE)~"}], "cve": "CVE-2024-4443", "method": "GET", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2024-4444-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "checkout"}, {"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4444-02": {"ajax_action": "learnpress-checkout", "conditions": [{"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4444-03": {"ajax_action": "learnpress_checkout", "conditions": [{"name": "ARGS:checkout-email-option", "type": "equals", "value": "new-account"}], "cve": "CVE-2024-4444", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.5"}, "RULE-CVE-2024-4470-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ms_slide_info\\\\b[^\\\\]]*tag_name\\\\s*=\\\\s*[\\"\']?(?!(?:h[1-4]|div|span)[\\"\'\\\\s\\\\]])[^\\"\'\\\\]]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-4470", "description": "Master Slider <=3.9.9 stored XSS via ms_slide_info shortcode tag_name attribute", "mode": "block", "severity": 6.4, "slug": "master-slider", "target": "plugin", "versions": "<=3.9.9"}, "RULE-CVE-2024-4489-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:async-upload\\\\.php|media-new\\\\.php)~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~<(?:script[\\\\s/>]|[^>]*\\\\bon(?:load|error|click|mouseover|focus)\\\\s*=|foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-4489", "description": "Royal Elementor Addons <=1.3.976 stored XSS via malicious SVG file upload through async-upload.php", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.3.976"}, "RULE-CVE-2024-4489-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~<(?:script[\\\\s/>]|[^>]*\\\\bon(?:load|error|click|mouseover|focus)\\\\s*=|foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-4489", "description": "Royal Elementor Addons <=1.3.976 stored XSS via malicious SVG file upload through REST media endpoint", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.3.976"}, "RULE-CVE-2024-4560-01": {"ajax_action": "chatbot_chatgpt_upload_file_to_assistant", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-4560", "method": "POST", "mode": "block", "severity": 9.8, "slug": "chatbot-chatgpt", "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2024-4624-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:eael_ext_toc_title_tag", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|(?:^|[\\\\s/])on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-4624", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=5.9.20"}, "RULE-CVE-2024-4711-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*button_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode button_label attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*container_type\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode container_type attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ajax_load_more[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via ajax_load_more shortcode class attribute", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-4711-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ajax_load_more\\\\b[^\\\\]]*\\\\b(?:button_label|container_type|css_classes)\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<script\\\\b|</script\\\\b|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-4711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4711", "description": "Ajax Load More <=7.1.1 stored XSS via REST API shortcode injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-load-more", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2024-47308-01": {"ajax_action": "templately_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-47308", "mode": "block", "severity": 9.8, "slug": "templately", "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2024-47308-02": {"ajax_action": "templately_pack_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-47308", "mode": "block", "severity": 9.8, "slug": "templately", "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2024-47331-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cf7mls/v1/cf7mls_validation(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2024-47331", "description": "Multi Step for Contact Form <=2.7.7 unauthenticated SQL injection via cf7mls_validation REST endpoint", "mode": "block", "severity": 9.8, "slug": "cf7-multi-step", "target": "plugin", "versions": "<=2.7.7"}, "RULE-CVE-2024-47350-01": {"ajax_action": "yith_ajax_search_products", "conditions": [{"name": "ARGS:query", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE|ALTER)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2024-47350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-47350", "description": "YITH WooCommerce Ajax Search <=2.8.0 unauthenticated SQL injection via query parameter in yith_ajax_search_products AJAX handler", "mode": "block", "severity": 9.3, "slug": "yith-woocommerce-ajax-search", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-47350-02": {"ajax_action": "yith_ajax_search_products", "conditions": [{"name": "ARGS:cat", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE|ALTER)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2024-47350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-47350", "description": "YITH WooCommerce Ajax Search <=2.8.0 unauthenticated SQL injection via cat parameter in yith_ajax_search_products AJAX handler", "mode": "block", "severity": 9.3, "slug": "yith-woocommerce-ajax-search", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-47350-03": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "yith_ajax_search_products"}, {"name": "ARGS:query", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE|ALTER)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2024-47350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-47350", "description": "YITH WooCommerce Ajax Search <=2.8.0 unauthenticated SQL injection via WooCommerce wc-ajax dispatch (query/cat parameters)", "method": "POST", "mode": "block", "severity": 9.3, "slug": "yith-woocommerce-ajax-search", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-47350-04": {"action": "init", "conditions": [{"name": "ARGS:wc-ajax", "type": "equals", "value": "yith_ajax_search_products"}, {"name": "ARGS:cat", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|CREATE|ALTER)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2024-47350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-47350", "description": "YITH WooCommerce Ajax Search <=2.8.0 unauthenticated SQL injection via WooCommerce wc-ajax dispatch (cat parameter)", "method": "POST", "mode": "block", "severity": 9.3, "slug": "yith-woocommerce-ajax-search", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-47361-01": {"ajax_action": "eae_refresh_insta_cache", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "eae_refresh_insta_cache"}, {"name": "ARGS:transient_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-47361", "method": "POST", "mode": "block", "severity": 8.8, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-4742-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[youzify_verified_users[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|IF\\\\s*\\\\(|CASE\\\\s+WHEN|0x[0-9a-fA-F]+|information_schema|RAND\\\\s*\\\\(\\\\s*\\\\)|INTO\\\\s+(?:OUT|DUMP))~i"}], "cve": "CVE-2024-4742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4742", "description": "Youzify <=1.2.5 authenticated (Contributor+) SQL Injection via youzify_verified_users shortcode order_by attribute in post content submitted to post.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "youzify", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-4742-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[youzify_reviews[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|IF\\\\s*\\\\(|CASE\\\\s+WHEN|0x[0-9a-fA-F]+|information_schema|RAND\\\\s*\\\\(\\\\s*\\\\)|INTO\\\\s+(?:OUT|DUMP))~i"}], "cve": "CVE-2024-4742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4742", "description": "Youzify <=1.2.5 authenticated (Contributor+) SQL Injection via youzify_reviews shortcode order_by attribute in post content submitted to post.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "youzify", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-4742-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[youzify_verified_users[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|IF\\\\s*\\\\(|CASE\\\\s+WHEN|0x[0-9a-fA-F]+|information_schema|RAND\\\\s*\\\\(\\\\s*\\\\)|INTO\\\\s+(?:OUT|DUMP))~i"}], "cve": "CVE-2024-4742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4742", "description": "Youzify <=1.2.5 authenticated (Contributor+) SQL Injection via youzify_verified_users shortcode order_by attribute in REST API post/page creation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "youzify", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-4742-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[youzify_reviews[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|IF\\\\s*\\\\(|CASE\\\\s+WHEN|0x[0-9a-fA-F]+|information_schema|RAND\\\\s*\\\\(\\\\s*\\\\)|INTO\\\\s+(?:OUT|DUMP))~i"}], "cve": "CVE-2024-4742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4742", "description": "Youzify <=1.2.5 authenticated (Contributor+) SQL Injection via youzify_reviews shortcode order_by attribute in REST API post/page creation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "youzify", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-48043-01": {"ajax_action": "image_editor", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-48043", "description": "ShortPixel Image Optimizer <=5.6.3 authenticated SQL injection via image_editor AJAX handler", "mode": "block", "severity": 7.6, "slug": "shortpixel-image-optimiser", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-48044-01": {"ajax_action": "shortpixel_process_queue", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-48044", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-48044-02": {"ajax_action": "shortpixel_ajax_request", "conditions": [{"name": "ARGS:screen_action", "type": "exists"}, {"name": "ARGS:screen_action", "type": "regex", "value": "~^(applyBulkSelection|startBulk|startMigrateAll|startMigrateSelected|toolsRemoveAll|toolsRemoveSelected|toolsRollbackAll|toolsRollbackSelected|foldersAddFolder|foldersRenameFolder|foldersRemoveFolder|toolsViewLog|toolsDownloadLog)$~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-48044", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-48044-03": {"ajax_action": "shortpixel_ajax_request", "conditions": [{"name": "ARGS:screen_action", "type": "exists"}, {"name": "ARGS:screen_action", "type": "regex", "value": "~^(startMigrateAll|toolsRemoveAll|toolsRollbackAll)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-48044", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-48044-04": {"ajax_action": "shortpixel_ajax_request", "conditions": [{"name": "ARGS:screen_action", "type": "exists"}, {"name": "ARGS:screen_action", "type": "regex", "value": "~^(optimizeItem|markCompleted|unMarkCompleted|cancelOptimize|restoreItem|reOptimizeItem|getItemEditWarning)$~i"}, {"name": "ARGS:id", "type": "exists"}, {"name": "ARGS:type", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-48044", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "target": "plugin", "versions": "<=5.6.3"}, "RULE-CVE-2024-48045-01": {"ajax_action": "ha_twitter_feed_action", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-48045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-48045", "description": "Happy Addons <=3.12.3 missing authorization on ha_twitter_feed_action AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "happy-elementor-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.12.3"}, "RULE-CVE-2024-48045-03": {"ajax_action": "ha_post_tab_action", "conditions": [{"name": "ARGS:post_tab_query", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2024-48045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-48045", "description": "Happy Addons <=3.12.3 path traversal via post_tab_query in ha_post_tab_action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "happy-elementor-addons", "tags": ["path-traversal", "lfi-attempt"], "target": "plugin", "versions": "<=3.12.3"}, "RULE-CVE-2024-4821-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new|admin-ajax)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*?(?:javascript\\\\s*:|on(?:error|load|click|focus|mouseover|mouseout|mouseenter|blur|change|submit|input|toggle)\\\\s*=|<script\\\\b)~i"}], "cve": "CVE-2024-4821", "description": "Shortcodes Ultimate <=7.1.6 contributor+ stored XSS via su_lightbox shortcode src/title attributes in post content", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.6"}, "RULE-CVE-2024-4821-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*?(?:javascript\\\\s*:|on(?:error|load|click|focus|mouseover|mouseout|mouseenter|blur|change|submit|input|toggle)\\\\s*=|<script\\\\b)~i"}], "cve": "CVE-2024-4821", "description": "Shortcodes Ultimate <=7.1.6 contributor+ stored XSS via su_lightbox shortcode in REST API post content", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.1.6"}, "RULE-CVE-2024-4863-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/(?:posts|pages|[a-z0-9_-]+)|(?:^|&|\\\\?)rest_route=/wp/v2/(?:posts|pages|[a-z0-9_-]+))~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonials[\\\\s\\\\S]*?\\"titleFont\\"[\\\\s\\\\S]*?\\"level\\"\\\\s*:\\\\s*\\"?[^0-9\\"}\\\\]]~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-4863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4863", "description": "Kadence Blocks <=3.2.38 contributor+ stored XSS via testimonial block titleFont level attribute (REST API path)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=3.2.38"}, "RULE-CVE-2024-4863-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/testimonials[\\\\s\\\\S]*?\\"titleFont\\"[\\\\s\\\\S]*?\\"level\\"\\\\s*:\\\\s*\\"?[^0-9\\"}\\\\]]~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-4863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4863", "description": "Kadence Blocks <=3.2.38 contributor+ stored XSS via testimonial block titleFont level attribute (classic editor post.php path)", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=3.2.38"}, "RULE-CVE-2024-49252-01": {"ajax_action": "leyka_upload_l10n", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-49252", "method": "POST", "mode": "block", "severity": 5.3, "slug": "leyka", "target": "plugin", "versions": "<=3.31.6"}, "RULE-CVE-2024-49282-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "rl_gallery"}, {"name": "ARGS:rl_gallery", "type": "regex", "value": "~(?i)(?:<\\\\s*script\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-49282", "method": "POST", "mode": "block", "severity": 5.9, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2024-49282-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "responsive-lightbox"}, {"name": "ARGS:section", "type": "detectXSS"}], "cve": "CVE-2024-49282", "method": "GET", "mode": "block", "severity": 5.9, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2024-4936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]canto[/\\\\\\\\]includes[/\\\\\\\\]lib[/\\\\\\\\]sizes\\\\.php~i"}, {"name": "ARGS:abspath", "type": "regex", "value": "~(?i)(?:https?|ftp)://|(?:data|php|phar|zip)://|%3a%2f%2f|%253a%252f%252f|\\\\.\\\\./|\\\\.\\\\.\\\\\\\\~"}], "cve": "CVE-2024-4936", "method": "GET", "mode": "block", "severity": 9.8, "slug": "canto", "target": "plugin", "versions": "<=3.0.8"}, "RULE-CVE-2024-4936-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]canto[/\\\\\\\\]includes[/\\\\\\\\]lib[/\\\\\\\\]sizes\\\\.php~i"}, {"name": "ARGS:abspath", "type": "regex", "value": "~(?i)(?:https?|ftp)://|(?:data|php|phar|zip)://|%3a%2f%2f|%253a%252f%252f|\\\\.\\\\./|\\\\.\\\\.\\\\\\\\~"}], "cve": "CVE-2024-4936", "method": "POST", "mode": "block", "severity": 9.8, "slug": "canto", "target": "plugin", "versions": "<=3.0.8"}, "RULE-CVE-2024-4958-01": {"ajax_action": "user_registration_import_form_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-4958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-4958", "description": "User Registration <=3.2.0.1 missing authorization on import_form_action allows contributor+ to import registration forms with administrator default role (privilege escalation)", "mode": "block", "severity": 7.1, "slug": "user-registration", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=3.2.0.1"}, "RULE-CVE-2024-49633-01": {"ajax_action": "directorypress_handler_request", "conditions": [{"name": "ARGS:hash", "type": "detectXSS"}], "cve": "CVE-2024-49633", "method": "POST", "mode": "block", "severity": 6.1, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.19"}, "RULE-CVE-2024-49644-01": {"ajax_action": "AllAccessible_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-49644", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-49644", "description": "Accessibility by AllAccessible <=1.3.4 authenticated (Subscriber+) arbitrary option update via AllAccessible_save_settings AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "allaccessible", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2024-4971-01": {"action": "admin_init", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|<iframe[\\\\s/>])~i"}], "cve": "CVE-2024-4971", "description": "LearnPress <=4.2.6.6 reflected XSS via id parameter in admin question editor", "mode": "block", "severity": 6.4, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.6"}, "RULE-CVE-2024-5020-01": {"ajax_action": "accordion_slider_save_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-5020-02": {"ajax_action": "accordion_slider_preview_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-5020-03": {"ajax_action": "accordion_slider_import_accordion", "conditions": [{"name": "ARGS:data", "type": "detectXSS"}], "cve": "CVE-2024-5020", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accordion-slider", "target": "plugin", "versions": "<=1.9.12"}, "RULE-CVE-2024-50413-01": {"ajax_action": "acui_email_template_selected", "conditions": [{"name": "ARGS:template_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_email_template_selected", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50413-02": {"ajax_action": "acui_send_test_email", "conditions": [{"name": "ARGS:mail_options_subject", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_send_test_email", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50413-03": {"ajax_action": "acui_mail_options_remove_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50413", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50413", "description": "Import Users from CSV with Meta <=1.27.5 stored XSS via acui_mail_options_remove_attachment", "mode": "block", "severity": 5.9, "slug": "import-users-from-csv-with-meta", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.27.5"}, "RULE-CVE-2024-50477-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/.*activate-new-password(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50477", "description": "Stacks Mobile App Builder <=5.2.3 unauthenticated account takeover via forgot-password REST endpoint missing permission_callback", "method": "POST", "mode": "block", "severity": 9.8, "slug": "stacks-mobile-app-builder", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-50477-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/avaris-wc-rest/v3/receive_builder_image(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|user\\\\.ini)$|\\\\.htaccess$~i"}], "cve": "CVE-2024-50477", "description": "Stacks Mobile App Builder <=5.2.3 unauthenticated arbitrary file upload via receive_builder_image REST endpoint missing permission_callback", "method": "POST", "mode": "block", "severity": 9.8, "slug": "stacks-mobile-app-builder", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2024-50500-01": {"ajax_action": "auxin_templates_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_templates_data AJAX handler allowing subscriber+ access to demo importer", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-02": {"ajax_action": "auxin_demo_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_demo_data AJAX handler allowing subscriber+ demo import", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-03": {"ajax_action": "import_step", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on import_step AJAX handler allowing subscriber+ demo import step execution", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-04": {"ajax_action": "auxin_template_control_importer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_template_control_importer AJAX handler allowing subscriber+ template control", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-05": {"ajax_action": "aux_ajax_lightbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_ajax_lightbox AJAX handler allowing subscriber+ access with XSS via preview param", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control", "xss"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-06": {"ajax_action": "aux_setup_plugins", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_setup_plugins AJAX handler allowing subscriber+ plugin installation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-07": {"ajax_action": "aux_step_manager", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_step_manager AJAX handler allowing subscriber+ setup wizard access", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-08": {"ajax_action": "aux_ajax_uninstall", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on aux_ajax_uninstall AJAX handler allowing subscriber+ plugin uninstall actions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-50500-09": {"ajax_action": "auxin_customizer_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-50500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-50500", "description": "Auxin Elements <=2.17.4 missing authorization on auxin_customizer_import AJAX handler allowing subscriber+ customizer import", "method": "POST", "mode": "block", "severity": 4.3, "slug": "auxin-elements", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.17.4"}, "RULE-CVE-2024-5090-01": {"ajax_action": "so_widgets_links_get_title", "conditions": [{"name": "ARGS:postId", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|marquee|body|input|form)\\\\b|&#x?[0-9a-f]+;?\\\\s*<|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-5090", "description": "SiteOrigin Widgets Bundle <=1.61.1 reflected XSS via postId in so_widgets_links_get_title AJAX handler (DCA-confirmed taint flow base/base.php:391->392).", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.61.1"}, "RULE-CVE-2024-5147-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2024-5147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5147", "description": "WPZOOM Addons for Elementor <=1.1.37 unauthenticated Local File Inclusion via path traversal in posts_data JSON parameter on wpz_posts_grid_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpzoom-elementor-addons", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2024-51667-01": {"ajax_action": "paytium_emails_attachments", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-51667", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paytium", "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2024-51793-01": {"ajax_action": "wc_upload_file_ajax", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2024-51793", "description": "Block unauthenticated arbitrary file upload via wc_upload_file_ajax AJAX handler in RepairBuddy plugin (CWE-434). The handler registers both wp_ajax and wp_ajax_nopriv hooks with no authentication, nonce, or file-type validation, allowing anonymous PHP web shell upload leading to RCE. This rule blocks any request carrying a file upload to that endpoint, since the nopriv hook means no legitimate unauthenticated use case exists for this dangerous upload handler.", "mode": "block", "severity": 10.0, "slug": "computer-repair-shop", "target": "plugin", "versions": "<=3.8115"}, "RULE-CVE-2024-5222-01": {"ajax_action": "responsive-ready-sites-import-xml", "conditions": [{"name": "ARGS:xml_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via WXR import xml_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-5222-02": {"ajax_action": "responsive-ready-sites-import-sites", "conditions": [{"name": "ARGS:site_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via site template import site_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-5222-03": {"ajax_action": "responsive-ready-sites-import-wpforms", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-5222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5222", "description": "Responsive Add-ons <=3.0.5 stored XSS via wpforms import form_data parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-add-ons", "tags": ["xss", "stored", "authenticated", "file-upload"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2024-52500-01": {"ajax_action": "create_zone", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on create_zone AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-02": {"ajax_action": "update_logged_in_disabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_logged_in_disabled AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-03": {"ajax_action": "update_zone_enabled_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_zone_enabled_option AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-52500-04": {"ajax_action": "update_zone_id_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-52500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-52500", "description": "Monetag Official <=1.1.3 missing authorization on update_zone_id_option AJAX action", "mode": "block", "severity": 7.2, "slug": "monetag-official", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2024-5266-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdm_(?:packages|package|user_dashboard|search_result|tag)\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5266", "description": "Download Manager <=3.2.92 contributor+ stored XSS via wpdm shortcode attributes in post_content (classic editor)", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.92"}, "RULE-CVE-2024-5266-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_(?:packages|package|user_dashboard|search_result|tag)\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5266", "description": "Download Manager <=3.2.92 contributor+ stored XSS via wpdm shortcode attributes in post content (Gutenberg REST API)", "mode": "block", "severity": 6.4, "slug": "download-manager", "target": "plugin", "versions": "<=3.2.92"}, "RULE-CVE-2024-5317-01": {"ajax_action": "tnp", "conditions": [{"name": "ARGS:na", "type": "regex", "value": "~^(?:s|ps|profile-save|profile_export)$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:svg|img|iframe|video|audio|object|embed|details|marquee|body)\\\\b)~i"}], "cve": "CVE-2024-5317", "description": "Newsletter <=8.3.4 unauthenticated stored XSS via np1/np-family profile fields on tnp AJAX action", "mode": "block", "severity": 6.1, "slug": "newsletter", "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2024-5317-02": {"action": "init", "conditions": [{"name": "ARGS:na", "type": "regex", "value": "~^(?:s|ps|profile-save|profile_export)$~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:svg|img|iframe|video|audio|object|embed|details|marquee|body)\\\\b)~i"}], "cve": "CVE-2024-5317", "description": "Newsletter <=8.3.4 unauthenticated stored XSS via np1/np-family profile fields on public subscribe form (newsletter_action)", "mode": "block", "severity": 6.1, "slug": "newsletter", "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2024-5324-01": {"ajax_action": "xoo_admin_settings_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-5324", "mode": "block", "severity": 8.8, "slug": "mobile-login-woocommerce", "target": "plugin", "versions": "<=2.6.1"}, "RULE-CVE-2024-5329-01": {"ajax_action": "unitecreator_elementor_get_categories", "conditions": [{"name": "ARGS:data[addonID]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|\\\\bOR\\\\b\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-5329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5329", "description": "Unlimited Elements for Elementor <=1.5.109 authenticated (contributor+) blind SQL injection via data[addonID]", "mode": "block", "severity": 8.8, "slug": "unlimited-elements-for-elementor", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=1.5.109"}, "RULE-CVE-2024-5349-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:map_style", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~i"}], "cve": "CVE-2024-5349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5349", "description": "LA-Studio Element Kit for Elementor <=1.3.8.1 Local File Inclusion via map_style parameter in Google Maps widget", "mode": "block", "severity": 8.8, "slug": "lastudio-element-kit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.3.8.1"}, "RULE-CVE-2024-54268-01": {"ajax_action": "so_widgets_search_posts", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "so_widgets_search_posts"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-54268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-54268", "description": "Broken access control in SiteOrigin Widgets Bundle so_widgets_search_posts AJAX action allowing low-privileged users to trigger privileged widget searches via admin-ajax.php", "mode": "block", "severity": 8.8, "slug": "so-widgets-bundle", "tags": ["wordpress", "ajax", "missing_authorization", "broken_access_control"], "target": "plugin", "versions": "<=1.64.0"}, "RULE-CVE-2024-54282-01": {"ajax_action": "wpmm_nav_menu_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_nav_menu_save AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-02": {"ajax_action": "wpmm_save_layout", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_save_layout AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-03": {"ajax_action": "wpmm_save_widget", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_save_widget AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-04": {"ajax_action": "wpmm_menu_item_option_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_menu_item_option_save AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-05": {"ajax_action": "wpmm_theme_delete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wpmm_theme_delete AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-06": {"ajax_action": "export_wpmm_theme", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via export_wpmm_theme AJAX (CWE-502) - blocks serialized PHP object payloads", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-54282-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^wp-megamenu(?:-import|-export|-themes|-settings)?$~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[^A-Za-z0-9_])[OC]:[0-9]+:\\\\\\"[A-Za-z_\\\\\\\\\\\\x80-\\\\xff][A-Za-z0-9_\\\\\\\\\\\\x80-\\\\xff]*\\\\\\":[0-9]+:\\\\{~"}], "cve": "CVE-2024-54282", "description": "WP Mega Menu <=1.4.2 PHP object injection via wp-megamenu admin import/export pages (CWE-502)", "mode": "block", "severity": 7.2, "slug": "wp-megamenu", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-5441-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:mec[featured_image]", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|tml?|ar|t)|shtml?|cgi|fcgi|asp|aspx|jsp|exe|bash|ht(?:access|passwd))(?:[?#/]|$)~i"}], "cve": "CVE-2024-5441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5441", "description": "Modern Events Calendar Lite <=6.5.6 arbitrary file upload via mec[featured_image] URL parameter in wp_ajax(_nopriv)_mec_fes_form \\u2014 set_featured_image() downloads attacker URL unchecked (CWE-434)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "modern-events-calendar-lite", "target": "plugin", "versions": "<=6.5.6"}, "RULE-CVE-2024-5450-01": {"action": "init", "conditions": [{"name": "ARGS:new-bug-title", "type": "exists"}, {"name": "FILES:attachimage", "type": "exists"}], "cve": "CVE-2024-5450", "method": "POST", "mode": "block", "severity": 9.1, "slug": "bug-library", "target": "plugin", "versions": "<2.1.1"}, "RULE-CVE-2024-5501-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~button_(?:one|two)_id\\\\s*=\\\\s*(?:\\"|%22)(?:[^\\"]*?)(?:on(?:mouse(?:over|enter|leave|down|up|move)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|animation(?:start|end|iteration)|transition(?:end|run))|(?:</|%3[Cc]/)\\\\s*\\\\w|(?:<|%3[Cc])\\\\s*(?:script|img|svg|iframe|object|embed|form|input|details|video|audio|body|marquee|isindex|meta)(?:[\\\\s/>]|%(?:20|3[Ee]|2[Ff]))|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-5501", "description": "Supreme Modules Lite <=2.5.51 contributor+ stored XSS via button_one_id/button_two_id shortcode attributes in post content", "mode": "block", "severity": 6.4, "slug": "supreme-modules-for-divi", "target": "plugin", "versions": "<=2.5.51"}, "RULE-CVE-2024-5522-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video/v1/singlevideo~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s+\'|--\\\\s*$)~i"}], "cve": "CVE-2024-5522", "description": "Blocks unauthenticated SQL injection via the \'id\' parameter on the REST route /wp-json/video/v1/singlevideo. The vulnerable plugin passes the id parameter to a SQL query without sanitization or use of $wpdb->prepare(). The fix applies input validation/sanitization. This rule detects SQL injection payloads in the id parameter on the public REST endpoint.", "mode": "block", "severity": 6.5, "slug": "html5-video-player", "target": "plugin", "versions": "<2.5.27"}, "RULE-CVE-2024-56226-01": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|keygen|base)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_ajax_search_link_target parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_no_results", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_no_results parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-03": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_view_result_text parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56226-04": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|button|select|textarea|form)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2024-56226", "description": "Royal Elementor Addons <=1.7.1001 unauthenticated reflected XSS via wpr_number_of_words parameter in AJAX search handler", "mode": "block", "severity": 7.1, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1001"}, "RULE-CVE-2024-56276-01": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-56276", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.9.2.2"}, "RULE-CVE-2024-56288-01": {"ajax_action": "wpdocs_update_option", "conditions": [{"name": "ARGS:wpd_home_id", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-56288-02": {"ajax_action": "wpdocs_update_option", "conditions": [{"name": "ARGS:wpd_get_permalink", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-56288-03": {"ajax_action": "wpdocs_update_folder", "conditions": [{"name": "ARGS:new_name", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-56288", "method": "POST", "mode": "block", "severity": 4.8, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-5667-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5667-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-featherlight[^=]*\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*?(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5667", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2024-5756-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:db", "type": "detectSQLi"}], "cve": "CVE-2024-5756", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-5756", "description": "Email Subscribers by Icegram Express <=5.7.23 unauthenticated SQL injection via db parameter in icegram-express AJAX handler", "mode": "block", "severity": 9.8, "slug": "email-subscribers", "tags": ["sql-injection", "unauthenticated", "time-based-sqli"], "target": "plugin", "versions": "<=5.7.23"}, "RULE-CVE-2024-5853-01": {"ajax_action": "sirv_upload_file_by_chanks", "conditions": [{"name": "ARGS:partFileName", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)~i"}], "cve": "CVE-2024-5853", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sirv", "target": "plugin", "versions": "<=7.2.6"}, "RULE-CVE-2024-5901-01": {"ajax_action": "so_widgets_setting_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:load|error|click|mouseover|mouseout|focus|blur|submit|change|input|keydown|keyup|keypress|toggle|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|<\\\\s*(?:iframe|svg|img|object|embed|form|math|video|audio|source|details|marquee|body|style|link|meta|base)[\\\\s/>]|srcdoc\\\\s*=|formaction\\\\s*=)~i"}], "cve": "CVE-2024-5901", "description": "SiteOrigin Widgets Bundle <=1.62.2 contributor+ stored XSS in Image Grid widget via so_widgets_setting_save instance attributes", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.62.2"}, "RULE-CVE-2024-5901-02": {"ajax_action": "so_widgets_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:load|error|click|mouseover|mouseout|focus|blur|submit|change|input|keydown|keyup|keypress|toggle|animationend)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|<\\\\s*(?:iframe|svg|img|object|embed|form|math|video|audio|source|details|marquee|body|style|link|meta|base)[\\\\s/>]|srcdoc\\\\s*=|formaction\\\\s*=)~i"}], "cve": "CVE-2024-5901", "description": "SiteOrigin Widgets Bundle <=1.62.2 contributor+ stored XSS in Image Grid widget via so_widgets_preview instance attributes", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "target": "plugin", "versions": "<=1.62.2"}, "RULE-CVE-2024-5932-02": {"action": "init", "conditions": [{"name": "ARGS:give_title", "type": "exists"}, {"name": "ARGS:give_title", "type": "regex", "value": "~(^|;)O:[0-9]+:\\\\\\"[A-Za-z0-9_\\\\\\\\]+\\\\\\\\TCPDF\\\\\\":~"}], "cve": "CVE-2024-5932", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-5940-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "POST", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-01-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/event/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "POST", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5940-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/events-tickets/ticket-type/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-5940", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5941-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/give-api/v2/donor-dashboard/avatar(?:/|\\\\?|$)|(?:^|[?&])rest_route=/give-api/v2/donor-dashboard/avatar)~i"}, {"name": "ARGS:avatarId", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2024-5941", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2024-5977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "POST", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-5977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/give-api/v2/admin/forms/(trash|restore|delete|duplicate|edit)(/|\\\\?|$)~i"}, {"name": "ARGS:ids", "type": "exists"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2024-5977", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "give", "target": "plugin", "versions": "<=3.13.0"}, "RULE-CVE-2024-6028-01": {"action": "init", "conditions": [{"name": "ARGS:ays_questions", "type": "regex", "value": "~(?:[^0-9, ].*[^0-9, ]|(?:UNION|SELECT|SLEEP|BENCHMARK|OR|AND|INSERT|UPDATE|DELETE|DROP|CONCAT|CHAR|0x[0-9a-fA-F]{2}|/\\\\*|\\\\*/|--)\\\\s)~i"}], "cve": "CVE-2024-6028", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.5.8.3"}, "RULE-CVE-2024-6088-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/learnpress/v1/(?:users/)?register(?:[/?&#]|$)|[?&]rest_route=/learnpress/v1/(?:users/)?register(?:[/?&#]|$))~i"}], "cve": "CVE-2024-6088", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.1"}, "RULE-CVE-2024-6265-01": {"action": "init", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by parameter on front-end users page", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6265-02": {"ajax_action": "uwp_ajax_user_sorting_action", "conditions": [{"name": "ARGS:uwp_sort_by", "type": "detectSQLi"}], "cve": "CVE-2024-6265", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6265", "description": "UsersWP <=1.2.10 unauthenticated SQL injection via uwp_sort_by on AJAX user sorting handler", "mode": "block", "severity": 9.8, "slug": "userswp", "tags": ["sql-injection", "unauthenticated", "order-by-injection", "ajax"], "target": "plugin", "versions": "<=1.2.10"}, "RULE-CVE-2024-6328-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6328-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/firebase_sms_login_v2(/|\\\\?|&|$)~"}], "cve": "CVE-2024-6328", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mstore-api", "target": "plugin", "versions": "<=4.14.7"}, "RULE-CVE-2024-6330-01": {"ajax_action": "gmw_info_window_init", "conditions": [{"name": "ARGS:form[info_window_template][content_path]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[a-z]+://|^/)~i"}], "cve": "CVE-2024-6330", "method": "POST", "mode": "block", "severity": 9.8, "slug": "geo-my-wp", "target": "plugin", "versions": "<4.5.0.2"}, "RULE-CVE-2024-6365-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"name": "ARGS:settings[order]", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings[order] written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6365-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wootablepress"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\?(?:php|=|\\\\s)|\\\\?>|<%|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bproc_open\\\\b|\\\\bpopen\\\\b|\\\\bbase64_decode\\\\b~i"}], "cve": "CVE-2024-6365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6365", "description": "Product Table by WBW <=2.0.1 unauthenticated RCE via PHP code injection in settings phrase parameters written to customTitle.php", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woo-product-tables", "tags": ["remote-code-execution", "arbitrary-file-write", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2024-6366-02": {"ajax_action": "query-attachments", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2024-6366", "method": "POST", "mode": "block", "severity": 9.1, "slug": "profile-builder", "target": "plugin", "versions": "<=3.11.7"}, "RULE-CVE-2024-6451-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~\\\\.(?:php|php[0-9]+|phtml)\\\\b~i"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6451-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/options.php"}, {"name": "ARGS:logs_path", "type": "exists"}, {"name": "ARGS:logs_path", "type": "regex", "value": "~^(?![^\\\\n]*\\\\.log$)[^\\\\n]+$~"}], "cve": "CVE-2024-6451", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2024-6455-01": {"ajax_action": "ekit_widgetarea_content", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6455", "description": "ElementsKit Lite <=3.2.0 unauthenticated information exposure via ekit_widgetarea_content AJAX action exposing drafts, pending and private posts", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2024-6460-01": {"ajax_action": "tm_load_data", "conditions": [{"name": "ARGS:component", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|(?:php|data|expect|phar|zip)://)~i"}], "cve": "CVE-2024-6460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6460", "description": "Grow by Tradedoubler <=2.0.21 unauthenticated Local File Inclusion via tm_load_data AJAX component parameter", "mode": "block", "severity": 9.8, "slug": "tradedoubler-affiliate-tracker", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.0.21"}, "RULE-CVE-2024-6500-01": {"action": "parse_request", "conditions": [{"name": "ARGS:easypack_download", "type": "regex", "value": "~(\\\\.\\\\.(?:[/\\\\\\\\]|%2f|%5c)|%2e(?:%2e|\\\\.(?:%2f|%5c|[/\\\\\\\\]))|%2e%2e(?:%2f|/|%5c|\\\\\\\\)|^/|^[A-Za-z]:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6500", "description": "InPost for WooCommerce <=1.4.4 unauthenticated arbitrary file read/delete via easypack_download query var", "mode": "block", "severity": 10.0, "slug": "inpost-for-woocommerce", "tags": ["missing-authorization", "path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2024-6522-01": {"ajax_action": "mec_fes_form", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"name": "ARGS:name", "type": "exists"}, {"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2024-6522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6522", "description": "Modern Events Calendar Lite <=7.12.1 authenticated (subscriber+) SSRF via mec_fes_form AJAX action", "method": "POST", "mode": "block", "severity": 9.6, "slug": "modern-events-calendar-lite", "tags": ["ssrf", "server-side-request-forgery", "authenticated", "cwe-918"], "target": "plugin", "versions": "<=7.12.1"}, "RULE-CVE-2024-6589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "POST", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6589-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/\\\\d+)?$~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:learnpress/[^>]*\\"template\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\.\\\\./|\\\\.\\\\.\\\\\\\\)[^\\"]*\\"~i"}], "cve": "CVE-2024-6589", "method": "PATCH", "mode": "block", "severity": 8.8, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.8.2"}, "RULE-CVE-2024-6624-01": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-01G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-02G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-03G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-04G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-05G": {"action": "init", "conditions": [{"name": "ARGS:json", "type": "regex", "value": "~user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-06G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-07G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/register~i"}, {"name": "ARGS:custom_fields[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-08G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(capabilities|user_level)$~i"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-09G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "POST", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6624-10G": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/user/update_user_meta~i"}, {"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2024-6624", "method": "GET", "mode": "block", "severity": 9.8, "slug": "json-api-user", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2024-6660-01": {"ajax_action": "bookingpress_import_data_continue_process_func", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-6660", "description": "BookingPress <=1.1.5 missing authorization on bookingpress_import_data_continue_process_func allows subscriber+ arbitrary options update and file upload", "mode": "block", "severity": 8.8, "slug": "bookingpress-appointment-booking", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2024-6691-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php$~"}, {"name": "ARGS:option_page", "type": "equals", "value": "edd_settings"}], "cve": "CVE-2024-6691", "method": "POST", "mode": "block", "severity": 4.0, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:edd_settings[agree_text]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-6692", "method": "POST", "mode": "block", "severity": 3.1, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2024-6704-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-02": {"ajax_action": "wpdAddInlineComment", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via comment parameter in wpdAddInlineComment AJAX handler", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6704-03": {"ajax_action": "wpdGuestAction", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseenter|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-6704", "description": "wpDiscuz <=7.6.21 unauthenticated stored XSS via guest comment submission", "mode": "block", "severity": 6.1, "slug": "wpdiscuz", "target": "plugin", "versions": "<=7.6.21"}, "RULE-CVE-2024-6723-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[accessor]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.accessor in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in admin discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6723-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai-ui/v1/discussions/list(/|\\\\?|$)~"}, {"name": "ARGS:sort[by]", "type": "regex", "value": "~[^a-zA-Z0-9_]~"}], "cve": "CVE-2024-6723", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6723", "description": "AI Engine <2.4.8 SQL injection via sort.by in public discussions REST endpoint", "method": "POST", "mode": "block", "severity": 4.7, "slug": "ai-engine", "tags": ["sql-injection", "rest-api"], "target": "plugin", "versions": "<2.4.8"}, "RULE-CVE-2024-6809-01": {"ajax_action": "qcsmd_upvote_action", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-6809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-6809", "description": "Simple Video Directory <=1.4.2 unauthenticated SQL injection via id parameter in qcsmd_upvote_action AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "simple-media-directory", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2024-6849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/async-upload\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (async-upload.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/media-new\\\\.php~"}, {"name": "FILES:async-upload:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:async-upload:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (media-new.php)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-6849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|mousedown)\\\\s*=|javascript\\\\s*:|<foreignObject[\\\\s/>])~i"}], "cve": "CVE-2024-6849", "description": "Preloader Plus <=2.2.1 stored XSS via unsanitized SVG file upload (REST /wp/v2/media)", "mode": "block", "severity": 6.4, "slug": "preloader-plus", "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2024-7031-01": {"ajax_action": "njt_fs_save_setting_restrictions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7031-02": {"ajax_action": "njt_fs_save_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7031", "method": "POST", "mode": "block", "severity": 8.8, "slug": "filester", "target": "plugin", "versions": "<=1.8.2"}, "RULE-CVE-2024-7094-01": {"action": "init", "conditions": [{"name": "ARGS:form_request", "type": "equals", "value": "jssupportticket"}, {"name": "ARGS:jstmod", "type": "equals", "value": "themes"}, {"name": "ARGS:task", "type": "equals", "value": "savetheme"}, {"name": "ARGS:/color[1-7]/", "type": "regex", "value": "~[\\"\'`;]|<\\\\?(?:php|=)|[$][a-zA-Z_]~"}], "cve": "CVE-2024-7094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7094", "description": "JS Help Desk <=2.8.6 unauthorized frontend savetheme dispatch via formhandler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "js-support-ticket", "tags": ["missing-authorization", "code-injection", "frontend-form"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-7122-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor AJAX save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7122-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:separator_title|button_text(?:_2)?|image_[12]_label|alt_text)[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-7122", "description": "Addon Elements for Elementor <=1.13.6 contributor+ stored XSS via unescaped widget attributes in Elementor REST save", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "target": "plugin", "versions": "<=1.13.6"}, "RULE-CVE-2024-7257-01": {"ajax_action": "yaye_handle_upload_file", "conditions": [{"name": "FILES:option_field_data", "type": "exists"}], "cve": "CVE-2024-7257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7257", "description": "YayExtra \\u2013 WooCommerce Extra Product Options <=1.3.7 unauthenticated arbitrary file upload via yaye_handle_upload_file AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yayextra", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2024-7258-01": {"ajax_action": "myajax-delete-feed-file", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed file deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7258-02": {"ajax_action": "myajax-delete-feed", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:feed_id", "type": "exists"}], "cve": "CVE-2024-7258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7258", "description": "WP Product Feed Manager <=2.8.0 unauthenticated feed deletion via missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-product-feed-manager", "tags": ["missing-authorization", "idor"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2024-7302-01": {"ajax_action": "b2s_upload_video", "conditions": [{"name": "ARGS:post_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouse(?:down|up|over|out|move)|key(?:down|up|press)|focus|blur|change|submit|reset|select|abort|dragstart|drag|dragend|drop)\\\\s*=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2024-7302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7302", "description": "Blog2Social <=7.5.4 stored XSS via post_title in video upload", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=7.5.4"}, "RULE-CVE-2024-7315-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/[^/]+\\\\.(?:zip|sql|gz|tar|json|txt|log)(?:\\\\?|$)~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7315-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-content/wpvividbackups/wpvivid_log/~i"}], "cve": "CVE-2024-7315", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<0.9.106"}, "RULE-CVE-2024-7385-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wshs_saved"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 authenticated (Admin+) SQL injection via id parameter in wshs_saved delete action", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7385-02": {"ajax_action": "wshs_save_shortcode", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2024-7385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7385", "description": "WordPress Simple HTML Sitemap <=3.1 SQL injection via id parameter in wshs_save_shortcode AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-simple-html-sitemap", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2024-7493-01": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:role", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via role parameter in registration", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-02": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_capabilities", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7493-03": {"ajax_action": "wpcom_register", "conditions": [{"name": "ARGS:meta_input[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-7493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7493", "description": "WPCOM Member <=1.5.2.1 unauthenticated privilege escalation via meta_input wp_user_level", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "tags": ["privilege-escalation", "unauthenticated", "mass-assignment"], "target": "plugin", "versions": "<=1.5.2.1"}, "RULE-CVE-2024-7514-01": {"ajax_action": "product_comments_csv_import_request", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2[Ee]){2}%2[Ff]|(?:%252[Ee]){2}%25(?:2[Ff]|5[Cc])|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2024-7514", "description": "Comments Import & Export <=2.3.7 authenticated arbitrary file read via path traversal in file parameter", "mode": "block", "severity": 6.5, "slug": "comments-import-export-woocommerce", "target": "plugin", "versions": "<=2.3.7"}, "RULE-CVE-2024-7548-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7548-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_featured_courses[^\\\\]]*order\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:select|sleep|benchmark|union|concat|if\\\\s*\\\\(|0x|/\\\\*|;|\\\\()[^\\"\']*[\\"\']~i"}], "cve": "CVE-2024-7548", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.6.9.3"}, "RULE-CVE-2024-7590-01": {"ajax_action": "uag_load_image_gallery_masonry", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7590-02": {"ajax_action": "uag_load_image_gallery_grid_pagination", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-7590", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.15.0"}, "RULE-CVE-2024-7607-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "feup-users"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2024-7607", "description": "Front End Only Users <=3.2.28 authenticated SQL injection via order parameter on feup-users admin page", "mode": "block", "severity": 8.8, "slug": "front-end-only-users", "target": "plugin", "versions": "<=3.2.28"}, "RULE-CVE-2024-7656-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|&quot;|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via devvn_ihotspot shortcode unserialize sink \\u2014 write-time block on content param", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7656-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~devvn_ihotspot[\\\\s\\\\S]{0,2000}?[OC]:[0-9]+:(?:\\\\\\\\?\\"|&quot;|%22)~i"}], "cve": "CVE-2024-7656", "description": "Image Hotspot by DevVN <=1.2.5 authenticated (Author+) PHP Object Injection via post_content carrying devvn_ihotspot serialized object", "mode": "block", "severity": 8.8, "slug": "devvn-image-hotspot", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2024-7703-01": {"ajax_action": "arm_upload_front", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_front", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-02": {"ajax_action": "arm_upload_cover", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_cover", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-03": {"ajax_action": "arm_upload_profile", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file upload in arm_upload_profile", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7703-04": {"ajax_action": "arm_import_user", "conditions": [{"name": "FILES:file:type", "type": "regex", "value": "~^image/svg~i"}, {"name": "FILES:file:content", "type": "regex", "value": "~(<script[\\\\s/>]|on(?:load|error|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2024-7703", "description": "ARMember <=4.0.37 stored XSS via SVG file import in arm_import_user", "mode": "block", "severity": 6.4, "slug": "armember-membership", "target": "plugin", "versions": "<=4.0.37"}, "RULE-CVE-2024-7770-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~file-manager/libs/elFinder/php/connector~i"}, {"name": "FILES:upload:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$~i"}], "cve": "CVE-2024-7770", "description": "Bit File Manager <=6.5.5 block direct access to elFinder connector with dangerous file upload", "mode": "block", "severity": 8.8, "slug": "file-manager", "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2024-7856-01": {"ajax_action": "removeTempFiles", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-7856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7856", "description": "MP3 Music Player by Sonaar <=5.7.0.1 missing authorization (subscriber+) arbitrary file deletion via removeTempFiles AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mp3-music-player-by-sonaar", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=5.7.0.1"}, "RULE-CVE-2024-7857-01": {"ajax_action": "mlf_change_sort_type", "conditions": [{"name": "ARGS:sort_type", "type": "detectSQLi"}], "cve": "CVE-2024-7857", "method": "POST", "mode": "block", "severity": 6.5, "slug": "media-library-plus", "target": "plugin", "versions": "<=8.2.2"}, "RULE-CVE-2024-7982-01": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:first_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via first_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7982-02": {"ajax_action": "rtec_process_form_submission", "conditions": [{"name": "ARGS:last_name", "type": "detectXSS"}], "cve": "CVE-2024-7982", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7982", "description": "Registrations for the Events Calendar <=2.12.3 unauthenticated stored XSS via last_name in registration form submission", "method": "POST", "mode": "block", "severity": 9.6, "slug": "registrations-for-the-events-calendar", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.12.3"}, "RULE-CVE-2024-7985-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "upload"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess)$~i"}], "cve": "CVE-2024-7985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-7985", "description": "File Organizer <=1.0.9 authenticated arbitrary file upload via filename extension bypass", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["arbitrary-file-upload", "authenticated", "file-upload"], "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2024-8252-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in post content (post.php)", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8252-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[clean-login-register[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*\\\\.\\\\.[/\\\\\\\\]~i"}], "cve": "CVE-2024-8252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8252", "description": "Clean Login <=1.14.5 authenticated (Contributor+) local file inclusion via clean-login-register shortcode template attribute in REST API post creation", "mode": "block", "severity": 8.8, "slug": "clean-login", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.14.5"}, "RULE-CVE-2024-8271-01": {"ajax_action": "woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (custom_prices parameter flows to do_shortcode at classes/woocs.php:4600)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8271-02": {"ajax_action": "nopriv_woocs_get_custom_price_html", "conditions": [{"name": "ARGS:custom_prices", "type": "regex", "value": "~(?:\\\\[[a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|\\\\]|/)|%5[Bb][a-zA-Z][a-zA-Z0-9_\\\\-]*(?:\\\\s|%5[Dd]|/)|%25[57]5[Bb][a-zA-Z])~"}], "cve": "CVE-2024-8271", "description": "WooCommerce Currency Switcher <=1.4.2.1 unauthenticated arbitrary shortcode execution via woocs_get_custom_price_html AJAX action (nopriv hook)", "mode": "block", "severity": 7.3, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.2.1"}, "RULE-CVE-2024-8275-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|EXTRACTVALUE\\\\s*\\\\(|CONCAT\\\\s*\\\\(|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2024-8275", "description": "The Events Calendar <=6.6.4 unauthenticated SQL injection via order parameter in tribe_has_next_event template tag", "method": "GET", "mode": "block", "severity": 9.8, "slug": "the-events-calendar", "target": "plugin", "versions": "<=6.6.4"}, "RULE-CVE-2024-8289-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/?(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PUT", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "PATCH", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_users"}], "cve": "CVE-2024-8289", "method": "DELETE", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8289-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mvx/v1/vendors/batch(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2024-8289", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2024-8353-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address_2", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_city", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_state", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_zip", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_name", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_number", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-09": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_cvc", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-10": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_month", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-11": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_exp_year", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-12": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:billing_country", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-13": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-14": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8353-15": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "regex", "value": "~[oOcCaA]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2024-8353", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<3.16.2"}, "RULE-CVE-2024-8485-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/watch-life-net/v1/weixin/updateuserinfo(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2024-8485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8485", "description": "REST API TO MiniProgram <=4.7.1 unauthenticated arbitrary user email update and privilege escalation via updateuserinfo REST endpoint IDOR", "method": "POST", "mode": "block", "severity": 9.8, "slug": "rest-api-to-miniprogram", "tags": ["authorization-bypass", "idor", "privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.7.6"}, "RULE-CVE-2024-8500-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|toggle|animationstart)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS via su_generator_preview shortcode/atts/content parameters reaching echo sink in Su_Generator::preview", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8500-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]*on|<\\\\s*img[^>]+onerror)~i"}], "cve": "CVE-2024-8500", "description": "Shortcodes Ultimate <=7.2.2 Contributor+ XSS/code-flow via su_generator_settings shortcode parameter reaching echo/call_user_func sinks", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.2.2"}, "RULE-CVE-2024-8519-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "um_loggedin"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|toggle|begin|end)\\\\s*=|javascript\\\\s*:|<\\\\s*iframe[\\\\s>]|<\\\\s*svg[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-8519", "description": "Ultimate Member <=2.8.6 stored XSS via um_loggedin shortcode lock_text attribute or inner content", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2024-8522-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/learnpress/v1/courses~"}, {"name": "ARGS:c_only_fields", "type": "regex", "value": "~(?i)(SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\(SELECT\\\\b|UNION\\\\s+SELECT\\\\b)~"}], "cve": "CVE-2024-8522", "description": "LearnPress <=4.2.7 unauthenticated SQL injection via c_only_fields parameter in REST courses endpoint.", "method": "GET", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.1"}, "RULE-CVE-2024-8800-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)(%3Cscript|<script\\\\b|javascript:|<[^>]*onerror\\\\s*=|<[^>]*onload\\\\s*=|<[^>]*onclick\\\\s*=|\\\\bonerror\\\\s*=|\\\\bonload\\\\s*=|\\\\bonclick\\\\s*=|%22%3E|%27%3E)~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8800-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "rabbit-loader"}, {"name": "ARGS", "type": "regex", "value": "~(?i)%3cscript|<img\\\\b[^>]*onerror\\\\s*=|<a\\\\b[^>]*href\\\\s*=\\\\s*[\'\\"]javascript:~"}], "cve": "CVE-2024-8800", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rabbit-loader", "target": "plugin", "versions": "<=2.21.0"}, "RULE-CVE-2024-8853-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:user_login", "type": "contains", "value": "-wfuser"}], "cve": "CVE-2024-8853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-8853", "description": "Webo-facto <=1.40 unauthenticated privilege escalation via user_login containing -wfuser substring", "method": "POST", "mode": "block", "severity": 9.8, "slug": "webo-facto-connector", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.40"}, "RULE-CVE-2024-8978-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(\\\\{\\\\{password\\\\}\\\\}|%7B%7Bpassword%7D%7D)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-8978", "method": "POST", "mode": "block", "severity": 5.7, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-8979-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|eael_get_token|save_settings_with_ajax|save_eael_elements_data)$~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[user_password\\\\]~i"}], "cve": "CVE-2024-8979", "description": "Essential Addons for Elementor Lite <=6.0.9 sensitive information disclosure via [user_password] placeholder in lostpassword email template (Login_Register widget)", "mode": "block", "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.9"}, "RULE-CVE-2024-9061-01": {"ajax_action": "shortcode_Api_Add", "conditions": [{"name": "ARGS:custom-popup", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9061", "description": "WP Popup Builder <=1.3.5 unauthenticated arbitrary shortcode execution via custom-popup parameter", "mode": "block", "severity": 9.8, "slug": "wp-popup-builder", "target": "plugin", "versions": "<=1.3.5"}, "RULE-CVE-2024-9263-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timetics/v1/customers(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9263", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9263", "description": "WP Timetics <=1.0.25 unauthenticated account takeover via IDOR on REST customers endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "timetics", "tags": ["idor", "account-takeover", "unauthenticated", "rest-api", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.25"}, "RULE-CVE-2024-9390-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_status", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_interval", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9390-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^rm_ex_~"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:<[^>]*\\\\son\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|applet|base|link|meta|style|svg|math|body|video|audio|details|form|input|select|textarea|button|marquee)\\\\b|javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}], "cve": "CVE-2024-9390", "method": "GET", "mode": "block", "severity": 4.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<6.0.2.1"}, "RULE-CVE-2024-9416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "modula-gallery"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via FancyBox attributes in gallery CPT settings", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9416-02": {"ajax_action": "add_images_to_gallery", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9416", "description": "Modula Image Gallery <=2.10.1 contributor+ stored XSS via add_images_to_gallery AJAX handler", "mode": "block", "severity": 6.4, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.10.1"}, "RULE-CVE-2024-9501-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu-social-login/type/[^/]+(/|\\\\?|$)~"}, {"name": "ARGS:code", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9501", "description": "Wp Social Login and Register Social Counter <=3.0.7 authentication bypass via social login OAuth callback REST route", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wp-social", "tags": ["authentication-bypass", "unauthenticated", "rest-api", "oauth"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2024-9504-01": {"ajax_action": "wpdevart_form_ajax", "conditions": [{"name": "FILES:file0", "type": "exists"}], "cve": "CVE-2024-9504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9504", "description": "Booking Calendar <=3.2.15 unauthenticated stored XSS via SVG file upload in wpdevart_form_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "booking-calendar", "tags": ["xss", "svg-upload", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2024-9598-01": {"ajax_action": "redux_p", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9598", "description": "AMP for WP CSRF via missing nonce validation on redux_p AJAX proxy endpoint", "mode": "block", "severity": 8.8, "slug": "accelerated-mobile-pages", "target": "plugin", "versions": "<=1.0.99.1"}, "RULE-CVE-2024-9634-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9634-02": {"action": "init", "conditions": [{"name": "ARGS:give_action", "type": "equals", "value": "purchase"}, {"name": "ARGS:give_company_name", "type": "regex", "value": "~(^\\\\s*|[;{]\\\\s*)O:\\\\d+:\\"~"}], "cve": "CVE-2024-9634", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.16.3"}, "RULE-CVE-2024-9636-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_capabilities]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9636-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid/v2/process_form_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_meta[wp_user_level]", "type": "exists"}], "cve": "CVE-2024-9636", "method": "POST", "mode": "block", "severity": 9.8, "slug": "post-grid", "target": "plugin", "versions": ">=2.2.85 <=2.3.3"}, "RULE-CVE-2024-9655-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v[12]/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in REST API post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9655-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/(?:single-)?icon[^}]*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9655", "description": "Kadence Blocks <=3.3.1 authenticated (Contributor+) stored XSS via Icon Widget block attributes in classic editor post save", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2024-9669-01": {"ajax_action": "njt_fs_save_setting", "conditions": [{"name": "ARGS:fm_locale", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.|%2e%2e[%2f%5c]|%252e%252e|%00)~i"}], "cve": "CVE-2024-9669", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9669", "description": "Filester <=1.8.5 local file inclusion via fm_locale path traversal in njt_fs_save_setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "filester", "tags": ["local-file-inclusion", "path-traversal"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2024-9707-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ai/v1/ai-site-import(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9707", "method": "POST", "mode": "block", "severity": 9.8, "slug": "hunk-companion", "target": "plugin", "versions": "<=1.8.4"}, "RULE-CVE-2024-9769-01": {"ajax_action": "tsvg_check_attachment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9769-02": {"ajax_action": "tsvg_get_attachment_id", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2024-9769", "method": "POST", "mode": "block", "severity": 4.4, "slug": "gallery-videos", "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2024-9881-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "learn-press-settings"}, {"name": "ARGS:learn_press_offline_payment[description]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9881", "method": "POST", "mode": "block", "severity": 4.8, "slug": "learnpress", "target": "plugin", "versions": "<4.2.7.2"}, "RULE-CVE-2024-9935-01": {"action": "init", "conditions": [{"name": "ARGS:rtw_pdf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2024-9935", "description": "PDF Generator Addon for Elementor Page Builder <=2.0.0 local file inclusion via rtw_pdf_file parameter", "mode": "block", "severity": 7.5, "slug": "pdf-generator-addon-for-elementor-page-builder", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2024-9993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_event_details_text"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_event_details_text in Event Calendar widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|input|change|keyup|keydown|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2024-9993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9993", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2024-9994-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "eael_pricing_item_tooltip_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<(?:script|img|svg|iframe|details|video|audio|source)[\\\\s/>]|on(?:error|load|toggle|click|mouse\\\\w+|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2024-9994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-9994", "description": "Essential Addons for Elementor <=6.1.12 contributor+ stored XSS via eael_pricing_item_tooltip_content in Pricing Table widget", "mode": "block", "severity": 5.4, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.12"}, "RULE-CVE-2025-0215-01": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:uri", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via uri parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-02": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:initiate_restore", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via initiate_restore parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0215-03": {"ajax_action": "updraft_ajax", "conditions": [{"name": "ARGS:showdata", "type": "detectXSS"}], "cve": "CVE-2025-0215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0215", "description": "UpdraftPlus <= 1.24.12 Reflected XSS via showdata parameter in updraft_ajax handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "updraftplus", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.24.12"}, "RULE-CVE-2025-0308-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|SL(?:/\\\\*[^*]*\\\\*/)?EEP\\\\s*\\\\()~i"}, {"name": "ARGS:search", "type": "regex", "value": "~(?i)(\\\\b(sleep|benchmark|union|select|if)\\\\b|--|/\\\\*|#|;)~i"}], "cve": "CVE-2025-0308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0308", "description": "Ultimate Member <=2.9.1 unauthenticated SQL injection via search parameter in um_get_members AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2025-0311-01": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL (javascript:/data: URI injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-02": {"action": "admin_init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~button_link[^}]*url[^}]*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget button_link URL through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0311-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|subtitle_tag)[^}]*(?:script|img|svg|iframe|body|object|embed|form|input|select|textarea|details|marquee|video|audio|math|base|link|meta|style|applet|isindex|frame|frameset|bgsound|keygen|source|layer|ilayer|blink|plaintext|listing|xmp|noembed|noscript|xml|xss)~i"}], "cve": "CVE-2025-0311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0311", "description": "Orbit Fox by ThemeIsle <=2.10.43 Stored XSS via Pricing Table widget title_tag/subtitle_tag through REST API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.10.43"}, "RULE-CVE-2025-0329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpbot"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via admin settings page (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-03": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (event handler injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0329-04": {"ajax_action": "openai_settings_option", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe)[^>]*>~i"}], "cve": "CVE-2025-0329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0329", "description": "AI ChatBot WPBot <6.2.4 Stored XSS via openai_settings_option AJAX (script/iframe tag injection)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "chatbot", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<6.2.4"}, "RULE-CVE-2025-0350-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wdcl_image_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Image Carousel widget attributes in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0350-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wdcl_logo_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Logo Carousel widget attributes in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0350-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wdcl_image_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Image Carousel widget attributes in content param", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0350-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wdcl_logo_carousel_child\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|mouseleave)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0350", "description": "Divi Carousel Lite <=2.0.4 Stored XSS via Logo Carousel widget attributes in content param", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-carousel-for-divi-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-0357-01": {"ajax_action": "wpb_ajax_post", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "edit_profile_data"}, {"name": "FILES:avatar", "type": "exists"}], "cve": "CVE-2025-0357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0357", "description": "WPBookit <1.6.10 unauthenticated arbitrary file upload via edit_profile_data avatar", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpbookit", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<1.6.10"}, "RULE-CVE-2025-0365-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.{2}[\\\\/\\\\\\\\]|[\\\\/\\\\\\\\])+(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|(?:^|[\\\\/\\\\\\\\\\"\'\\\\s])\\\\.env(?:$|[\\\\/\\\\\\\\\\"\'\\\\s])|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-0365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0365", "description": "JupiterX Core <=4.8.7 authenticated (Contributor+) arbitrary file read via path traversal in Elementor widget settings (actions param)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "tags": ["path-traversal", "local-file-inclusion", "authenticated", "elementor-widget"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0365-02": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\.{2}[\\\\/\\\\\\\\]|[\\\\/\\\\\\\\])+(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|(?:^|[\\\\/\\\\\\\\\\"\'\\\\s])\\\\.env(?:$|[\\\\/\\\\\\\\\\"\'\\\\s])|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-0365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0365", "description": "JupiterX Core <=4.8.7 authenticated (Contributor+) arbitrary file read via path traversal in Elementor data param", "method": "POST", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "tags": ["path-traversal", "local-file-inclusion", "authenticated", "elementor-widget"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0366-01": {"ajax_action": "raven_form_frontend", "conditions": [{"name": "FILES:form_fields:content", "type": "regex", "value": "~<\\\\?(?:php|=)|<script\\\\b|shell_exec\\\\s*\\\\(|base64_decode\\\\s*\\\\(|system\\\\s*\\\\(|passthru\\\\s*\\\\(|eval\\\\s*\\\\(~i"}], "cve": "CVE-2025-0366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0366", "description": "Jupiter X Core <=4.8.7 SVG file upload with embedded PHP via raven_form_frontend AJAX handler (LFI-to-RCE chain stage 1)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["local-file-inclusion", "remote-code-execution", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0366-02": {"ajax_action": "raven_control_file_upload", "conditions": [{"name": "FILES:form_fields:content", "type": "regex", "value": "~<\\\\?(?:php|=)|<script\\\\b|shell_exec\\\\s*\\\\(|base64_decode\\\\s*\\\\(|system\\\\s*\\\\(|passthru\\\\s*\\\\(|eval\\\\s*\\\\(~i"}], "cve": "CVE-2025-0366", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0366", "description": "Jupiter X Core <=4.8.7 SVG file upload with embedded PHP via raven_control_file_upload AJAX handler (LFI-to-RCE chain stage 1)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["local-file-inclusion", "remote-code-execution", "file-upload"], "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-0370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with dangerous URI scheme (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0370-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with dangerous URI scheme (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0370-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with event handler injection (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0370-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox\\\\b[^\\\\]]*\\\\bsrc\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-0370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0370", "description": "Shortcodes Ultimate <=7.3.3 Stored XSS via [su_lightbox] shortcode src attribute with event handler injection (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.3.3"}, "RULE-CVE-2025-0393-01": {"ajax_action": "wpr_filter_grid_posts", "conditions": [{"name": "ARGS:grid_settings", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#~i"}], "cve": "CVE-2025-0393", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0393", "description": "Royal Elementor Addons <=1.7.1006 CSRF to Reflected XSS via wpr_filter_grid_posts grid_settings parameter", "mode": "block", "severity": 6.1, "slug": "royal-elementor-addons", "tags": ["xss", "csrf", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1006"}, "RULE-CVE-2025-0428-01": {"ajax_action": "wpaicg_import_prompts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-0428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0428", "description": "AI Power Complete AI Pack <=1.8.96 PHP Object Injection payload injection attempt via wpaicg_import_prompts", "method": "POST", "mode": "block", "severity": 7.2, "slug": "gpt3-ai-content-generator", "tags": ["object-injection", "deserialization", "php-object-injection", "ajax"], "target": "plugin", "versions": "<=1.8.96"}, "RULE-CVE-2025-0428-02": {"ajax_action": "wpaicg_export_prompts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-0428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0428", "description": "AI Power Complete AI Pack <=1.8.96 PHP Object Injection trigger attempt via wpaicg_export_prompts with serialized markers", "method": "POST", "mode": "block", "severity": 7.2, "slug": "gpt3-ai-content-generator", "tags": ["object-injection", "deserialization", "php-object-injection", "ajax"], "target": "plugin", "versions": "<=1.8.96"}, "RULE-CVE-2025-0466-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype", "type": "equals", "value": "sensei_message"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_message posts via REST search subtype parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0466-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype", "type": "equals", "value": "sensei_email"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_email posts via REST search subtype parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0466-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype[]", "type": "regex", "value": "~^sensei_message$~"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_message posts via REST search subtype[] array parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0466-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/search(?:/|\\\\?|&|$)~i"}, {"name": "ARGS:subtype[]", "type": "regex", "value": "~^sensei_email$~"}], "cve": "CVE-2025-0466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0466", "description": "Sensei LMS <4.24.4 unauthenticated information disclosure of sensei_email posts via REST search subtype[] array parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "sensei-lms", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<4.24.4"}, "RULE-CVE-2025-0469-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:builder", "type": "exists"}, {"name": "ARGS:builder", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|math|details|marquee|video|audio|body|input|textarea|select|form|base|meta)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|beforeunload|message|animationend|animationstart|pointerover|pointerenter)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-0469", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0469", "description": "Forminator <=1.39.2 Stored XSS via slider template prefix/suffix in form builder save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "forminator", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.39.2"}, "RULE-CVE-2025-0493-01": {"ajax_action": "mvx_announcements_refresh_tab_data", "conditions": [{"name": "ARGS:tabname", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.|\\\\.\\\\./|php://|phar://|data://|expect://|glob://)~i"}], "cve": "CVE-2025-0493", "method": "POST", "mode": "block", "severity": 9.8, "slug": "dc-woocommerce-multi-vendor", "target": "plugin", "versions": "<=4.2.14"}, "RULE-CVE-2025-0506-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "rise-blocks/site-identity"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"(?:titleTag|taglineTag)\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*[<>][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (REST API post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "rise-blocks/site-identity"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"(?:titleTag|taglineTag)\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*[<>][^\\"\\\\\\\\]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0506", "description": "Rise Blocks <=3.6 Stored XSS via titleTag block attribute in site-identity block (classic post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.6"}, "RULE-CVE-2025-0507-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|<script)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0507", "description": "Ticketmeo (ploxel) <=2.3.6 Stored XSS via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ploxel", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-0507-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|<script)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0507", "description": "Ticketmeo (ploxel) <=2.3.6 Stored XSS via shortcode attributes in post_content param (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ploxel", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-0507-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:ticketmeo|ploxel|ticketix)\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|on(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|<script)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0507", "description": "Ticketmeo (ploxel) <=2.3.6 Stored XSS via shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ploxel", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-0511-01": {"ajax_action": "welcart_confirm_check", "conditions": [{"name": "ARGS:customer[name1]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name1] in welcart_confirm_check AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0511-02": {"ajax_action": "welcart_confirm_check", "conditions": [{"name": "ARGS:customer[name2]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name2] in welcart_confirm_check AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0511-03": {"action": "init", "conditions": [{"name": "ARGS:customer[name1]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name1] in front-end checkout form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0511-04": {"action": "init", "conditions": [{"name": "ARGS:customer[name2]", "type": "detectXSS"}], "cve": "CVE-2025-0511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0511", "description": "Welcart e-Commerce <=2.11.9 unauthenticated stored XSS via customer[name2] in front-end checkout form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "usc-e-shop", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.9"}, "RULE-CVE-2025-0512-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\s[^\\\\]]*(?:<script|<iframe|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:&lt;|&#0*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0512-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sc_fs_local_business\\\\s[^\\\\]]*(?:<script|<iframe|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:&lt;|&#0*60;)\\\\s*(?:script|iframe|svg|img))[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0512", "description": "Structured Content (JSON-LD) <=1.6.3 Stored XSS via sc_fs_local_business shortcode description attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "structured-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2025-0682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/trx_addons/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+|(?:php|data|expect|phar|zip|compress\\\\.zlib|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal and PHP wrapper abuse in REST API. Blocks directory traversal (../../) and PHP stream wrappers (php://, phar://, etc.) in any parameter sent to /wp-json/trx_addons/ endpoints. Covers CVE-2020-10257 RCE vector and CVE-2025-0682 shortcode LFI when accessed via REST.", "mode": "block", "severity": 8.8, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "rest-api", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-02": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?!(?:fonts|images|css|js|assets|vendor|dist|lib|node_modules|wp-content|wp-includes|uploads|components|templates|shortcodes)[\\\\/])|(?:php|phar|expect|zip|compress\\\\.zlib|data|file)://~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 path traversal in template selector parameters (type, layout, template, view, skin) across all entry points \\u2014 AJAX, shortcodes, REST, front-end template loaders. Fires on init hook for maximum coverage. Covers 190+ theme-level LFI CVEs from AncoraThemes, axiomthemes, ThemeREX.", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "path-traversal", "shortcode", "ajax", "generic", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0682-03": {"action": "init", "conditions": [{"name": "ARGS:/^(type|layout|template|view|skin)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log|(?:id_[rd]sa|authorized_keys))~i"}], "cve": "CVE-2025-0682", "cve_link": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85", "description": "ThemeREX Addons <= 2.33.0 defense-in-depth: block known sensitive file names in template selector parameters. Catches absolute path inclusion attempts without directory traversal (e.g., type=wp-config.php).", "mode": "block", "severity": 8.1, "slug": "trx_addons", "tags": ["lfi", "sensitive-file", "defense-in-depth", "trx-addons"], "target": "plugin", "versions": "<=2.33.0"}, "RULE-CVE-2025-0764-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php$~"}, {"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] profile update (wp-admin path)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-07": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] path traversal in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-08": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~^\\\\s*(?:file|phar|php|zip|data|expect|glob)://~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via data[avatar] local scheme in frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "local-file-inclusion", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0764-09": {"action": "init", "conditions": [{"name": "ARGS:data[avatar]", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|/proc/self/)~i"}], "cve": "CVE-2025-0764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0764", "description": "wpForo Forum <=2.4.1 authenticated (Subscriber+) arbitrary file read via absolute path in data[avatar] frontend profile update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["arbitrary-file-read", "path-traversal", "improper-input-validation"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0804-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^clickwhale~"}, {"name": "ARGS:title", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0804", "description": "ClickWhale <=2.4.1 Stored XSS via link title on admin page", "method": "POST", "mode": "block", "severity": 5.4, "slug": "clickwhale", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-0805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mlcalc\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|expression\\\\s*\\\\()[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0805", "description": "Mortgage Calculator / Loan Calculator <=1.5.20 authenticated (Contributor+) Stored XSS via mlcalc shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mortgage-loan-calculator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.20"}, "RULE-CVE-2025-0805-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mlcalc\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|expression\\\\s*\\\\()[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-0805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0805", "description": "Mortgage Calculator / Loan Calculator <=1.5.20 authenticated (Contributor+) Stored XSS via mlcalc shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mortgage-loan-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.20"}, "RULE-CVE-2025-0808-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "houzez-property-feed-export"}, {"name": "ARGS:action", "type": "equals", "value": "deleteexport"}, {"name": "ARGS:export_id", "type": "exists"}], "cve": "CVE-2025-0808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0808", "description": "Houzez Property Feed <=2.4.21 CSRF leading to property feed export deletion via deleteexport action", "method": "GET", "mode": "block", "severity": 5.4, "slug": "houzez-property-feed", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": "<=2.4.21"}, "RULE-CVE-2025-0821-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bit-assist/v1/widget-channels/update-sequence(/|\\\\?|$)~"}, {"name": "ARGS:widgetChannels[*][id]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-0821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0821", "description": "Bit Assist <=1.5.2 authenticated (Subscriber+) SQL injection via widgetChannels[id] in update-sequence REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "bit-assist", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-0860-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:autor", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via autor parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:frase", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via frase parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:idfrase", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via idfrase parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:aut", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via aut parameter on vrfr_managefrases admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:autor", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via autor parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:frase", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via frase parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:idfrase", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via idfrase parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0860-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vrfr_managefrases"}, {"name": "ARGS:aut", "type": "detectXSS"}], "cve": "CVE-2025-0860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0860", "description": "VR-Frases <=3.0.1 Reflected XSS via aut parameter on vrfr_managefrases admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "vr-frases", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-0897-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1)[\\\\s\\\\S])*?\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr parameter (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with javascript URI (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:expression|vbscript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with data URI (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1)[\\\\s\\\\S])*?\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr parameter (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0897-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[iframeBox\\\\b[^\\\\]]*\\\\battr\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:javascript\\\\s*:|expression|vbscript\\\\s*:|data\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0897", "description": "Modal Window <=6.1.5 Stored XSS via iframeBox shortcode attr with javascript/data URI (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "modal-window", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-0912-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[country]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[address1]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[address2]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-04": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[city]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-05": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[state]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-06": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:card_address[zip]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-07": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:firstName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-08": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:lastName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-09": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[country]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-10": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[address1]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-11": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[address2]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-12": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[city]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-13": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[state]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-14": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:card_address[zip]", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-15": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:firstName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0912-16": {"action": "init", "conditions": [{"name": "ARGS:givewp-route", "type": "equals", "value": "donate"}, {"name": "ARGS:lastName", "type": "regex", "value": "~[OCoc]:\\\\+?\\\\d+:\\"~"}], "cve": "CVE-2025-0912", "method": "POST", "mode": "block", "severity": 9.8, "slug": "give", "target": "plugin", "versions": "<=3.19.4"}, "RULE-CVE-2025-0916-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment body logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0916-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<(?:script|iframe|svg|object|embed|form)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0916", "description": "YaySMTP <=2.6.3 stored XSS via comment author name logged as email content without sanitization", "method": "POST", "mode": "block", "severity": 6.1, "slug": "yaysmtp", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": ">=2.4.9 <=2.6.3"}, "RULE-CVE-2025-0918-01": {"ajax_action": "_email_logs", "conditions": [{"name": "ARGS:params[valSearch]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log list (action=_email_logs); blocks HTML/script payload in params[valSearch]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0918-02": {"ajax_action": "_detail_email_logs", "conditions": [{"name": "ARGS:params[id]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|object|embed|body|input|details|video|audio|a)\\\\b|on[a-z]+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-0918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0918", "description": "SMTP for SendGrid - YaySMTP <=1.4 stored XSS via email log detail (action=_detail_email_logs); blocks HTML/script payload in params[id]", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendgrid", "tags": ["xss", "stored-xss", "email-log"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-0924-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:log", "type": "detectXSS"}], "cve": "CVE-2025-0924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0924", "description": "WP Activity Log <=5.2.2 unauthenticated stored XSS via username field on login form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-security-audit-log", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2025-0953-01": {"ajax_action": "_detail_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log detail", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0953-02": {"ajax_action": "_email_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0953", "description": "SMTP for Sendinblue YaySMTP <=1.2 unauthenticated stored XSS via email log list", "method": "POST", "mode": "block", "severity": 6.1, "slug": "smtp-sendinblue", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-0957-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email logs list AJAX - attacker-controlled email content may be rendered in logs; block XSS markers in search parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0957-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^yay_smtp_amazonses_detail_email_logs$~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-0957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0957", "description": "SMTP for Amazon SES <= 1.8 stored XSS via admin email log detail AJAX - attacker-controlled email content may be rendered in log detail; block XSS markers in selector parameter (s)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-0968-01": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0968-02": {"ajax_action": "get_megamenu_content", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-0968", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0968", "description": "ElementsKit Elementor Addons <=3.4.0 unauthenticated sensitive information exposure via get_megamenu_content AJAX (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "elementskit-lite", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-0969-01": {"ajax_action": "brizy_get_users", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-0969", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-0969", "description": "Brizy Page Builder <=2.7.16 authenticated sensitive information exposure via brizy_get_users AJAX action", "mode": "block", "severity": 6.5, "slug": "brizy", "tags": ["missing-authorization", "sensitive-information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=2.7.16"}, "RULE-CVE-2025-10000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~data:[^;]*(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|aspx?|jsp|jspx?|cfm|phtml|user\\\\.ini|htaccess|htpasswd)[^;]*;base64~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10000-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/qyrr/v1/blob-to-file(/|\\\\?|$)~"}, {"name": "ARGS:format", "type": "regex", "value": "~^(?:\\\\.)?(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|phtml|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2025-10000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10000", "description": "Qyrr - simply and modern QR-Code creation <=2.0.7 authenticated (Contributor+) arbitrary file upload via blob-to-file REST endpoint - format parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qyrr-code", "tags": ["arbitrary-file-upload", "unrestricted-file-type", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-10002-01": {"ajax_action": "clickwhale/admin/export_csv", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-10002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10002", "description": "ClickWhale <=2.5.0 authenticated SQL injection via id parameter in export_csv AJAX handler", "mode": "block", "severity": 4.9, "slug": "clickwhale", "tags": ["sql-injection", "authenticated", "csv-export"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-10036-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_fifu(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_fifu REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:keyword", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)|(?:\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b)|(?:\\\\bSELECT\\\\s+.+\\\\bFROM\\\\b)|(?:\\\\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|EXEC)\\\\b(?=.*(?:[\'\\"`;]|--\\\\s|/\\\\*)))|(?:;|--\\\\s|/\\\\*)|(?:\\\\bSLEEP\\\\s*\\\\()|(?:\\\\bBENCHMARK\\\\s*\\\\()|(?:\\\\bEXTRACTVALUE\\\\b)|(?:\\\\bUPDATEXML\\\\b)~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via keyword parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10036-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/list_all_media_library(/|\\\\?|$)~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND|UNION|;|--|#))|(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\()|(?:\\\\b(?:ASC|DESC)\\\\b\\\\s*,\\\\s*\\\\()|(?:\\\\)\\\\s*(?:OR|AND|UNION))~i"}], "cve": "CVE-2025-10036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10036", "description": "Featured Image from URL (FIFU) <=5.2.7 authenticated SQL injection via type parameter in list_all_media_library REST endpoint", "method": "GET", "mode": "block", "severity": 4.9, "slug": "featured-image-from-url", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-10039-01": {"ajax_action": "eh_crm_ticket_single_view_client", "conditions": [{"name": "ARGS:ticket_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10039", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.2.9 IDOR via eh_crm_ticket_single_view_client allows Subscriber+ to read any ticket", "method": "POST", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["idor", "missing-authorization", "insecure-direct-object-reference", "information-disclosure"], "target": "plugin", "versions": "<=3.2.9"}, "RULE-CVE-2025-10045-01": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via order parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10045-02": {"action": "admin_init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10045", "description": "onOffice for WP-Websites <=6.5.1 authenticated SQL injection via orderby parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 4.9, "slug": "onoffice-for-wp-websites", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-10046-01": {"ajax_action": "elex_gpf_manage_feed_remove_file", "conditions": [{"name": "ARGS:file_to_delete", "type": "detectSQLi"}], "cve": "CVE-2025-10046", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10046", "description": "ELEX WooCommerce Google Shopping <=1.4.3 authenticated SQL injection via file_to_delete in feed removal AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elex-woocommerce-google-product-feed-plugin-basic", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-10047-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-tracker"}, {"name": "ARGS:orderby", "type": "regex", "value": "~[(),\'\\"`]|\\\\bselect\\\\b|\\\\bcase\\\\b|\\\\bwhen\\\\b|\\\\bsleep\\\\b|\\\\bunion\\\\b|--\\\\s|/\\\\*~i"}], "cve": "CVE-2025-10047", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10047", "description": "Email Tracker <=5.3.15 authenticated (Admin+) SQL injection via orderby parameter in email list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-tracker", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=5.3.15"}, "RULE-CVE-2025-10048-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via order parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10048-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^gjmaa_~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|\\\\b(?:ASC|DESC)\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10048", "description": "My Auctions Allegro <=3.6.31 authenticated SQL injection via orderby parameter in admin list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "my-auctions-allegro-free-edition", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.6.31"}, "RULE-CVE-2025-10049-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "responsive_portfolio_with_lightbox_media_management"}, {"name": "ARGS:HdnMediaSelection", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|cgi|asp|aspx|jsp|jspx|cfm|shtml)(?:\\\\?|%3[Ff]|%00|$)~i"}], "cve": "CVE-2025-10049", "method": "POST", "mode": "block", "severity": 7.2, "slug": "responsive-filterable-portfolio", "target": "plugin", "versions": "<=1.0.24"}, "RULE-CVE-2025-1005-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-1005-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~elementskit-image-accordion~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1005", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1005", "description": "ElementsKit Elementor Addons <=3.4.0 Stored XSS via Image Accordion widget in post content save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2025-10054-01": {"ajax_action": "eh_crm_remove_agent", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10054", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.1 missing authorization on eh_crm_remove_agent AJAX action allows Subscriber+ role removal", "mode": "block", "severity": 4.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "role-removal"], "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-10055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:ProjectName", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via ProjectName on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-queue-invoice"}, {"name": "ARGS:timesheet_id", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via timesheet_id on queue-invoice page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-my-dashboard"}, {"name": "ARGS:team_member", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to reflected XSS via team_member on my-dashboard page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10055-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "time-sheets-manage-projects"}, {"name": "ARGS:notes", "type": "regex", "value": "~<script[^>]*>|javascript:|on[a-z]+=~i"}], "cve": "CVE-2025-10055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10055", "description": "Time Sheets <=2.1.3 CSRF to stored XSS via notes on manage-projects page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "time-sheets", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10058-01": {"ajax_action": "get_ftp_url", "conditions": [{"name": "ARGS:HostPath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10058", "description": "WP Ultimate CSV Importer <=7.27 authenticated arbitrary file deletion via get_ftp_url AJAX action (HostPath path traversal)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wp-ultimate-csv-importer", "tags": ["arbitrary-file-deletion", "path-traversal", "missing-authorization"], "target": "plugin", "versions": "<=7.27"}, "RULE-CVE-2025-10124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[booking-manager-delete\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10124", "description": "Booking Manager <=2.1.14 unauthorized booking deletion via [booking-manager-delete] shortcode injection in Classic Editor post save", "method": "POST", "mode": "block", "severity": 4.5, "slug": "booking-manager", "tags": ["incorrect-authorization", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-10125-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with script/tag injection (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute with javascript: URI (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute event handler injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*<(?:script|img|svg|iframe|object|embed|details|math)~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute script/tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10125-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[row\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-10125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10125", "description": "Memberlite Shortcodes <=1.4 Stored XSS via [row] shortcode class attribute javascript: URI (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "memberlite-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]webcam[^]]*(?:\\\\s+on[a-zA-Z]+\\\\s*=|javascript:|<\\\\s*script|<\\\\s*/\\\\s*script)~i"}], "cve": "CVE-2025-10129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10129", "description": "WP Webcam Widget/Shortcode <=1.2 Stored XSS via [webcam] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-webcam-widget-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10136-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tweetthis[\\\\s\\\\S]*?(?:<script|on[a-z0-9_:-]+\\\\s*=|javascript\\\\s*:)[\\\\s\\\\S]*?\\\\[/tweetthis\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10136", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10136", "description": "TweetThis Shortcode <=1.8.0 Authenticated (Contributor+) Stored XSS via tweetthis shortcode attributes and content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tweetthis-shortcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2025-10141-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ds\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-10141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10141", "description": "Digiseller <=1.3 Stored XSS via [ds] shortcode attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "digiseller", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10141-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ds\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-10141", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10141", "description": "Digiseller <=1.3 Stored XSS via [ds] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "digiseller", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10143-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catch_dark_mode\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/])[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10143", "description": "Catch Dark Mode <=2.0 authenticated (Contributor+) local file inclusion via catch_dark_mode shortcode style attribute in post content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "catch-dark-mode", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-10143-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catch_dark_mode\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/])[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10143", "description": "Catch Dark Mode <=2.0 authenticated (Contributor+) local file inclusion via catch_dark_mode shortcode style attribute in REST API post content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "catch-dark-mode", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-10147-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/podlove/v2/image(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?#]|$)~i"}], "cve": "CVE-2025-10147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10147", "description": "Podlove Podcast Publisher <=4.2.6 unauthenticated arbitrary file upload via REST API image endpoint (url parameter)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "podlove-podcasting-plugin-for-wordpress", "tags": ["arbitrary-file-upload", "unauthenticated", "rest-api", "file-upload"], "target": "plugin", "versions": "<=4.2.6"}, "RULE-CVE-2025-10162-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wooconvo/v1/download-file(/|\\\\?|&|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|(?:^|[\\\\\\\\/])\\\\.htaccess(?:$|[\\\\\\\\/])|(?:^|[\\\\\\\\/])\\\\.env(?:$|[\\\\\\\\/])|(?:^|[\\\\\\\\/])debug\\\\.log(?:$|[\\\\\\\\/])|(?:^|[\\\\\\\\/])error_log(?:$|[\\\\\\\\/])))~i"}], "cve": "CVE-2025-10162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10162", "description": "Admin and Customer Messages After Order for WooCommerce <=13.5 unauthenticated path traversal via REST download-file endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "admin-and-client-message-after-order-for-woocommerce", "tags": ["path-traversal", "local-file-inclusion", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=13.5"}, "RULE-CVE-2025-10163-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*starting_with\\\\s*=\\\\s*([\\"\'])(?:(?:\\\\\\\\.|(?!\\\\1).)*)?(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|UNION\\\\s+(?:ALL\\\\s+)?SELECT|AND\\\\s+\\\\(?\\\\s*SELECT|OR\\\\s+\\\\(?\\\\s*SELECT|INTO\\\\s+(?:OUT|DUMP)FILE)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10163", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10163", "description": "List Category Posts <=0.91.0 authenticated SQL injection via catlist shortcode starting_with attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.5, "slug": "list-category-posts", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-10163-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*starting_with\\\\s*=\\\\s*([\\"\'])(?:(?:\\\\\\\\.|(?!\\\\1).)*)?(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|UNION\\\\s+(?:ALL\\\\s+)?SELECT|AND\\\\s+\\\\(?\\\\s*SELECT|OR\\\\s+\\\\(?\\\\s*SELECT|INTO\\\\s+(?:OUT|DUMP)FILE)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10163", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10163", "description": "List Category Posts <=0.91.0 authenticated SQL injection via catlist shortcode starting_with attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "list-category-posts", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-10166-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:blogger|bookhype|colourlovers|deviantart|dribbble|etsy|facebook|flickr|flipboard|github|goodreads|hackernews|imdb|instagram|lastfm|linkedin|myspace|patreon|pinterest|reddit|slideshare|spacehey|soundcloud|tiktok|twitch|twitter|vimeo|x|yelp|youtube)\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10166", "description": "Social Media Shortcodes <=1.3.1 Stored XSS via shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-media-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-10166-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:blogger|bookhype|colourlovers|deviantart|dribbble|etsy|facebook|flickr|flipboard|github|goodreads|hackernews|imdb|instagram|lastfm|linkedin|myspace|patreon|pinterest|reddit|slideshare|spacehey|soundcloud|tiktok|twitch|twitter|vimeo|x|yelp|youtube)\\\\s[^\\\\]]*(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10166", "description": "Social Media Shortcodes <=1.3.1 Stored XSS via shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-media-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-10167-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[alg_wc_stock_snapshot_restocked"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[alg_wc_stock_snapshot_restocked\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10167-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "[alg_wc_stock_snapshot_restocked"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[alg_wc_stock_snapshot_restocked\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10167", "description": "Stock History & Reports Manager for WooCommerce <=2.2.2 Stored XSS via [alg_wc_stock_snapshot_restocked] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-snapshot-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-10181-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[drafts\\\\b[^\\\\]]*template\\\\s*=\\\\s*(?:([\'\\"])(?:(?!\\\\1).)*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)(?:(?!\\\\1).)*\\\\1|[^\\\\s\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-10181", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10181", "description": "Draft List <=2.6 authenticated (Contributor+) stored XSS via drafts shortcode template attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-draft-list", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.6"}, "RULE-CVE-2025-10186-01": {"ajax_action": "remove_row", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10186", "description": "WhyDonate <=4.0.15 unauthorized deletion of wp_wdplugin_style rows via remove_row AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-whydonate", "tags": ["missing-authorization", "unauthenticated", "data-deletion"], "target": "plugin", "versions": "<=4.0.15"}, "RULE-CVE-2025-10187-01": {"ajax_action": "wpgsp_apply_ajax_save", "conditions": [{"name": "ARGS:field", "type": "regex", "value": "~(?:[`()=;]|\\\\b(?:SELECT|UNION|INSERT|UPDATE|DELETE|DROP|SLEEP|IF|FROM|WHERE|OR|AND)\\\\b|--)~i"}], "cve": "CVE-2025-10187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10187", "description": "GSpeech TTS <=3.17.13 authenticated SQL injection via field parameter in wpgsp_apply_ajax_save", "method": "POST", "mode": "block", "severity": 4.9, "slug": "gspeech", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=3.17.13"}, "RULE-CVE-2025-10196-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~surveyanyplace_embed[^]]*(?:on[a-zA-Z]+=|<script|javascript:)~i"}], "cve": "CVE-2025-10196", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10196", "description": "Survey Anyplace <=1.0.0 Stored XSS via surveyanyplace_embed shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "surveyanyplace", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-10196-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~surveyanyplace_embed[^]]*(?:on[a-zA-Z]+=|<script|javascript:)~i"}], "cve": "CVE-2025-10196", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10196", "description": "Survey Anyplace <=1.0.0 Stored XSS via surveyanyplace_embed shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "surveyanyplace", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-10299-01": {"ajax_action": "ctl_create_link", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10299", "mode": "block", "severity": 8.8, "slug": "create-temporary-login", "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-10303-01": {"ajax_action": "owt_lib_handler", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:module", "type": "exists"}, {"name": "ARGS:get_option", "type": "exists"}], "cve": "CVE-2025-10303", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10303", "description": "Library Management System <=3.1 missing authorization on owt_lib_handler AJAX action allows subscriber+ to modify settings and data", "method": "POST", "mode": "block", "severity": 4.3, "slug": "library-management-system", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-10307-01": {"ajax_action": "backuply_multi_backup_delete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|(?:\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC]|%2[eE]%2[eE]%2[fF]|%2[eE]%2[eE]%5[cC]))~"}], "cve": "CVE-2025-10307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10307", "description": "Backuply <=1.4.8 Authenticated (Admin+) Arbitrary File Deletion via path traversal in backuply_multi_backup_delete AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "backuply", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2025-10307-02": {"ajax_action": "backuply_download_backup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|(?:\\\\.\\\\.%2[fF]|\\\\.\\\\.%5[cC]|%2[eE]%2[eE]%2[fF]|%2[eE]%2[eE]%5[cC]))~"}], "cve": "CVE-2025-10307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10307", "description": "Backuply <=1.4.8 Authenticated (Admin+) Arbitrary File Read via path traversal in backuply_download_backup AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "backuply", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2025-10309-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via name parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:item", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via item parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:return", "type": "regex", "value": "~(?:<script\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*[^,]*<|<[^>]*\\\\son[a-zA-Z0-9_]+\\\\s*=|[\'\\"]\\\\s*on[a-zA-Z0-9_]+\\\\s*=|expression\\\\s*\\\\()~i"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via return URL parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via coupon parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:email", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via email parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "paypal-forms"}, {"name": "ARGS:paypal", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 CSRF to stored XSS via paypal parameter in admin form management", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10309-07": {"action": "init", "conditions": [{"name": "ARGS:paypal_form_coupon", "type": "detectXSS"}], "cve": "CVE-2025-10309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10309", "description": "PayPal Forms <=1.0.3 reflected XSS via paypal_form_coupon shortcode parameter (unauthenticated)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "paypal-forms", "tags": ["csrf", "xss", "reflected-xss", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10310-01": {"ajax_action": "easysnippetGet", "conditions": [{"name": "ARGS:last", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}, {"name": "ARGS:last", "type": "regex", "value": "~(?i)(?:(?:[\'\\\\\\"]\\\\s*)?\\\\b(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER\\\\s+BY|GROUP\\\\s+BY|SLEEP|BENCHMARK|WAITFOR|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\b|(?:--\\\\s*$)|(?:/\\\\*)|(?:;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)))~"}], "cve": "CVE-2025-10310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10310", "description": "Rich Snippet Site Report <=2.0.0105 authenticated SQL injection via last parameter in easysnippetGet AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "easysnippet", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.0.0105"}, "RULE-CVE-2025-10376-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "crfl_redirect_setting"}, {"name": "ARGS:id", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-10376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10376", "description": "Course Redirects for Learndash <=0.4 CSRF to reflected XSS via unsanitized id parameter on settings page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "course-redirects-for-learndash", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=0.4"}, "RULE-CVE-2025-10380-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on REST API save endpoint - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining with dangerous PHP callables on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~constant\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|call_user_func|call_user_func_array)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template injection on post.php save - constant() function abuse", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\|\\\\s*(?:filter|map|reduce|sort)\\\\s*\\\\(\\\\s*[\'\\"](?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec)[\'\\"]~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig filter chaining on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~_self\\\\s*\\\\.\\\\s*env\\\\s*\\\\.\\\\s*(?:registerUndefinedFilterCallback|registerUndefinedFunctionCallback|getFilter|getFunction)~i"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig _self.env callback registration on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/acf-views/~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on REST API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-10380-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS", "type": "regex", "value": "~\\\\{[%{](?:(?![%}]\\\\}).)*\\\\b(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|pcntl_exec|phpinfo|file_get_contents|file_put_contents|fopen)\\\\s*\\\\((?:(?![%}]\\\\}).)*[%}]\\\\}~is"}], "cve": "CVE-2025-10380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10380", "description": "Advanced Views <=3.7.19 authenticated (Author+) SSTI/RCE via Twig template with dangerous PHP functions in Twig delimiters on post.php save", "method": "POST", "mode": "block", "severity": 8.8, "slug": "acf-views", "tags": ["ssti", "remote-code-execution", "twig-template-injection"], "target": "plugin", "versions": "<=3.7.19"}, "RULE-CVE-2025-1043-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in post_content stored through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-1043-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[embeddoc[^\\\\]]*\\\\surl\\\\s*=\\\\s*[\\"\']?\\\\s*(?:(?:https?://)?(?:127\\\\.(?:0\\\\.){2}(?:0\\\\.)?1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.0\\\\.0\\\\.1\\\\]?|0x[0-9a-fA-F]+|0[0-7]+|[0-9]{8,10})(?:[:/]|\\\\]|\\\\s|$)|(?:file|gopher|dict|ftp|ldap|tftp)://)~i"}], "cve": "CVE-2025-1043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1043", "description": "Embed Any Document <=2.7.5 authenticated (Contributor+) blind SSRF via [embeddoc] shortcode in content stored through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-any-document", "tags": ["ssrf", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-10476-01": {"ajax_action": "wpfc_db_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10476", "mode": "block", "severity": 4.3, "slug": "wp-fastest-cache", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10487-01": {"ajax_action": "advads_ad_select", "conditions": [{"name": "ARGS:ad_method", "type": "regex", "value": "~^(?!ad$|group$|placement$|id$).+~"}], "cve": "CVE-2025-10487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10487", "description": "Advanced Ads <=2.0.12 unauthenticated limited RCE via ad_method parameter in advads_ad_select AJAX handler", "mode": "block", "severity": 7.3, "slug": "advanced-ads", "tags": ["code-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=2.0.12"}, "RULE-CVE-2025-1054-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~uicore-(?:counter|icon-box|testimonial-(?:slider|grid|carousel))~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[^>]*>|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:[^\\\\s]|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[^>]*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1054", "description": "UiCore Elements <=1.0.16 Stored XSS via Counter/Icon Box/Testimonial widgets on REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uicore-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.16"}, "RULE-CVE-2025-10567-01": {"ajax_action": "get_gutenberg_checkout_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(script|img|svg|iframe|details|embed|object|math|video|audio|body|input|button|select|textarea|form|marquee|isindex|meta|link|style|base|source|applet)[\\\\s/>]|\\\\bon(error|load|click|mouse\\\\w+|focus|blur|toggle|resize|submit|change|input|key\\\\w+|touch\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-10567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10567", "description": "FunnelKit <=3.12.0 reflected XSS via unsanitized checkout text fields in get_gutenberg_checkout_from_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.3, "slug": "funnel-builder", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.12.0"}, "RULE-CVE-2025-10570-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10570", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10570", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.38 missing authorization on fr_refund_request AJAX action allows subscriber+ IDOR refund requests", "method": "POST", "mode": "block", "severity": 4.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.38"}, "RULE-CVE-2025-10579-01": {"ajax_action": "backwpup_working", "conditions": [{"name": "ARGS:jobid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "backwpup"}], "cve": "CVE-2025-10579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10579", "description": "BackWPup <=5.5.0 missing authorization on backwpup_working AJAX action exposes backup filename to low-privilege users", "mode": "block", "severity": 5.3, "slug": "backwpup", "tags": ["missing-authorization", "information-exposure", "broken-access-control"], "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2025-10580-01": {"ajax_action": "widgetopts_ajax_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<[^>]*\\\\bon\\\\w+\\\\s*=|<\\\\s*(?:script|img|svg|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_ajax_settings widget option save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10580-02": {"ajax_action": "widgetopts_migrator", "conditions": [{"name": "ARGS:single_sidebar", "type": "detectXSS"}], "cve": "CVE-2025-10580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10580", "description": "Widget Options <=4.1.2 Stored XSS via widgetopts_migrator single_sidebar parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-options", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-10587-01": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_category", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-10587-02": {"action": "init", "conditions": [{"name": "ARGS:event_name", "type": "exists"}, {"name": "ARGS:event_venue", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10587", "method": "POST", "mode": "block", "severity": 9.8, "slug": "community-events", "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-1063-01": {"ajax_action": "rtcl_taxonomy_settings_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1063", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1063", "description": "Classified Listing <=4.0.4 unauthenticated settings exposure via rtcl_taxonomy_settings_export AJAX action", "mode": "block", "severity": 5.3, "slug": "classified-listing", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1064-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (javascript:/data: URI injection in href)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-1064-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[xoo_el_action\\\\b[^\\\\]]*change_to\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-1064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1064", "description": "Login/Signup Popup <= 2.8.5 Stored XSS via xoo_el_action shortcode change_to attribute (Gutenberg REST API content field)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-login-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.5"}, "RULE-CVE-2025-10645-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-reset[/\\\\\\\\](?:.*/)?wf-licensing\\\\.log([?#]|$)~i"}], "cve": "CVE-2025-10645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10645", "description": "WP Reset <=2.05 unauthenticated sensitive information exposure via wf-licensing.log direct file access", "method": "GET", "mode": "block", "severity": 5.3, "slug": "wp-reset", "tags": ["information-disclosure", "sensitive-log-file", "unauthenticated"], "target": "plugin", "versions": "<=2.05"}, "RULE-CVE-2025-10647-01": {"ajax_action": "epdf_wf_download_pdf_media", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.|%2e)(?:ph(?:p\\\\d*|ar|ps|t|tml?)|phtml)(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-10647", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10647", "description": "Embed PDF for WPForms <=1.1.5 arbitrary file upload via dangerous file extension in url parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "embed-pdf-wpforms", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-10649-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^usces_(?:orderlist|memberlist|itemedit)$~"}, {"name": "REQUEST_COOKIES:usces_cookie", "type": "regex", "value": "~(?:sortColumn|sortSwitchs)[^;]*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|CONCAT|BENCHMARK|SLEEP|ORDER\\\\s+BY|AND\\\\s+|OR\\\\s+[\\\\d\\"\\\\\']|[\\\\\'\\\\\\"]\\\\s*(?:--|#))~i"}], "cve": "CVE-2025-10649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10649", "description": "Welcart e-Commerce <=2.11.21 authenticated (Author+) SQL injection via usces_cookie sortColumn/sortSwitchs in admin list pages", "method": "GET", "mode": "block", "severity": 6.5, "slug": "usc-e-shop", "tags": ["sql-injection", "cookie-injection", "authenticated"], "target": "plugin", "versions": "<=2.11.21"}, "RULE-CVE-2025-1065-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via type parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:library", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via library parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:date", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via date parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:source", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via source parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via s (search) parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via orderby parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-1065-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "visualizer"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2025-1065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1065", "description": "Visualizer: Tables and Charts Manager for WordPress <=3.11.8 Reflected XSS via order parameter on library display", "mode": "block", "severity": 6.4, "slug": "visualizer", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.11.8"}, "RULE-CVE-2025-10660-01": {"ajax_action": "dashboard_chat", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-10660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10660", "description": "WP Dashboard Chat <=1.0.3 authenticated SQL injection via id parameter in dashboard_chat AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-dashboard-chat", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-10682-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tariffuxx_configurator[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|EXEC|SLEEP|BENCHMARK|LOAD_FILE|INTO\\\\s+OUTFILE|INTO\\\\s+DUMPFILE)\\\\b|--|#|/\\\\*|\'\\\\s*(?:OR|AND)(?:\\\\s|[\'\\"(]))~i"}], "cve": "CVE-2025-10682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10682", "description": "TARIFFUXX <=1.4 SQL injection via tariffuxx_configurator shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "tariffuxx", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4"}, "RULE-CVE-2025-10683-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10683-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "email-subscription-with-secure-captcha"}, {"name": "ARGS:uid", "type": "detectSQLi"}], "cve": "CVE-2025-10683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10683", "description": "Easy Email Subscription <=1.3 authenticated SQL injection via uid parameter on admin edit subscriber page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "email-subscription-with-secure-captcha", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-10686-01": {"ajax_action": "cretats_get_preview_html", "conditions": [{"name": "ARGS:cretats_layout", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2025-10686", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10686", "description": "Creta Testimonial Showcase <=1.2.3 authenticated Local File Inclusion via cretats_layout parameter in cretats_get_preview_html AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "creta-testimonial-showcase", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-10745-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]banhammer-process_~"}], "cve": "CVE-2025-10745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10745", "description": "Banhammer <=3.4.8 unauthenticated protection mechanism bypass via predictable banhammer-process_ GET parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "banhammer", "tags": ["protection-bypass", "predictable-secret", "unauthenticated"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-10748-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "rapidresult"}, {"name": "ARGS:s", "type": "regex", "value": "~\'\\\\s*(?:(?:OR|AND)\\\\s+[^\']{0,40}(?:--|#|/[*])|(?:OR|AND)\\\\s+[0-9]+\\\\s*[=<>]|(?:OR|AND)\\\\s*[(]\\\\s*SELECT\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s)|SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]~i"}], "cve": "CVE-2025-10748", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10748", "description": "RapidResult <=1.2 authenticated (Contributor+) SQL injection via s parameter in admin search", "method": "GET", "mode": "block", "severity": 6.5, "slug": "rapidresult", "tags": ["sql-injection", "authenticated", "admin-search"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-10749-01": {"ajax_action": "azure-storage-media-replace", "conditions": [{"name": "ARGS:replace_attachment", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-10749", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10749", "description": "Microsoft Azure Storage for WordPress <=4.5.1 missing authorization on azure-storage-media-replace AJAX action allows authenticated subscribers to delete arbitrary media", "method": "POST", "mode": "block", "severity": 5.4, "slug": "windows-azure-storage", "tags": ["missing-authorization", "broken-access-control", "arbitrary-media-deletion"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-10754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "docodoco-store-locator"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10754", "description": "DocoDoco Store Locator <=1.0.1 authenticated (Editor+) arbitrary file upload via ZIP import", "method": "POST", "mode": "block", "severity": 7.2, "slug": "docodoco-store-locator", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-10862-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via id parameter on PUT /popup/logs REST endpoint", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10862-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-builder-block/v1/popup/logs(/|\\\\?|&|$)~"}, {"name": "ARGS:campaignId", "type": "regex", "value": "~\\\\D~"}], "cve": "CVE-2025-10862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10862", "description": "PopupKit <=2.1.3 unauthenticated SQL injection via campaignId parameter on GET /popup/logs REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "popup-builder-block", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2025-10873-02": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_email", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_email parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10873-03": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS:mail_data_from_name", "type": "exists"}], "cve": "CVE-2025-10873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10873", "description": "ElementInvader Addons for Elementor <=1.4.0 unauthenticated arbitrary email sending via mail_data_from_name parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elementinvader-addons-for-elementor", "tags": ["missing-authorization", "email-spoofing", "unauthenticated"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-10874-01": {"ajax_action": "handle-request-mystock", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://([a-z0-9-]+\\\\.)*static\\\\.?flickr\\\\.com(/|$)).+~i"}], "cve": "CVE-2025-10874", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10874", "description": "Orbit Fox by ThemeIsle <=3.0.1 authenticated SSRF via MyStock image import (handle-request-mystock)", "method": "POST", "mode": "block", "severity": 5.5, "slug": "themeisle-companion", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2025-10902-01": {"ajax_action": "origaich_ai_scan_result_remove", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-10902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-10902", "description": "Originality.ai AI Checker <=1.0.15 missing authorization on scan log deletion via origaich_ai_scan_result_remove AJAX action", "method": "POST", "mode": "block", "severity": 4.3, "slug": "originality-ai", "tags": ["missing-authorization", "broken-access-control", "data-deletion"], "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2025-10916-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/responses/attachments(?:/|\\\\?|&|$)~"}, {"name": "ARGS:file_token", "type": "regex", "value": "~(?:Li4v|Li5c)~"}], "cve": "CVE-2025-10916", "method": "DELETE", "mode": "block", "severity": 9.1, "slug": "formgent", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-11003-01": {"ajax_action": "uip_save_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_save_ui_template AJAX handler allows Subscriber+ Stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11003-02": {"ajax_action": "uip_create_new_ui_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11003", "description": "UiPress lite <=3.5.08 missing authorization on uip_create_new_ui_template AJAX handler allows Subscriber+ template creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uipress-lite", "tags": ["missing-authorization", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.08"}, "RULE-CVE-2025-11007-01": {"ajax_action": "ce21_single_sign_on_save_api_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ce21-suite", "target": "plugin", "versions": ">=2.2.1 <=2.3.1"}, "RULE-CVE-2025-11128-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/feedzy/v1/feed(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~https?://(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|localhost|\\\\[?::1\\\\]?)~i"}], "cve": "CVE-2025-11128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11128", "description": "Feedzy RSS Feeds Lite <=5.1.0 authenticated SSRF via REST API url parameter targeting internal/private IPs", "method": "POST", "mode": "block", "severity": 5.0, "slug": "feedzy-rss-feeds", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2025-11162-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~</style[^>]*>|<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in REST API post meta", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11162-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:meta[uagb_custom_page_level_css]", "type": "regex", "value": "~</style[^>]*>|<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11162", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.14 Authenticated (Contributor+) Stored XSS via Custom CSS in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "classic-editor", "authenticated"], "target": "plugin", "versions": "<=2.19.14"}, "RULE-CVE-2025-11171-01": {"ajax_action": "ays_chart_admin_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_admin_ajax AJAX handler allowing unauthenticated admin method dispatch", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-02": {"ajax_action": "ays_chart_install_plugin", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_install_plugin AJAX handler allowing unauthenticated plugin installation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-03": {"ajax_action": "ays_chart_activate_plugin", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_activate_plugin AJAX handler allowing unauthenticated plugin activation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11171-05": {"ajax_action": "ays_chart_dismiss_button", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11171", "description": "Chartify \\u2013 WordPress Chart Plugin <=3.5.9 missing authentication on ays_chart_dismiss_button AJAX handler allowing unauthenticated notice dismissal", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chart-builder", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.5.9"}, "RULE-CVE-2025-11174-01": {"ajax_action": "dll_load_posts", "conditions": [{"name": "ARGS:args[status]", "type": "regex", "value": "~^(?:draft|pending|future|private|any)$~i"}], "cve": "CVE-2025-11174", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11174", "description": "Document Library Lite <=1.1.6 unauthenticated sensitive information exposure via dll_load_posts AJAX handler args[status] parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "document-library-lite", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-11185-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cmplz-accept-link\\\\b[^\\\\]]*(?:on[a-z]+=|<script|<img|<svg|<iframe|javascript:|&#(?:x0*22|0*34|x0*27|0*39|x0*3c|0*60|x0*3e|0*62))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11185", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11185", "description": "Complianz GDPR/CCPA Cookie Consent <=7.4.3 Stored XSS via cmplz-accept-link shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "complianz-gdpr", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.3"}, "RULE-CVE-2025-11185-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cmplz-accept-link\\\\b[^\\\\]]*(?:on[a-z]+=|<script|<img|<svg|<iframe|javascript:|&#(?:x0*22|0*34|x0*27|0*39|x0*3c|0*60|x0*3e|0*62))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11185", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11185", "description": "Complianz GDPR/CCPA Cookie Consent <=7.4.3 Stored XSS via cmplz-accept-link shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "complianz-gdpr", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.3"}, "RULE-CVE-2025-11186-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cookies_accepted[^\\\\]]*\\\\].*?(?:<script|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~is"}], "cve": "CVE-2025-11186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11186", "description": "Cookie Notice & Compliance for GDPR/CCPA <=2.5.8 Stored XSS via [cookies_accepted] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cookie-notice", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5.8"}, "RULE-CVE-2025-11186-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cookies_accepted[^\\\\]]*\\\\].*?(?:<script|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~is"}], "cve": "CVE-2025-11186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11186", "description": "Cookie Notice & Compliance for GDPR/CCPA <=2.5.8 Stored XSS via [cookies_accepted] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cookie-notice", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.5.8"}, "RULE-CVE-2025-1119-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/appointments(/|\\\\?|$)~"}, {"name": "ARGS:customer_locale", "type": "regex", "value": "~[^a-zA-Z_\\\\-]~"}], "cve": "CVE-2025-1119", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1119", "description": "Simply Schedule Appointments <=1.6.8.5 unauthenticated arbitrary shortcode execution via stored customer_locale with non-locale characters", "method": "POST", "mode": "block", "severity": 7.3, "slug": "simply-schedule-appointments", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.6.8.5"}, "RULE-CVE-2025-11191-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/realpress/v1/contact-form(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11191", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11191", "description": "RealPress <1.1.0 unauthenticated email sending via /contact-form REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "realpress", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.1.0"}, "RULE-CVE-2025-11191-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/realpress/v1/schedule-tour(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11191", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11191", "description": "RealPress <1.1.0 unauthenticated email sending via /schedule-tour REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "realpress", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.1.0"}, "RULE-CVE-2025-11191-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/realpress/v1/(?!contact-form(/|\\\\?|$)|schedule-tour(/|\\\\?|$))[a-z0-9_/-]+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11191", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11191", "description": "RealPress <1.1.0 unauthenticated page creation and data manipulation via REST API", "method": "POST", "mode": "block", "severity": 5.3, "slug": "realpress", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.1.0"}, "RULE-CVE-2025-11204-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "rm_form_reports"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "GET", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11204-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "rm_form_reports"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "POST", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11204-03": {"ajax_action": "rm_get_stats", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rm_get_stats"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "POST", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11204-04": {"ajax_action": "rm_get_stats", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rm_get_stats"}, {"name": "ARGS:rm_form_id", "type": "detectSQLi"}], "cve": "CVE-2025-11204", "method": "GET", "mode": "block", "severity": 7.2, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.2"}, "RULE-CVE-2025-11220-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "text-path"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|link|base)\\\\b|\\\\bon(?:error|load|begin|end|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11220", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11220", "description": "Elementor <=3.33.3 Authenticated (Contributor+) Stored DOM-Based XSS via Text Path widget SVG markup", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elementor", "tags": ["xss", "stored-xss", "svg-injection", "elementor"], "target": "plugin", "versions": "<=3.33.3"}, "RULE-CVE-2025-11227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/campaigns/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated access to single campaign data via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-11227-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/campaigns(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated enumeration of campaigns via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-11227-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/donation-forms/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated access to single donation form data via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-11227-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/give-api/v3/donation-forms(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_give_forms"}], "cve": "CVE-2025-11227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11227", "description": "GiveWP <=4.10.0 unauthenticated enumeration of donation forms via REST API", "method": "GET", "mode": "block", "severity": 6.5, "slug": "give", "tags": ["missing-authorization", "information-exposure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.10.0"}, "RULE-CVE-2025-1123-01": {"ajax_action": "solidwp_mail_send_test_email", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=~i"}], "cve": "CVE-2025-1123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1123", "description": "Solid Mail (WP SMTP) <=2.1.5 stored XSS via test email fields in solidwp_mail_send_test_email AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-smtp", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.1.5"}, "RULE-CVE-2025-11254-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via gallery form upload submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11254-03": {"ajax_action": "post_cg_registry", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^[\\\\s\\\\t]*(=|\\\\+|\\\\-|@)~"}], "cve": "CVE-2025-11254", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11254", "description": "Contest Gallery <=27.0.3 unauthenticated CSV injection via registry submissions", "method": "POST", "mode": "block", "severity": 4.3, "slug": "contest-gallery", "tags": ["csv-injection", "formula-injection", "unauthenticated"], "target": "plugin", "versions": "<=27.0.3"}, "RULE-CVE-2025-11256-01": {"action": "admin_post_nopriv_delete_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file deletion via admin_post_nopriv_delete_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-02": {"action": "admin_post_nopriv_delete_all_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk log deletion via admin_post_nopriv_delete_all_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-03": {"action": "admin_post_nopriv_download_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated log file download via admin_post_nopriv_download_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-04": {"action": "admin_post_nopriv_fix_permissions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated permission fix via admin_post_nopriv_fix_permissions", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-05": {"action": "admin_post_nopriv_download_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log download via admin_post_nopriv_download_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-read", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-06": {"action": "admin_post_nopriv_delete_widget_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated widget log deletion via admin_post_nopriv_delete_widget_log", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-07": {"action": "admin_post_nopriv_delete_all_widget_logs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated bulk widget log deletion via admin_post_nopriv_delete_all_widget_logs", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-delete", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11256-09": {"ajax_action": "chatbot_chatgpt_upload_files", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11256", "description": "Kognetiks Chatbot <=2.3.5 unauthenticated limited file upload via chatbot_chatgpt_upload_files AJAX", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chatbot-chatgpt", "tags": ["missing-authorization", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11262-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper/ai-auth(?:/|\\\\?|&|$)~"}, {"name": "ARGS:user_id", "type": "regex", "value": "~<\\\\s{0,8}/?\\\\s{0,8}[a-z]|%3c\\\\s{0,8}(?:%2f)?\\\\s{0,8}[a-z]|\\\\bon\\\\w{1,24}\\\\s{0,8}=|javascript\\\\s{0,8}:~i"}], "cve": "CVE-2025-11262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11262", "description": "Link Whisper Free <=0.9.0 unauthenticated stored XSS via the user_id parameter of the ai-auth REST endpoint (POST /wp-json/link-whisper/ai-auth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "link-whisper", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.9.0"}, "RULE-CVE-2025-11271-01": {"action": "init", "conditions": [{"name": "ARGS:verification_override", "type": "exists"}], "cve": "CVE-2025-11271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11271", "description": "Easy Digital Downloads <=3.5.2 PayPal IPN verification bypass via verification_override parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-digital-downloads", "tags": ["verification-bypass", "unauthenticated", "payment-fraud", "cwe-807"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-11307-01": {"ajax_action": "wpgmza_rest_api_request", "conditions": [{"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via wpgmza_rest_api_request AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11307-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpgmza/v1/~"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2025-11307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11307", "description": "WP Go Maps <9.0.48 unauthenticated stored XSS via REST API /wpgmza/v1/ endpoints", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-maps", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<9.0.48"}, "RULE-CVE-2025-11361-01": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~(?:^|[/\\\\\\\\@])(?:127\\\\.(?:0\\\\.){2}1|0\\\\.0\\\\.0\\\\.0|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|localhost|\\\\[::1\\\\])~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - internal/private IP targets", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11361-02": {"ajax_action": "save_ai_generated_image", "conditions": [{"name": "ARGS:image_url", "type": "regex", "value": "~^\\\\s*(?:gopher|file|dict|ftp|data|ldap|telnet|tftp|jar|netdoc)\\\\s*:~i"}], "cve": "CVE-2025-11361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11361", "description": "Essential Blocks <=5.7.1 authenticated (Author+) SSRF via save_ai_generated_image AJAX handler - dangerous URL schemes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=5.7.1"}, "RULE-CVE-2025-11369-01": {"ajax_action": "get_instagram_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on get_instagram_access_token AJAX action allows Author+ to read Instagram API token", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-02": {"ajax_action": "google_map_api_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on google_map_api_key AJAX action allows Author+ to read Google Maps API key", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11369-03": {"ajax_action": "openverse_email_name_DB", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11369", "description": "Essential Blocks <=5.7.2 missing authorization on openverse_email_name_DB AJAX action allows Author+ to read OpenVerse API credentials", "method": "POST", "mode": "block", "severity": 4.3, "slug": "essential-blocks", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2025-11370-01": {"ajax_action": "depicter-document-rules-store", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule update via depicter-document-rules-store AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11370-02": {"ajax_action": "depicter-document-rules-show", "conditions": [{"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11370", "description": "Depicter <=4.0.7 missing authorization on unauthenticated display rule read via depicter-document-rules-show AJAX action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "depicter", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-11372-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "lp/v1/admin/tools/create-indexs"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11372", "description": "LearnPress \\u2013 WordPress LMS Plugin Admin Tools REST create-indexs endpoint is exposed without authorization because it is registered with permission_callback set to __return_true, allowing unauthenticated destructive database operations (dropping indexes on any table including wp_options, creating duplicate configuration entries, and degrading performance) via /wp-json/lp/v1/admin/tools/create-indexs when table names are supplied.", "method": "POST", "mode": "block", "severity": 6.5, "slug": "learnpress", "tags": ["missing-authorization", "rest-api", "unauthenticated", "database-manipulation"], "target": "plugin", "versions": "<=4.2.9.3"}, "RULE-CVE-2025-11377-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11377-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*post_status\\\\s*=\\\\s*[\\"\']?(?:private|draft|pending|future|any|trash)[\\"\']?~i"}, {"type": "missing_capability", "value": "read_private_posts"}], "cve": "CVE-2025-11377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11377", "description": "List Category Posts <=0.92.0 information exposure via catlist shortcode post_status attribute (REST API)", "method": "POST", "mode": "block", "severity": 4.3, "slug": "list-category-posts", "tags": ["information-exposure", "shortcode", "authorization-bypass", "rest-api"], "target": "plugin", "versions": "<=0.92.0"}, "RULE-CVE-2025-11379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\/wp-content\\\\/webp-express\\\\/config\\\\/.*\\\\.json~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11379", "description": "WebP Express <=0.25.9 unauthenticated information disclosure via predictable config.json file path", "method": "GET", "mode": "block", "severity": 5.3, "slug": "webp-express", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=0.25.9"}, "RULE-CVE-2025-11380-01": {"ajax_action": "everest_process_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_process_status AJAX action leading to unauthenticated backup file location disclosure", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11380-02": {"ajax_action": "everest_backup_process_status_unlink", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11380", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11380", "description": "Everest Backup <=2.3.5 missing authorization on everest_backup_process_status_unlink AJAX action allowing unauthenticated status file deletion", "mode": "block", "severity": 5.9, "slug": "everest-backup", "tags": ["missing-authorization", "data-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2.3.5"}, "RULE-CVE-2025-11427-01": {"ajax_action": "wpmdb_flush", "conditions": [{"name": "ARGS:download", "type": "regex", "value": "~(?:https?|ftp|file|php|data|phar|compress\\\\.(?:zlib|bzip2)|zip|glob|expect)://~i"}], "cve": "CVE-2025-11427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11427", "description": "WP Migrate Lite <=2.7.6 unauthenticated blind SSRF via wpmdb_flush AJAX download parameter", "method": "POST", "mode": "block", "severity": 5.8, "slug": "wp-migrate-db", "tags": ["ssrf", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2025-11448-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/envira-convert/v1/bulk-convert(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11448", "description": "Envira Gallery Lite <=1.11.0 missing authorization on bulk-convert REST endpoint", "method": "POST", "mode": "block", "severity": 4.3, "slug": "envira-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2025-11451-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/aal_ajax_unit_loading(/|\\\\?|&|$)~"}, {"name": "ARGS:data[template_path]", "type": "exists"}], "cve": "CVE-2025-11451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11451", "description": "Auto Amazon Links <=5.4.3 unauthenticated arbitrary file read via template_path in REST API", "mode": "block", "severity": 7.5, "slug": "amazon-auto-links", "target": "plugin", "versions": "<=5.4.3"}, "RULE-CVE-2025-11453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:_inpost_head_script[synth_header_script]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11453", "description": "Header and Footer Scripts <=2.2.2 Stored XSS via _inpost_head_script post meta field by Contributor+ users", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-scripts", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2025-11454-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "eos_scfm_duplicate_post_as_draft"}, {"name": "ARGS:post", "type": "regex", "value": "~[^0-9]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11454", "description": "Specific Content For Mobile <=0.5.5 authenticated SQL injection via post parameter in eos_scfm_duplicate_post_as_draft admin action", "method": "GET", "mode": "block", "severity": 6.5, "slug": "specific-content-for-mobile", "tags": ["sql-injection", "authenticated", "contributor"], "target": "plugin", "versions": "<=0.5.5"}, "RULE-CVE-2025-11457-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/easycommerce/v1/orders(?:/|[?&]|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-11457", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easycommerce", "target": "plugin", "versions": ">=0.9.0-beta2 <=1.8.2"}, "RULE-CVE-2025-11496-01": {"action": "init", "conditions": [{"name": "ARGS:rtb-name", "type": "detectXSS"}], "cve": "CVE-2025-11496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11496", "description": "Five Star Restaurant Reservations <=2.7.5 unauthenticated stored XSS via rtb-name booking form parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "restaurant-reservations", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-11499-01": {"action": "init", "conditions": [{"name": "ARGS:post_featured_image", "type": "regex", "value": "~https?://[^\\\\s\\"\'<>]+\\\\.(?:ph(?:p\\\\d?|ps|tml?|t|ar)|[aj]sp[x]?|cgi|cfm|exe|bash)(?:[?#]|$)~i"}], "cve": "CVE-2025-11499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "tablesome", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-11502-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[saswp_tiny_multiple_faq\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11502", "description": "Schema & Structured Data for WP & AMP <=1.51 Stored XSS via saswp_tiny_multiple_faq shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.51"}, "RULE-CVE-2025-11502-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[saswp_tiny_multiple_faq\\\\b[^\\\\]]*(?:<svg|<iframe|<embed|<object|<math|<body|<video[^>]*autoplay|<img[^>]*(?:onerror|onload|onsrc)\\\\s*=)~i"}], "cve": "CVE-2025-11502", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11502", "description": "Schema & Structured Data for WP & AMP <=1.51 Stored XSS via saswp_tiny_multiple_faq shortcode dangerous HTML elements in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.51"}, "RULE-CVE-2025-11504-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]plugins[/\\\\\\\\]quickcreator[/\\\\\\\\]dupasrala\\\\.txt~i"}], "cve": "CVE-2025-11504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11504", "description": "Quickcreator <=0.1.17 unauthenticated sensitive API key exposure via dupasrala.txt static file", "method": "GET", "mode": "block", "severity": 7.5, "slug": "quickcreator", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "cwe-532"], "target": "plugin", "versions": "<=0.1.17"}, "RULE-CVE-2025-11510-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/filebird/v1/fb-wipe-clear-all-data(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11510", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11510", "description": "FileBird <=6.4.9 missing authorization on fb-wipe-clear-all-data REST endpoint allows author+ to reset plugin data", "method": "POST", "mode": "block", "severity": 4.3, "slug": "filebird", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=6.4.9"}, "RULE-CVE-2025-11536-01": {"ajax_action": "import_elementor_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_elementor_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11536-02": {"ajax_action": "import_ep_elementor_bundle_template", "conditions": [{"name": "ARGS:import_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11536", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11536", "description": "Element Pack Addons for Elementor <=8.2.5 authenticated (Subscriber+) blind SSRF via import_ep_elementor_bundle_template AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "bdthemes-element-pack-lite", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.2.5"}, "RULE-CVE-2025-11564-01": {"ajax_action": "tutor_handle_api_calls", "conditions": [{"name": "ARGS:payment_type", "type": "equals", "value": "recurring"}], "cve": "CVE-2025-11564", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11564", "description": "Tutor LMS <=3.8.3 unauthenticated payment verification bypass via forged recurring payment webhook", "method": "POST", "mode": "block", "severity": 5.3, "slug": "tutor", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.8.3"}, "RULE-CVE-2025-11576-01": {"ajax_action": "newcodebyte_chatbot_send_message", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~^\\\\s*[=+\\\\-@]~"}], "cve": "CVE-2025-11576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11576", "description": "AI Chatbot Free Models <=1.6.5 unauthenticated CSV injection via chat message", "method": "POST", "mode": "block", "severity": 4.3, "slug": "chatbot-ai-free-models", "tags": ["csv-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-11587-01": {"action": "admin_post_cnb_apikey_activate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11587", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11587", "description": "Call Now Button <=1.5.3 missing authorization on API key activation via admin_post_cnb_apikey_activate", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2025-11627-01a": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (message)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01b": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11627-01c": {"ajax_action": "bill_minozzi_js_error_catched", "conditions": [{"name": "ARGS:error_msg", "type": "regex", "value": "~[\\\\x00-\\\\x08\\\\x0a-\\\\x1f]|%0[aAdD]|%00~i"}], "cve": "CVE-2025-11627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11627", "description": "Site Checkup <=1.47 unauthenticated log file poisoning via bill_minozzi_js_error_catched AJAX handler with newline/control character injection (error_msg)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "site-checkup", "tags": ["log-injection", "unauthenticated", "cwe-117", "denial-of-service"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-11632-01": {"ajax_action": "cnb_get_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-02": {"ajax_action": "cnb_request_billing_portal", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_request_billing_portal AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-03": {"ajax_action": "cnb_create_chat_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_create_chat_token AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-04": {"ajax_action": "cnb_get_domain_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_domain_status AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-05": {"ajax_action": "cnb_get_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-06": {"ajax_action": "cnb_get_agency_checkout", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_agency_checkout AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-07": {"ajax_action": "cnb_upgrade_to_yearly", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_upgrade_to_yearly AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-08": {"ajax_action": "cnb_enable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_enable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-09": {"ajax_action": "cnb_disable_chat", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_disable_chat AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-10": {"ajax_action": "cnb_get_plans", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_get_plans AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11632-11": {"ajax_action": "cnb_time_format", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11632", "description": "Call Now Button <=1.5.4 missing authorization on cnb_time_format AJAX handler", "mode": "block", "severity": 4.3, "slug": "call-now-button", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-11691-01": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:ppom_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via ppom_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11691-02": {"ajax_action": "ppom_ajax_validation", "conditions": [{"name": "ARGS:productmeta_id", "type": "regex", "value": "~[^0-9,]~"}], "cve": "CVE-2025-11691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11691", "description": "PPOM for WooCommerce <=33.0.15 unauthenticated SQL injection via productmeta_id parameter in ppom_ajax_validation AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-product-addon", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=33.0.15"}, "RULE-CVE-2025-11692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php path traversal", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11692-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]zip-attachments[/\\\\\\\\]download\\\\.php~i"}, {"name": "ARGS:za_real_filename", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-11692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11692", "description": "Zip Attachments <=1.6 unauthenticated arbitrary file read/delete via download.php targeting sensitive files", "method": "GET", "mode": "block", "severity": 5.3, "slug": "zip-attachments", "tags": ["missing-authorization", "arbitrary-file-deletion", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2025-11703-01": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~<[a-z!/][^>]*>~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - HTML tag injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-02": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - DOM event handler injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11703-03": {"ajax_action": "wpgmza_store_nominatim_cache", "conditions": [{"name": "ARGS:response", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-11703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11703", "description": "WP Go Maps <=9.0.48 unauthenticated cache poisoning via wpgmza_store_nominatim_cache - javascript URI injection in response parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-google-maps", "tags": ["cache-poisoning", "unauthenticated", "stored-xss"], "target": "plugin", "versions": "<=9.0.48"}, "RULE-CVE-2025-11705-01": {"ajax_action": "GOTMLS_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 authenticated arbitrary file read via GOTMLS_scan AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-02": {"ajax_action": "GOTMLS_View_Quarantine", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_View_Quarantine AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "information-disclosure", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-03": {"ajax_action": "GOTMLS_load_update", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_load_update AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-04": {"ajax_action": "GOTMLS_empty_trash", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_empty_trash AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-05": {"ajax_action": "GOTMLS_whitelist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_whitelist AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11705-06": {"ajax_action": "GOTMLS_fix", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11705", "description": "Anti-Malware Security and Brute-Force Firewall <=4.23.81 missing authorization on GOTMLS_fix AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "gotmls", "tags": ["missing-authorization", "authenticated"], "target": "plugin", "versions": "<=4.23.81"}, "RULE-CVE-2025-11706-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "aruba-hispeed-cache"}, {"name": "ARGS:dbstatus", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-11706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11706", "description": "Aruba HiSpeed Cache <=3.0.2 reflected cross-site scripting via dbstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "aruba-hispeed-cache", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-01": {"ajax_action": "ahsc_reset_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on plugin settings AJAX endpoints", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-02": {"ajax_action": "ahsc_enable_purge", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_purge AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-03": {"ajax_action": "ahsc_enable_cron", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on enable_cron AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-04": {"ajax_action": "ahsc_debug_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on debug_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-05": {"ajax_action": "ahsc_xmlrpc_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on xmlrpc_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-06": {"ajax_action": "ahsc_cron_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_status AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-07": {"ajax_action": "ahsc_cron_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cron_time AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-08": {"ajax_action": "ahsc_dboptimization", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dboptimization AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-09": {"ajax_action": "ahsc_purge_homepage_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_homepage_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-10": {"ajax_action": "ahsc_purge_archive_on_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_archive_on_edit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-11": {"ajax_action": "ahsc_purge_page_on_new_comment", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on purge_page_on_new_comment AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-12": {"ajax_action": "ahsc_static_cache", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on static_cache AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-13": {"ajax_action": "ahsc_lazy_load", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on lazy_load AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-14": {"ajax_action": "ahsc_html_optimizer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on html_optimizer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-15": {"ajax_action": "ahsc_dns_preconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-16": {"ajax_action": "ahsc_dns_preconnect_domain_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on dns_preconnect_domain_list AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-17": {"ajax_action": "ahsc_cache_warmer", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on cache_warmer AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-18": {"ajax_action": "ahsc_update_apc_Settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on update_apc_Settings AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-19": {"ajax_action": "ahsc_check_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on check_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-20": {"ajax_action": "ahsc_create_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on create_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11725-21": {"ajax_action": "ahsc_delete_apc_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11725", "description": "Aruba HiSpeed Cache <=3.0.2 missing authorization on delete_apc_file AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aruba-hispeed-cache", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-11726-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to create/update global presets", "method": "POST", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11726-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fl-controls/v1/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11726", "description": "Beaver Builder Lite <=2.9.4 missing authorization on fl-controls/v1 REST endpoints allows contributor+ to delete global presets", "method": "DELETE", "mode": "block", "severity": 4.3, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-11733-01": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:pre_footnotes", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via pre_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11733-02": {"action": "init", "conditions": [{"name": "ARGS:save_footnotes_made_easy_options", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post_footnotes", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11733", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11733", "description": "Footnotes Made Easy <=3.0.7 unauthenticated stored XSS via post_footnotes settings field", "method": "POST", "mode": "block", "severity": 7.2, "slug": "footnotes-made-easy", "tags": ["xss", "stored-xss", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.0.7"}, "RULE-CVE-2025-11734-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:^/wp-json)(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post|(?:^|&|\\\\?)rest_route=(?:/|%2F)aioseoBrokenLinkChecker(?:/|%2F)v1(?:/|%2F)post)(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-11734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11734", "description": "Broken Link Checker by AIOSEO <=1.2.5 missing authorization on DELETE /aioseoBrokenLinkChecker/v1/post allows contributor+ to trash arbitrary posts", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "broken-link-checker-seo", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-11745-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[adinserter[^\\\\]]*custom-field\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11745", "description": "Ad Inserter <=2.8.7 Stored XSS via [adinserter custom-field] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-inserter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.7"}, "RULE-CVE-2025-11749-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/messages~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11749-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json|[?&]rest_route=)/mwai/v1/[A-Za-z0-9_-]+/sse~"}], "cve": "CVE-2025-11749", "mode": "block", "severity": 9.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-11754-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gdpr/v1/settings(?:/)?(?:\\\\?|$)~"}, {"name": "ARGS:platform", "type": "equals", "value": "wordpress"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11754", "description": "GDPR Cookie Consent <=4.1.2 unauthenticated information disclosure via gdpr/v1/settings REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-11755-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipes(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipes", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/import_recipe_fields(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:https?://|//)[^ \\"\'<>]+\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:[?# \\"\';,]|$)~i"}], "cve": "CVE-2025-11755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11755", "description": "Delicious Recipes <=1.9.0 authenticated (Contributor+) arbitrary file upload via CSV recipe import REST endpoint /import_recipe_fields", "method": "POST", "mode": "block", "severity": 8.8, "slug": "delicious-recipes", "tags": ["arbitrary-file-upload", "unrestricted-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11758-01": {"ajax_action": "aio_time_clock_lite_admin_js", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-11758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11758", "description": "All in One Time Clock Lite <=2.0.3 missing authorization on admin AJAX handler allowing unauthenticated page creation and report download", "method": "POST", "mode": "block", "severity": 6.5, "slug": "aio-time-clock-lite", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-11765-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:stock[-_]tools)\\\\b[^\\\\]]*\\\\bimage_width\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<script\\\\b|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\"\'\\\\]]*[\\"\'][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11765", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11765", "description": "Stock Tools <=1.1 authenticated (Contributor+) stored XSS via image_width shortcode attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "stock-tools", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-11770-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[brighttalk-time\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<script|<img|<svg|<iframe|<object|<embed|<video|<audio|<math|<details|on(?:error|load|click|mouseover|focus|blur|mouse(?:enter|leave|move|out|up|down))\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11770", "description": "BrightTALK WordPress Shortcode <=2.4.0 Stored XSS via brighttalk-time shortcode format attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brighttalk-wp-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-11770-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[brighttalk-time\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<script|<img|<svg|<iframe|<object|<embed|<video|<audio|<math|<details|on(?:error|load|click|mouseover|focus|blur|mouse(?:enter|leave|move|out|up|down))\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11770", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11770", "description": "BrightTALK WordPress Shortcode <=2.4.0 Stored XSS via brighttalk-time shortcode format attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brighttalk-wp-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-11771-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tokenico/v1/create-sale-record(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11771", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11771", "description": "TokenICO <=2.4.7 unauthenticated presale counter manipulation via create-sale-record REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop", "tags": ["missing-authentication", "unauthorized-data-modification", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-11799-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[affiai_img\\\\b[^\\\\]]*asin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11799", "description": "Affiliate AI Lite <=1.0.1 Stored XSS via affiai_img shortcode asin attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-ai-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11799-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[affiai_img\\\\b[^\\\\]]*asin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11799", "description": "Affiliate AI Lite <=1.0.1 Stored XSS via affiai_img shortcode asin attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-ai-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11799-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[affiai_img\\\\b[^\\\\]]*asin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11799", "description": "Affiliate AI Lite <=1.0.1 Stored XSS via affiai_img shortcode asin attribute in post content (REST API update via PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "affiliate-ai-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11800-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[minicrm\\\\b[^\\\\]]*id\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:<|javascript\\\\s*:|on\\\\w+\\\\s*=)[^\\"\']*[\\"\']|[^\\\\s\\\\]\\\\\\"\']*(?:<|javascript\\\\s*:|on\\\\w+\\\\s*=)[^\\\\s\\\\]\\\\\\"\']*)~i"}], "cve": "CVE-2025-11800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11800", "description": "Surbma | MiniCRM Shortcode <=2.0 Stored XSS via minicrm shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "surbma-minicrm-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-11803-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpsite_y\\\\b[^\\\\]]*\\\\bformat\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y shortcode format attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor shortcode before attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_y\\\\b[^\\\\]]*\\\\bformat\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_y format attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11803-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpsite_postauthor\\\\b[^\\\\]]*\\\\bbefore\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11803", "description": "WPSite Shortcode <=1.2 Stored XSS via wpsite_postauthor before attribute through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpsite-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11805-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[skipto\\\\b[^\\\\]]*(?:(?:time|text|class)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|javascript\\\\s*:)|\\\\bon\\\\w+\\\\s*=\\\\s*[\\"\'])[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-11805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11805", "description": "Skip to Timestamp <=1.4.4 Stored XSS via skipto shortcode time/text/class attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "skip-to-timestamp", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-11806-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "[qzzr "}, {"name": "ARGS:post_content", "type": "regex", "value": "~quiz[ ]*=[ ]*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11806", "description": "Qzzr Shortcode <=1.0.1 Stored XSS via [qzzr] shortcode quiz attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qzzr-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11806-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[qzzr "}, {"name": "ARGS:content", "type": "regex", "value": "~quiz[ ]*=[ ]*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11806", "description": "Qzzr Shortcode <=1.0.1 Stored XSS via [qzzr] shortcode quiz attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "qzzr-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11810-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[print-button\\\\b[^\\\\]]*target\\\\s*=\\\\s*[\'\\"][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|img|svg|iframe|object|embed))~i"}], "cve": "CVE-2025-11810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11810", "description": "Print Button Shortcode <=1.0.1 authenticated stored XSS via [print-button] shortcode target attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "print-button-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11810-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[print-button\\\\b[^\\\\]]*target\\\\s*=\\\\s*[\'\\"][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|img|svg|iframe|object|embed))~i"}], "cve": "CVE-2025-11810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11810", "description": "Print Button Shortcode <=1.0.1 authenticated stored XSS via [print-button] shortcode target attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "print-button-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-11811-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[embed_youtube\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']|(?![\\"\'])\\\\S*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)\\\\S*)~i"}], "cve": "CVE-2025-11811", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11811", "description": "Simple Youtube Shortcode <=1.1.3 Stored XSS via embed_youtube shortcode id attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-youtube-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2025-11811-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[embed_youtube\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']|(?![\\"\'])\\\\S*(?:<|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)\\\\S*)~i"}], "cve": "CVE-2025-11811", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11811", "description": "Simple Youtube Shortcode <=1.1.3 Stored XSS via embed_youtube shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-youtube-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2025-11813-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[responsive_map\\\\b[^\\\\]]*(?:width|height)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\']*\')~i"}], "cve": "CVE-2025-11813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11813", "description": "Responsive iframe GoogleMap <=1.0.2 stored XSS via responsive_map shortcode width/height attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-iframe-googlemap", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11813-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[responsive_map\\\\b[^\\\\]]*(?:width|height)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript\\\\s*:)[^\']*\')~i"}], "cve": "CVE-2025-11813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11813", "description": "Responsive iframe GoogleMap <=1.0.2 stored XSS via responsive_map shortcode width/height attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "responsive-iframe-googlemap", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11816-01": {"ajax_action": "disconnect_account_request", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11816", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wplegalpages", "target": "plugin", "versions": "<=3.5.0"}, "RULE-CVE-2025-11820-03": {"ajax_action": "graphina_setting_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<img[^>]*\\\\bon|<iframe[\\\\s>]~i"}], "cve": "CVE-2025-11820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11820", "description": "Graphina - Elementor Charts and Graphs <=3.1.8 admin settings Stored XSS via graphina_setting_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-11821-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:<script|<iframe|<svg|<img[^>]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:post_content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:<script|<iframe|<svg|<img[^>]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11821-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "woo_products_custom_tax"}, {"name": "ARGS:content", "type": "regex", "value": "~woo_products_custom_tax[^\\\\]]*(?:<script|<iframe|<svg|<img[^>]+on\\\\w+\\\\s*=|on(?:error|load|click|mouseover|focus|mouseout)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11821", "description": "WooCommerce Products By Custom Tax <=2.2 stored XSS via woo_products_custom_tax shortcode through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-products-by-custom-tax", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-11822-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bootstrap_tab\\\\b[^\\\\]]*(?:name|link|active)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\\"|\'[^\']*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11822", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11822", "description": "WP Bootstrap Tabs <=1.0.4 Stored XSS via [bootstrap_tab] shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bootstrap-tabs", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-11822-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bootstrap_tab\\\\b[^\\\\]]*(?:name|link|active)\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\\"|\'[^\']*(?:<script|on(?:mouse|key|load|error|focus|blur|click|dblclick|change|submit|reset|select|abort|drag|drop|pointer|touch|wheel|animation|transition)[a-zA-Z0-9_]*\\\\s*=|javascript\\\\s*:)\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11822", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11822", "description": "WP Bootstrap Tabs <=1.0.4 Stored XSS via [bootstrap_tab] shortcode attributes in REST API content submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bootstrap-tabs", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-11823-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_exist_text\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_exist_text attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_exist_text\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_exist_text attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ever_compare\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via ever_compare shortcode button_text attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ever_compare\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via ever_compare shortcode button_text attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-05": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_text/button_added_text attributes (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11823-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button\\\\b[^\\\\]]*button_(?:text|added_text)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*<[^\\"\']*[\\"\']|\\\\S*<\\\\S*)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11823", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11823", "description": "ShopLentor (WooLentor) <=3.2.4 Stored XSS via wishsuite_button shortcode button_text/button_added_text attributes (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-11826-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[social-networks\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(on(mouseover|click|error|focus|load|keydown|keyup|mouseout|mouseenter|submit|change|input)\\\\s*=|<\\\\s*(script|img|iframe|svg|object|embed|link|style|body|input|form|video|audio|details|marquee)|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11826", "description": "WP Company Info <=1.9.0 Stored XSS via [social-networks] shortcode class attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-company-info", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11826-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[social-networks\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\"\'][^\\"\']*(on(mouseover|click|error|focus|load|keydown|keyup|mouseout|mouseenter|submit|change|input)\\\\s*=|<\\\\s*(script|img|iframe|svg|object|embed|link|style|body|input|form|video|audio|details|marquee)|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11826", "description": "WP Company Info <=1.9.0 Stored XSS via [social-networks] shortcode class attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-company-info", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-11827-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "[oboxads-ad-widget"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oboxads-ad-widget\\\\b[^\\\\]]*(?:before_widget|after_widget|before_title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<img|<svg|<iframe|<object|<embed|<link|<style|on(?:error|load|click|mouseover|focus|blur|change|submit|input|keydown|keyup|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11827", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11827", "description": "Oboxmedia Ads <=1.9.8 Stored XSS via oboxads-ad-widget shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "oboxmedia-ads", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-11827-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[oboxads-ad-widget"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oboxads-ad-widget\\\\b[^\\\\]]*(?:before_widget|after_widget|before_title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<img|<svg|<iframe|<object|<embed|<link|<style|on(?:error|load|click|mouseover|focus|blur|change|submit|input|keydown|keyup|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11827", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11827", "description": "Oboxmedia Ads <=1.9.8 Stored XSS via oboxads-ad-widget shortcode attributes in REST post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "oboxmedia-ads", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-11828-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:bnm-blocks/(?:featured-posts-1|featured-posts-2|slider|post-block-1|post-block-2|posts-ultra)\\\\s[\\\\s\\\\S]*?\\"(?:headerHtmlTag|titleHtmlTag)\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s=][^\\"]*\\"~i"}], "cve": "CVE-2025-11828", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11828", "description": "Magazine Companion (bnm-blocks) <=1.2.3 Stored XSS via headerHtmlTag/titleHtmlTag block attributes in REST API post creation", "mode": "block", "severity": 6.4, "slug": "bnm-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-11828-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:bnm-blocks/(?:featured-posts-1|featured-posts-2|slider|post-block-1|post-block-2|posts-ultra)\\\\s[\\\\s\\\\S]*?\\"(?:headerHtmlTag|titleHtmlTag)\\"\\\\s*:\\\\s*\\"[^\\"]*[\\\\s=][^\\"]*\\"~i"}], "cve": "CVE-2025-11828", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11828", "description": "Magazine Companion (bnm-blocks) <=1.2.3 Stored XSS via headerHtmlTag/titleHtmlTag block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bnm-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-11829-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[five9-chat\\\\b[^\\\\]]*toolbar\\\\s*=\\\\s*[\\"\'][^\\\\]]*(<script|on(error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11829", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11829", "description": "Five9 Live Chat <=1.1.2 authenticated (Contributor+) stored XSS via [five9-chat] shortcode toolbar attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "five9", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-11830-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[restaurant_summary\\\\b[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|\\\\bon[a-z]+=|javascript:|style\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11830", "description": "WP Restaurant Listings <=1.0.2 Stored XSS via restaurant_summary shortcode align attribute in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-restaurant-listings", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11830-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[restaurant_summary\\\\b[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|\\\\bon[a-z]+=|javascript:|style\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-11830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11830", "description": "WP Restaurant Listings <=1.0.2 Stored XSS via restaurant_summary shortcode align attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-restaurant-listings", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-11841-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "greenshift-blocks/chart"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<script[\\\\s>]|</script|\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11841", "description": "Greenshift \\u2013 animation and page builder blocks <=12.2.7 Stored XSS via Chart Data Attributes in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=12.2.7"}, "RULE-CVE-2025-11857-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mxp_fb2wp_display_embed\\\\b[^\\\\]]*\\\\bpost_id\\\\s*=\\\\s*(?:\\"(?!\\\\d+(?:_\\\\d+)?\\")([^\\"]*)\\"|\'(?!\\\\d+(?:_\\\\d+)?\')([^\']*)\'|(?!\\\\d+(?:_\\\\d+)?(?:\\\\s|\\\\]|$))([^\\\\s\\\\]\'\\\\\\"]+))~i"}], "cve": "CVE-2025-11857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11857", "description": "FB2WP Integration Tools <=1.9.9 Stored XSS via mxp_fb2wp_display_embed shortcode post_id attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fb2wp-integration-tools", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2025-11857-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mxp_fb2wp_display_embed\\\\b[^\\\\]]*\\\\bpost_id\\\\s*=\\\\s*(?:\\"(?!\\\\d+(?:_\\\\d+)?\\")([^\\"]*)\\"|\'(?!\\\\d+(?:_\\\\d+)?\')([^\']*)\'|(?!\\\\d+(?:_\\\\d+)?(?:\\\\s|\\\\]|$))([^\\\\s\\\\]\'\\\\\\"]+))~i"}], "cve": "CVE-2025-11857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11857", "description": "FB2WP Integration Tools <=1.9.9 Stored XSS via mxp_fb2wp_display_embed shortcode post_id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fb2wp-integration-tools", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2025-11863-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[mygeo_(?:city|country_code|country_name|region|latitude|longitude|postal_code)\\\\b[^\\\\]]*default\\\\s*=\\\\s*[\'\\"]?[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11863", "description": "My Geo Posts Free <=1.2 Stored XSS via mygeo_* shortcode default attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-geo-posts-free", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11863-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mygeo_(?:city|country_code|country_name|region|latitude|longitude|postal_code)\\\\b[^\\\\]]*default\\\\s*=\\\\s*[\'\\"]?[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-11863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11863", "description": "My Geo Posts Free <=1.2 Stored XSS via mygeo_* shortcode default attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-geo-posts-free", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11872-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post\\\\.php|post-new\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mdiconic\\\\b[^\\\\]]*(?:\\\\s+on[a-z]+\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s*(?:style|class)\\\\s*=)~i"}], "cve": "CVE-2025-11872", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11872", "description": "Material Design Iconic Font Integration <=2 Stored XSS via [mdiconic] shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "material-design-iconic-font-integration", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2"}, "RULE-CVE-2025-11872-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mdiconic\\\\b[^\\\\]]*(?:\\\\s+on[a-z]+\\\\s*=|javascript\\\\s*:|\\\\x22\\\\s*(?:style|class)\\\\s*=)~i"}], "cve": "CVE-2025-11872", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11872", "description": "Material Design Iconic Font Integration <=2 Stored XSS via [mdiconic] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "material-design-iconic-font-integration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2"}, "RULE-CVE-2025-11873-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[url\\\\s*=\\\\s*(?:javascript|vbscript|data)\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11873", "description": "WP BBCode <=1.8.1 authenticated (Contributor+) Stored XSS via [url] BBCode shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bbcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.1"}, "RULE-CVE-2025-11873-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[url\\\\s*=[^\\\\]]*[\\"\']\\\\s*on\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11873", "description": "WP BBCode <=1.8.1 authenticated (Contributor+) Stored XSS via [url] BBCode attribute injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bbcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.1"}, "RULE-CVE-2025-11873-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[url[^\\\\]]*\\\\][^\\\\[]*<\\\\s*(?:script|img|svg|iframe|object|embed|details|marquee|math|body|input|form|link|meta|style|base)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11873", "description": "WP BBCode <=1.8.1 authenticated (Contributor+) Stored XSS via HTML injection in [url] BBCode inner text", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-bbcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.8.1"}, "RULE-CVE-2025-11876-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mailgun_subscription_form\\\\b[^\\\\]]*(?:<(?:script|svg|iframe|embed|object|math|details|img|video|audio|body|input|select|textarea|button|form|link|style|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|change|input|submit|pointerover|mouseenter|dblclick|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11876", "description": "Mailgun Subscriptions <=1.3.1 Stored XSS via mailgun_subscription_form shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mailgun-subscriptions", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-11881-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/myappp-verify(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via myappp-verify REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11881-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appp/v1/system-info(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11881", "description": "AppPresser <=4.5.0 unauthenticated information disclosure via system-info REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "apppresser", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2025-11917-01": {"ajax_action": "wpematico_test_feed", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp)://|://(?:localhost|\\\\[?::1\\\\]?|0x[0-9a-f]|0[0-7]{2,}|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.)|://[^/?#]*@)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11917", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11917", "description": "WPeMatico RSS Feed Fetcher <=2.8.11 authenticated (Subscriber+) SSRF via wpematico_test_feed AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpematico", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2025-11923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/students/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11923-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/llms/v1/instructors/\\\\d+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11923", "mode": "block", "severity": 8.8, "slug": "lifterlms", "target": "plugin", "versions": ">=3.5.3 <=9.1.0"}, "RULE-CVE-2025-11924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?forms/\\\\d+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated IDOR on ninja-forms-views REST submissions endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["idor", "missing-authorization", "unauthenticated", "rest-api", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11924-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/(?:v1/)?token/refresh(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11924", "description": "Ninja Forms <=3.13.2 unauthenticated bearer token minting via ninja-forms-views REST token/refresh endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated", "rest-api", "token-minting"], "target": "plugin", "versions": "<=3.13.2"}, "RULE-CVE-2025-11928-01": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_set_property AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11928-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|embed|object|form|meta|base|link)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|input|invalid|reset|search|select|drag|drop|copy|cut|paste|abort|canplay|ended|pause|play|progress|ratechange|seeked|seeking|stalled|suspend|waiting|toggle|popstate|hashchange|beforeunload|unload|message|storage|animationstart|animationend|animationiteration|transitionend)\\\\s*=|javascript\\\\s*:/~i"}], "cve": "CVE-2025-11928", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11928", "description": "CSS & JavaScript Toolbox <=12.0.5 Stored XSS via cjtoolbox_create AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "css-javascript-toolbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=12.0.5"}, "RULE-CVE-2025-11976-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fusewp_save_sync_rule", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11976", "description": "FuseWP <=1.1.23.0 CSRF to sync rule creation/edit via missing nonce and capability check on save_changes()", "method": "POST", "mode": "block", "severity": 4.3, "slug": "fusewp", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23.0"}, "RULE-CVE-2025-11986-01": {"ajax_action": "crypto_connect_ajax_process", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-11986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11986", "description": "Crypto plugin <=2.22 unauthenticated auth bypass and data injection via crypto_connect_ajax_process AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "crypto", "tags": ["missing-authentication", "authentication-bypass", "unauthenticated", "information-exposure"], "target": "plugin", "versions": "<=2.22"}, "RULE-CVE-2025-11987-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11987-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/)?(?:\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[visual-link-preview\\\\b[^\\\\]]*(?:<[a-z/!]|(?:\\\\s|\\"|\')on[a-z]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-11987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11987", "description": "Visual Link Preview <=2.2.7 Stored XSS via visual-link-preview shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "visual-link-preview", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-11994-01": {"action": "init", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-11994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11994", "description": "Easy Email Subscription <=1.3 unauthenticated stored XSS via subscription form name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "email-subscription-with-secure-captcha", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-11995-01": {"action": "init", "conditions": [{"name": "ARGS:eventdesc", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event description field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-02": {"action": "init", "conditions": [{"name": "ARGS:eventname", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event name field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-03": {"action": "init", "conditions": [{"name": "ARGS:eventaddress", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-04": {"action": "init", "conditions": [{"name": "ARGS:eventticket", "type": "detectXSS"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated stored XSS via event ticket address field in front-end submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-05": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:year", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via year parameter in community_events_frontend_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-06": {"ajax_action": "community_events_admin_list", "conditions": [{"name": "ARGS:currentyear", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via currentyear parameter in community_events_admin_list AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11995-07": {"ajax_action": "community_events_click_tracker", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-11995", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11995", "description": "Community Events <=1.5.2 unauthenticated reflected XSS via id parameter in community_events_click_tracker AJAX handler", "mode": "block", "severity": 7.2, "slug": "community-events", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-11999-01": {"ajax_action": "addmultiplemarker_reset_map", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated map reset via addmultiplemarker_reset_map AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "data-deletion"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-11999-02": {"ajax_action": "amm_save_map_api", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-11999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-11999", "description": "Add Multiple Marker <=1.2 unauthenticated API key overwrite via amm_save_map_api AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "add-multiple-marker", "tags": ["missing-authorization", "unauthenticated", "settings-manipulation"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2025-12000-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpfunnels/v1/settings(/|\\\\?|&|$)~"}, {"name": "ARGS:logKey", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e|%252e%252e)[%/\\\\\\\\]|[\\\\\\\\/]etc[\\\\\\\\/]|(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])(?:debug\\\\.log|error_log)(?:$|[\\\\\\\\/])))~i"}], "cve": "CVE-2025-12000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12000", "description": "WPFunnels <=3.6.2 authenticated arbitrary file deletion via path traversal in logKey parameter on REST settings endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpfunnels", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12010-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated (Contributor+) sensitive information exposure via {al:*} shortcode placeholders in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-02": {"ajax_action": "update_authors_list_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 unauthenticated sensitive information exposure via update_authors_list_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12010-03": {"ajax_action": "authors_list_display_edit_item_preview_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\{al:\\\\s*(?:user_pass|user_activation_key|user_email|user_login|user_registered|user_status)\\\\}~i"}], "cve": "CVE-2025-12010", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12010", "description": "Authors List <=2.0.6.1 authenticated sensitive information exposure via authors_list_display_edit_item_preview_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "authors-list", "tags": ["sensitive-information-exposure", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.0.6.1"}, "RULE-CVE-2025-12018-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fnd]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fnd] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[rsp]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[rsp] admin setting (attribute context)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mol]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mol] member login message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moe]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moe] membership expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[mon]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[mon] no-access message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[moi]", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[moi] session expired message", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[org]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[org] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[out]", "type": "regex", "value": "~(?:javascript\\\\s*:|\\"\\\\s*(?:on\\\\w+\\\\s*=|>)|<\\\\s*(?:script|img|svg|iframe))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[out] logout redirect URL", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[top]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[top] data attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[fbk]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[fbk] Facebook App ID attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12018-11": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "sf_admin_group"}, {"name": "ARGS:sf_set[map]", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12018", "description": "MembershipWorks <=6.14 stored XSS via sf_set[map] Google Maps API key attribute injection", "method": "POST", "mode": "block", "severity": 4.4, "slug": "memberfindme", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=6.14"}, "RULE-CVE-2025-12021-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on wp-login.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12021-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~login-google\\\\.php~"}, {"name": "ARGS:error_description", "type": "detectXSS"}], "cve": "CVE-2025-12021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12021", "description": "WP-OAuth <=0.4.1 Reflected XSS via error_description parameter on login-google.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-oauth", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-12025-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_ytcs_title]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via title setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12025-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:sm_ytcs_option[sm_youtube_channel_id]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>]|\\"|\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12025", "description": "YouTube Subscribe <=3.0.0 Authenticated (Admin+) Stored XSS via channel ID setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "easy-youtube-subscribe", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-12028-01": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization POST confirmation via wp-login.php?action=indieauth", "method": "POST", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-02": {"action": "login_form_indieauth", "conditions": [{"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF on OAuth authorization GET initiation via wp-login.php?action=indieauth", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/indieauth/1\\\\.0/auth(?:/|\\\\?|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12028-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/indieauth/1\\\\.0/auth(?:/|$)~"}, {"name": "ARGS:client_id", "type": "regex", "value": "~^https?://~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^https?://~i"}], "cve": "CVE-2025-12028", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12028", "description": "IndieAuth <=4.5.4 CSRF via REST auth endpoint missing PKCE requirements (rest_route=/indieauth/1.0/auth)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "indieauth", "tags": ["csrf", "account-takeover", "oauth", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-12032-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_messager", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized messager setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_zalo", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized zalo setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_hotline", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized hotline setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12032-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:vithanhlam_zsocial_save_contact", "type": "detectXSS"}], "cve": "CVE-2025-12032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12032", "description": "Zweb Social Mobile <=1.0.0 stored XSS via unsanitized contact setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "zweb-social-mobile", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12034-01": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][domain]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN domain settings field (domain key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12034-02": {"action": "admin_init", "conditions": [{"name": "ARGS:fvm_settings[cdn][url]", "type": "regex", "value": "~[\\"\'<>]~"}], "cve": "CVE-2025-12034", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12034", "description": "Fast Velocity Minify <=3.5.1 Stored XSS via CDN url settings field (legacy url key)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fast-velocity-minify", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-12042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]course-booking-system[/\\\\\\\\](includes[/\\\\\\\\])?csv-export\\\\.php([?#]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12042", "description": "Course Booking System <=6.1.5 unauthenticated booking data export via direct access to csv-export.php", "method": "GET", "mode": "block", "severity": 5.3, "slug": "course-booking-system", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-12045-01": {"ajax_action": "add-tag", "conditions": [{"name": "ARGS:tag-name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via taxonomy term name in add-tag AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/tags(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via tag name through REST /wp/v2/tags endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12045-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/categories(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "detectXSS"}], "cve": "CVE-2025-12045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12045", "description": "Orbit Fox Companion <=3.0.2 Stored XSS via category name through REST /wp/v2/categories endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeisle-companion", "tags": ["xss", "stored-xss", "rest-api", "taxonomy"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-12062-01": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_name parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12062-02": {"ajax_action": "core_templates", "conditions": [{"name": "ARGS:template_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-12062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12062", "description": "WP Maps plugin <=4.8.6 Local File Inclusion via template_type parameter in core_templates AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-google-map-plugin", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=4.8.6"}, "RULE-CVE-2025-12064-01": {"ajax_action": "xyz_fbap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12064-02": {"ajax_action": "xyz_fbap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12064", "description": "WP2Social Auto Publish <=2.4.7 Reflected XSS via xyzscripts_user_hash in xyz_fbap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "facebook-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2025-12066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpedpcampaign"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|(?:src|href|action)\\\\s*=\\\\s*[\\"\']?javascript:|xmlns)|<\\\\s*(?:script|iframe|object|embed|svg|math)~i"}], "cve": "CVE-2025-12066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12066", "description": "WP Delete Post Copies <=6.0.2 stored XSS via campaign meta box fields on save_post", "method": "POST", "mode": "block", "severity": 4.4, "slug": "etruel-del-post-copies", "tags": ["xss", "stored-xss", "admin-plus"], "target": "plugin", "versions": "<=6.0.2"}, "RULE-CVE-2025-12067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via table cell content in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~\\"c\\"\\\\s*:\\\\s*\\".*(?:<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|toggle|change|input)\\\\s*=|javascript\\\\s*:).*\\"~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12067", "description": "Table Field Add-on for ACF and SCF <=1.3.30 authenticated (Contributor+) stored XSS via REST API post update with table cell content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-table-field", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.30"}, "RULE-CVE-2025-12076-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via ln_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:th_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via th_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:tw_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via tw_auth_err parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "social-media-auto-publish"}, {"name": "ARGS:xyz_smap_bot_token", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyz_smap_bot_token parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-05": {"ajax_action": "xyz_smap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-06": {"ajax_action": "xyz_smap_del_ln_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ln_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-07": {"ajax_action": "xyz_smap_del_tw_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_tw_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-08": {"ajax_action": "xyz_smap_del_ig_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_ig_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-09": {"ajax_action": "xyz_smap_del_fb_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_fb_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-10": {"ajax_action": "xyz_smap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-11": {"ajax_action": "xyz_smap_del_twuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_twuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12076-12": {"ajax_action": "xyz_smap_del_iguser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12076", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12076", "description": "Social Media Auto Publish <=3.6.5 reflected XSS via xyzscripts_user_hash in xyz_smap_del_iguser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "social-media-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2025-12077-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedin-auto-publish"}, {"name": "ARGS:ln_auth_err", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via ln_auth_err parameter on plugin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-02": {"ajax_action": "xyz_lnap_del_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12077-03": {"ajax_action": "xyz_lnap_del_lnuser_entries", "conditions": [{"name": "ARGS:xyzscripts_user_hash", "type": "detectXSS"}], "cve": "CVE-2025-12077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12077", "description": "WP to LinkedIn Auto Publish <=1.9.8 reflected XSS via xyzscripts_user_hash in xyz_lnap_del_lnuser_entries AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-auto-publish", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.9.8"}, "RULE-CVE-2025-12089-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache()", "method": "POST", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12089-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "supsystic-tables"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]){2,}.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-12089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12089", "description": "Data Tables Generator by Supsystic <=1.10.45 authenticated arbitrary file deletion via path traversal in cleanCache() (GET admin page)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "data-tables-generator-by-supsystic", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.10.45"}, "RULE-CVE-2025-12092-01-0": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[0]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-1": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[1]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-2": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[2]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-3": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[3]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12092-01-4": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cyan-backup"}, {"name": "ARGS:remove[4]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-12092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12092", "description": "CYAN Backup <=2.5.4 authenticated arbitrary file deletion via path traversal in backup remove parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cyan-backup", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-12099-01": {"ajax_action": "academy/course/import_all_courses", "conditions": [{"name": "ARGS:import_all_courses", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-12099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12099", "description": "Academy LMS <=3.3.8 authenticated PHP Object Injection via import_all_courses AJAX action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "academy", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2025-12109-01": {"action": "init", "conditions": [{"name": "ARGS:asm_header_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_header_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-02": {"action": "init", "conditions": [{"name": "ARGS:asm_body_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_body_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12109-03": {"action": "init", "conditions": [{"name": "ARGS:asm_footer_scripts", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|meta)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|key(?:down|up|press)|submit|change|input|reset)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12109", "description": "Header Footer Script Adder <=2.0.5 authenticated (Contributor+) stored XSS via asm_footer_scripts parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "header-and-footer-script-adder", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2025-12115-01": {"action": "init", "conditions": [{"name": "ARGS:add-to-cart", "type": "exists"}, {"name": "ARGS:woonp", "type": "exists"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/\\\\?|\\\\?|&)(?:add-to-cart=)~"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in add-to-cart POST", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12115-02": {"action": "init", "conditions": [{"name": "ARGS:woonp", "type": "exists"}], "cve": "CVE-2025-12115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12115", "description": "WPC Name Your Price for WooCommerce <=2.1.9 unauthenticated price alteration via woonp parameter in GET request", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpc-name-your-price", "tags": ["business-logic", "price-manipulation", "unauthenticated", "client-side-enforcement-bypass"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-12126-01": {"ajax_action": "ttbp_add_chapter", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to add chapters to others\' books via ttbp_add_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-02": {"ajax_action": "ttbp_delete_chapter", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to delete others\' chapters via ttbp_delete_chapter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-03": {"ajax_action": "ttbp_update_chapter_order", "conditions": [{"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reorder others\' chapters via ttbp_update_chapter_order", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12126-04": {"ajax_action": "ttbp_assign_chapter_to_book", "conditions": [{"name": "ARGS:chapter_id", "type": "exists"}, {"name": "ARGS:book_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-12126", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126", "description": "The Total Book Project <=1.0.0 IDOR allows Contributor+ to reassign others\' chapters via ttbp_assign_chapter_to_book", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-total-book-project", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12129-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp-posts/v1/query-new(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-12129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12129", "description": "CubeWP Framework <=1.1.27 unauthenticated information exposure via /cubewp-posts/v1/query-new REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "cubewp-framework", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/importwp/v1/importer/\\\\d+/file(?:/|\\\\?|$)~"}, {"name": "ARGS:local_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|/etc/shadow|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}], "cve": "CVE-2025-12137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12137", "description": "Import WP <=2.14.16 authenticated (admin+) arbitrary file read via local_url parameter in REST API file_local import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "jc-importer", "tags": ["arbitrary-file-read", "path-traversal", "rest-api"], "target": "plugin", "versions": "<=2.14.16"}, "RULE-CVE-2025-12138-01": {"ajax_action": "uimptr_import_single_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~\\\\.(?:php\\\\d?|phps|phtml|pht|phar)(?:[/?#%&\\"\'<>\\\\s]|%[0-9a-fA-F]{2}|$)~i"}], "cve": "CVE-2025-12138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12138", "description": "URL Image Importer <=1.0.6 authenticated (Author+) arbitrary file upload via uimptr_import_single_url AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "url-image-importer", "tags": ["arbitrary-file-upload", "content-type-spoofing", "authenticated"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-12151-01": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "add_simple_folio"}, {"name": "ARGS:portfolio_name", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via portfolio_name parameter in add_simple_folio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12151-02": {"action": "admin_init", "conditions": [{"name": "ARGS:simple_folio_action", "type": "equals", "value": "remove_portfolio"}, {"name": "ARGS:id", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12151", "description": "Simple Folio <=1.1.0 Stored XSS via id parameter in remove_portfolio handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-12159-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_raw_content shortcode in post_content field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-03": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12159-04": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bt_bb_raw_content[\\\\s\\\\]>]~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<|&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:script|iframe|embed|object|svg|math|details)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|animationend|beforeprint)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12159", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12159", "description": "Bold Page Builder <=5.4.8 Stored XSS via bt_bb_fe_get_html AJAX handler processing bt_bb_raw_content shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=5.4.8"}, "RULE-CVE-2025-12160-01A": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01B": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[all]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[all] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01C": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[subscriber]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[subscriber] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01D": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[editor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[editor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01E": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[author]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[author] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01F": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[contributor]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[contributor] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12160-01G": {"ajax_action": "admin_send_message_user", "conditions": [{"name": "ARGS:wpr_admin_msg[administrator]", "type": "detectXSS"}], "cve": "CVE-2025-12160", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12160", "description": "Simple User Registration <=6.6 unauthenticated stored XSS via wpr_admin_msg[administrator] in admin_send_message_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-registration", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.6"}, "RULE-CVE-2025-12161-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<img[^>]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12161-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~<img[^>]+src=[\\"\']https?://[^\\"\']+\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)(?:(?:%[0-9A-Fa-f]{2})|[?#\\"\'\\\\s>])~i"}], "cve": "CVE-2025-12161", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12161", "description": "Smart Auto Upload Images <=1.2.0 arbitrary file upload via external URL with dangerous extension in post content (REST API)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "smart-auto-upload-images", "tags": ["arbitrary-file-upload", "unsafe-file-type", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-12170-01": {"ajax_action": "checkbox_clean_log", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12170", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12170", "description": "Checkbox <=2.8.10 missing authorization on checkbox_clean_log AJAX endpoint allows unauthenticated log clearing", "mode": "block", "severity": 5.3, "slug": "checkbox", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.8.10"}, "RULE-CVE-2025-12192-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe_events/v2/[^/]{0,5}/sysinfo~"}], "cve": "CVE-2025-12192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12192", "description": "The Events Calendar <=6.15.9 unauthenticated information disclosure via sysinfo REST endpoint loose key comparison", "method": "GET", "mode": "block", "severity": 5.3, "slug": "the-events-calendar", "tags": ["information-disclosure", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-12197-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/tec/v[0-9]+/events(?:\\\\?|$)|\\\\?rest_route=/tec/v[0-9]+/events(?:&|$))~i"}, {"name": "ARGS:/^(?:search|s)$/", "type": "regex", "value": "~(?i)(?:(?:sleep|pg_sleep|benchmark)\\\\s*\\\\(|waitfor\\\\s+(?:delay|nowait)\\\\b)~"}], "cve": "CVE-2025-12197", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12197", "description": "The Events Calendar 6.15.1.1-6.15.9 unauthenticated blind SQL injection via the search parameter on the /wp-json/tec/v*/events REST endpoint. CVE-2025-12197 is an incomplete-fix continuation of CVE-2025-9807; the Custom_Tables_Query.php sink remained exploitable through 6.15.9. Fixed completely in 6.15.10.", "method": "GET", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sqli", "blind-sqli", "rest-api", "unauthenticated", "incomplete-fix"], "target": "plugin", "versions": "<=6.15.9"}, "RULE-CVE-2025-1232-01": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:title", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review title on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-1232-02": {"action": "init", "conditions": [{"name": "ARGS:_action", "type": "equals", "value": "submit-review"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:iframe|script|embed|object|form|meta|link|base)\\\\b|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-1232", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1232", "description": "Site Reviews <=7.2.4 unauthenticated stored XSS via review content on submit-review action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "site-reviews", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.2.4"}, "RULE-CVE-2025-12324-01": {"ajax_action": "tablepress_save", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\'\\"]\\\\s*\\\\)\\\\s*;|</script|<script|\\\\\\\\x3c\\\\s*script)~i"}], "cve": "CVE-2025-12324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12324", "description": "TablePress <=3.2.4 Authenticated (Contributor+) Stored XSS via DataTables datetime format JS injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "javascript-injection"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2025-12348-01": {"ajax_action": "ig_es_run_action_scheduler_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12348", "description": "Icegram Express (Email Subscribers) <=5.9.10 unauthenticated scheduled task execution via ig_es_run_action_scheduler_task AJAX (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "email-subscribers", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=5.9.10"}, "RULE-CVE-2025-12348-02": {"ajax_action": "ig_es_run_action_scheduler_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12348", "description": "Icegram Express (Email Subscribers) <=5.9.10 unauthenticated scheduled task execution via ig_es_run_action_scheduler_task AJAX (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "email-subscribers", "tags": ["missing-authentication", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=5.9.10"}, "RULE-CVE-2025-12353-01": {"ajax_action": "wpfnl_optin_submission", "conditions": [{"name": "ARGS:optin_allow_registration", "type": "equals", "value": "yes"}], "cve": "CVE-2025-12353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12353", "description": "WPFunnels <=3.6.2 unauthorized user registration via optin_allow_registration parameter on wpfnl_optin_submission AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpfunnels", "tags": ["authorization-bypass", "user-registration", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12353-02": {"ajax_action": "wpfnl_gutenberg_optin_submission", "conditions": [{"name": "ARGS:optin_allow_registration", "type": "equals", "value": "yes"}], "cve": "CVE-2025-12353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12353", "description": "WPFunnels <=3.6.2 unauthorized user registration via optin_allow_registration parameter on wpfnl_gutenberg_optin_submission AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpfunnels", "tags": ["authorization-bypass", "user-registration", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12353-03": {"ajax_action": "wpfnl_shortcode_optin_submission", "conditions": [{"name": "ARGS:optin_allow_registration", "type": "equals", "value": "yes"}], "cve": "CVE-2025-12353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12353", "description": "WPFunnels <=3.6.2 unauthorized user registration via optin_allow_registration parameter on wpfnl_shortcode_optin_submission AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpfunnels", "tags": ["authorization-bypass", "user-registration", "unauthenticated"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-12359-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/block-renderer/|\\\\?(?:.*&)?rest_route=/wp/v2/block-renderer/)~"}, {"name": "ARGS:attributes[imageURL]", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12359-02": {"ajax_action": "rl-get-preview-content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12359-03": {"ajax_action": "rl-get-gallery-page-content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12359-04": {"ajax_action": "rl-post-gallery-preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^https?://(?:\\\\[?(?:(?:::1)|(?:0:0:0:0:0:0:0:1))\\\\]?|(?:127(?:\\\\.[0-9]{1,3}){3})|(?:169\\\\.254(?:\\\\.[0-9]{1,3}){2})|(?:10(?:\\\\.[0-9]{1,3}){3})|(?:192\\\\.168(?:\\\\.[0-9]{1,3}){2})|(?:172\\\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\\\.[0-9]{1,3}){2})|(?:localhost))(?:[:/]|$)~i"}], "cve": "CVE-2025-12359", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-12368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sermon-views\\\\b[^\\\\]]*(?:<script|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-12368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12368", "description": "Sermon Manager <=2.30.0 Stored XSS via sermon-views shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sermon-manager-for-wordpress", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.30.0"}, "RULE-CVE-2025-12371-01": {"ajax_action": "nari100", "conditions": [{"name": "ARGS:do", "type": "equals", "value": "save"}, {"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,} *=~i"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Stored XSS via account save action", "method": "POST", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12371-02": {"ajax_action": "nari100", "conditions": [{"name": "ARGS:by", "type": "detectXSS"}], "cve": "CVE-2025-12371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12371", "description": "Nari Accountant <=1.0.12 Authenticated (Editor+) Reflected XSS via by parameter", "mode": "block", "severity": 4.4, "slug": "nari-accountant", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.0.12"}, "RULE-CVE-2025-12375-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/printful/v2/advanced-size-chart(/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~://(?:localhost|127\\\\.|10\\\\.|0\\\\.|169\\\\.254|172\\\\.(?:1[6-9]|2\\\\d|3[01])|192\\\\.168|\\\\[::1\\\\]|\\\\[0:|0\\\\.0\\\\.0\\\\.0)~i"}], "cve": "CVE-2025-12375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12375", "description": "Printful Integration for WooCommerce <=2.2.11 authenticated SSRF via advanced size chart REST API endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "printful-shipping-for-woocommerce", "tags": ["ssrf", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.2.11"}, "RULE-CVE-2025-12376-01": {"ajax_action": "fs_api_request", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "fs_api_request"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:https?:)?//~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12376", "description": "Icon List Block <=1.2.1 authenticated (Subscriber+) SSRF via fs_api_request AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "icon-list-block", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12379-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:title_tag|title_tag_secondary)(?:\\\\\\\\?[\\"\']\\\\s*:\\\\s*\\\\\\\\?[\\"\'])(?!(?:h[1-6]|div|span|p)\\\\\\\\?[\\"\'])~i"}], "cve": "CVE-2025-12379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12379", "description": "Auxin Elements <=2.17.13 Stored XSS via Modern Heading widget title_tag/title_tag_secondary in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auxin-elements", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.17.13"}, "RULE-CVE-2025-12384-01": {"ajax_action": "bplde_save_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document creation/update via bplde_save_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-02": {"ajax_action": "bplde_get_all", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document listing via bplde_get_all AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-03": {"ajax_action": "bplde_get_single", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document read via bplde_get_single AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12384-04": {"ajax_action": "bplde_delete_document_library", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12384", "description": "Document Embedder <=2.0.0 unauthenticated document deletion via bplde_delete_document_library AJAX action", "method": "POST", "mode": "block", "severity": 8.6, "slug": "document-emberdder", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-12388-01": {"ajax_action": "bicbPipeChecker", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|localhost|0x7f000001|2130706433|\\\\[::1\\\\]|\\\\[::ffff:|169\\\\.254\\\\.)|\\\\.internal[/:\\\\s]|^(?!https?://).+://)~i"}], "cve": "CVE-2025-12388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12388", "description": "B Carousel Block <=1.1.5 authenticated (Subscriber+) SSRF via bicbPipeChecker AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "b-carousel-block", "tags": ["ssrf", "missing-authorization", "server-side-request-forgery"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12392-01": {"action": "admin_post_nopriv_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows unauthenticated tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12392-02": {"action": "admin_post_handle_optin_optout", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "handle_optin_optout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12392", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12392", "description": "TripleA Cryptocurrency Payment Gateway for WooCommerce <=2.0.25 missing authorization on handle_optin_optout allows low-privilege tracking status update", "mode": "block", "severity": 5.3, "slug": "triplea-cryptocurrency-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.25"}, "RULE-CVE-2025-12402-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "ARGS:update_linkedinresumeSettings", "type": "exists"}, {"name": "ARGS:linkedinId", "type": "detectXSS"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 CSRF to Stored XSS via unsanitized linkedinId parameter in admin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12402-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "linkedinresume.php"}, {"name": "REQUEST_URI", "type": "regex", "value": "~<script[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|%3Cscript|%3E%3Cscript~i"}], "cve": "CVE-2025-12402", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12402", "description": "LinkedIn Resume <=2.00 Reflected XSS via unsanitized REQUEST_URI in admin page form action", "mode": "block", "severity": 6.1, "slug": "linkedin-resume", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=2.00"}, "RULE-CVE-2025-12406-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:access_key", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via access_key parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot1", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot1 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:honey_pot2", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via honey_pot2 parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "ARGS:update_honeyPotSettings", "type": "exists"}, {"name": "ARGS:output_to_all", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 CSRF to Stored XSS via output_to_all parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12406-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "project-honey-pot-spam-trap"}, {"name": "REQUEST_URI", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|(?:^|[\\\\s\\"\'<>])on[a-z]+\\\\s*=|%3c[a-z/!]|%6a%61%76%61%73%63%72%69%70%74~i"}], "cve": "CVE-2025-12406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12406", "description": "Project Honey Pot Spam Trap <=1.0.1 Reflected XSS via REQUEST_URI in settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "project-honey-pot-spam-trap", "tags": ["csrf", "xss", "reflected-xss"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12408-01": {"action": "init", "conditions": [{"name": "ARGS:em_ajax_action", "type": "equals", "value": "get_location"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12408", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12408", "description": "Events Manager <=7.2.2.2 unauthenticated information exposure via get_location custom AJAX dispatcher", "mode": "block", "severity": 5.3, "slug": "events-manager", "tags": ["information-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.2.2.2"}, "RULE-CVE-2025-12448-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smartsupp"}, {"name": "ARGS:ssaction", "type": "equals", "value": "update"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12448", "description": "Smartsupp \\u2013 live chat, AI shopping assistant and chatbots <=3.9.1 authenticated (Subscriber+) unauthorized settings update via code parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smartsupp-live-chat", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-12449-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_settings AJAX action exposes sensitive API keys to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_settings AJAX action allows Subscriber+ to modify plugin settings and API keys", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/save_block_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on save_block_visibility AJAX action allows Subscriber+ to toggle block visibility", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-04": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/get_blocks_visibility"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on get_blocks_visibility AJAX action exposes block configuration to Subscriber+", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12449-05": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ablocks/fetch_posts"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12449", "description": "aBlocks <= 2.4.0 missing authorization on fetch_posts AJAX action allows Subscriber+ to enumerate posts", "mode": "block", "severity": 5.4, "slug": "ablocks", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-12450-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^litespeed~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|on(?:error|load|focus|click|mouseover)\\\\s*=)~i"}], "cve": "CVE-2025-12450", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12450", "description": "LiteSpeed Cache <=7.5.0.1 Reflected XSS via unsanitized REQUEST_URI in admin page form_action output", "method": "GET", "mode": "block", "severity": 6.1, "slug": "litespeed-cache", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.5.0.1"}, "RULE-CVE-2025-12451-01": {"ajax_action": "svg_get_attachment_url", "conditions": [{"name": "ARGS:attachmentID", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-12451", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12451", "description": "Easy SVG Support <=4.0 authenticated stored XSS via missing authorization on svg_get_attachment_url AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "easy-svg", "tags": ["xss", "missing-authorization", "stored-xss", "svg-upload"], "target": "plugin", "versions": "<=4.0"}, "RULE-CVE-2025-12456-01": {"ajax_action": "cai_ajaxaction", "conditions": [{"name": "ARGS:cai_name_color", "type": "detectXSS"}], "cve": "CVE-2025-12456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12456", "description": "Centangle Team Showcase <=1.0.0 CSRF to Stored XSS via cai_name_color in cai_ajaxaction AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "centangle-team", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12471-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "dpsp-dashboard"}, {"name": "ARGS:dpsp_list_attention_search", "type": "detectXSS"}], "cve": "CVE-2025-12471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12471", "description": "Hubbub Lite (Social Pug) <=1.36.0 reflected XSS via dpsp_list_attention_search parameter on admin dashboard", "mode": "block", "severity": 6.1, "slug": "social-pug", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.36.0"}, "RULE-CVE-2025-12473-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:[/?]|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "themebuilder"}, {"name": "ARGS:themebuilder", "type": "regex", "value": "~(?:%25(?:3[cC]|3[eE]|22|27)|%3[cC]|%3[eE]|%22|%27|<|>|\\"|\'|on(?:error|load)\\\\s*=|<\\\\s*(?:script|img|svg)\\\\b)~i"}], "cve": "CVE-2025-12473", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12473", "description": "RomethemeKit For Elementor <=1.6.8 Reflected XSS via themebuilder parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "rometheme-for-elementor", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-12475-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[blocksy_newsletter_subscribe\\\\s[^\\\\]]*(?:<[a-z]|\\\\bon\\\\w+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-12475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12475", "description": "Blocksy Companion <=2.1.14 Stored XSS via blocksy_newsletter_subscribe shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12482-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:%\'[\\\\s]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|HAVING|WHERE|SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)[\\\\s(]|/\\\\*[\\\\s\\\\S]*?\\\\*/)~i"}], "cve": "CVE-2025-12482", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12482", "description": "Amelia Booking <=1.2.35 unauthenticated SQL injection via search parameter in wpamelia_api AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ameliabooking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.2.35"}, "RULE-CVE-2025-12484-01": {"ajax_action": "rafflepress_lite_giveaway_api", "conditions": [{"name": "ARGS:entry_option", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:>|\\\\bon\\\\w+\\\\s*=)|javascript\\\\s*:|&#(?:60|x3[cC]);~i"}], "cve": "CVE-2025-12484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12484", "description": "RafflePress <=1.12.19 unauthenticated stored XSS via entry_option JSON blob in giveaway API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rafflepress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.12.19"}, "RULE-CVE-2025-12493-01": {"ajax_action": "woolentor_load_more_products", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|\\\\.\\\\.%2f|\\\\.\\\\.%5c)~i"}], "cve": "CVE-2025-12493", "method": "POST", "mode": "block", "severity": 9.8, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.2.5"}, "RULE-CVE-2025-12499-01": {"ajax_action": "grw_overview_ajax", "conditions": [{"name": "ARGS:place_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via place_id in grw_overview_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-02": {"ajax_action": "grw_feed_save_ajax", "conditions": [{"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via post_id in grw_feed_save_ajax", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-03": {"ajax_action": "grw_connect_google", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized POST data in grw_connect_google", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-04": {"ajax_action": "grw_place_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 reflected XSS via unsanitized POST data in grw_place_autocomplete", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12499-05": {"ajax_action": "grw_get_place", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12499", "description": "Rich Shortcodes for Google Reviews <=6.8 stored XSS via unsanitized Google Place data in grw_get_place", "method": "POST", "mode": "block", "severity": 7.2, "slug": "widget-google-reviews", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-12505-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wedocs/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12505", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12505", "description": "weDocs <=2.1.14 missing authorization on REST settings update allows Subscriber+ to modify global plugin settings", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wedocs", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.1.14"}, "RULE-CVE-2025-12537-01": {"ajax_action": "eae_save_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_save_config AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12537-02": {"ajax_action": "eae_elements_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12537", "description": "Addon Elements for Elementor <=1.14.3 Authenticated (Contributor+) Stored XSS via eae_elements_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addon-elements-for-elementor-page-builder", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.14.3"}, "RULE-CVE-2025-12538-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "regex", "value": "~^iworks_fleet_(?:person|boat|result)$~"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|resize|pointerdown)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/]|<embed[\\\\s/>]|<object[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12538", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12538", "description": "Fleet Manager <=2.5.1 Stored XSS via unsanitized post meta in person/boat/result custom post type admin columns", "method": "POST", "mode": "block", "severity": 4.4, "slug": "fleet", "tags": ["xss", "stored-xss", "custom-post-type"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-12539-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]tnc-toolbox-config[/\\\\\\\\]~i"}], "cve": "CVE-2025-12539", "method": "GET", "mode": "block", "severity": 10.0, "slug": "tnc-toolbox", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-12560-01": {"ajax_action": "b2s_get_full_content", "conditions": [{"name": "ARGS:post_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12560", "description": "Blog2Social <=8.6.0 authenticated (Subscriber+) blind SSRF via post_url in b2s_get_full_content AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "blog2social", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=8.6.0"}, "RULE-CVE-2025-12569-01": {"action": "init", "conditions": [{"name": "ARGS:redirect", "type": "regex", "value": "~^(?:https?:|//)~i"}], "cve": "CVE-2025-12569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12569", "description": "WP Front User Submit / Front Editor <=4.9.5 open redirect via unvalidated redirect parameter in registration/login shortcode form submission", "method": "POST", "mode": "block", "severity": 4.7, "slug": "front-editor", "tags": ["open-redirect", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=4.9.5"}, "RULE-CVE-2025-12583-01": {"ajax_action": "neofix_sdl_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_add AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-02": {"ajax_action": "neofix_sdl_edit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_edit AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-03": {"ajax_action": "neofix_sdl_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_delete AJAX action allowing Subscriber+ unauthorized deletion", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-04": {"ajax_action": "neofix_sdl_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_restore AJAX action allowing Subscriber+ unauthorized restore", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12583-05": {"ajax_action": "neofix_sdl_get_file_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12583", "description": "Simple Downloads List <=1.4.3 missing authorization on neofix_sdl_get_file_url AJAX action allowing Subscriber+ information disclosure", "mode": "block", "severity": 6.4, "slug": "simple-downloads-list", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-12621-01": {"ajax_action": "fr_refund_request", "conditions": [{"name": "ARGS:order_ID", "type": "exists"}, {"name": "ARGS:status", "type": "regex", "value": "~(?i)^\\\\s*(approved|refused)\\\\s*$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12621", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12621", "description": "Flexible Refund and Return Order for WooCommerce <=1.0.42 incorrect authorization on fr_refund_request AJAX action allows Contributor+ to approve/refuse refunds", "method": "POST", "mode": "block", "severity": 5.3, "slug": "flexible-refund-and-return-order-for-woocommerce", "tags": ["incorrect-authorization", "broken-access-control", "woocommerce"], "target": "plugin", "versions": "<=1.0.42"}, "RULE-CVE-2025-12628-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "validate_2fa"}, {"name": "ARGS:provider", "type": "regex", "value": "~^(?i)backup(?:_|%5[fF])codes$~"}, {"name": "ARGS:wp-2fa-backup-code", "type": "exists"}], "cve": "CVE-2025-12628", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12628", "description": "WP 2FA <=2.9.3 second factor bypass via brute-force of low-entropy backup codes on validate_2fa endpoint", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-2fa", "tags": ["authentication-bypass", "insufficient-entropy", "brute-force"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-12630-01": {"ajax_action": "upload_am_get_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option disclosure via upload_am_get_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12630-02": {"ajax_action": "upload_am_update_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}], "cve": "CVE-2025-12630", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12630", "description": "Upload@AM <=1.0.0 arbitrary option update via upload_am_update_option AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 4.9, "slug": "upload-am-file-hosting-vpn", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12633-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v1/commerce/stripe/return(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12633", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12633", "description": "Bookit <=2.5.0 missing authorization on Stripe Connect return REST endpoint allows unauthenticated Stripe account linkage", "method": "GET", "mode": "block", "severity": 7.5, "slug": "bookit", "tags": ["missing-authorization", "unauthenticated", "rest-api", "stripe-connect"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1264-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/link-status-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on link-status-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-1264-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/aioseoBrokenLinkChecker/v1/links-table(/|\\\\?|$)~"}, {"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2025-1264", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1264", "description": "Broken Link Checker by AIOSEO <=1.2.3 authenticated SQL injection via orderBy parameter on links-table REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-checker-seo", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-12641-01": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12641-02": {"action": "init", "conditions": [{"name": "ARGS:wpas-do", "type": "equals", "value": "mr_activate_user"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12641", "description": "Awesome Support <=6.3.6 unauthenticated role demotion via wpas-do=mr_activate_user (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "awesome-support", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=6.3.6"}, "RULE-CVE-2025-12643-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12643-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~(?i)\\\\[saphali_liqpay\\\\b[^\\\\]]*(?:<[a-z]|javascript\\\\s*:|on[a-z]+\\\\s*=)[^\\\\]]*\\\\]~"}], "cve": "CVE-2025-12643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12643", "description": "Saphali LiqPay for donate <=1.0.2 Stored XSS via [saphali_liqpay] shortcode attributes in post_content param", "method": "POST", "mode": "block", "severity": 6.4, "slug": "saphali-liqpay-for-donate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12646-01": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12646-02": {"ajax_action": "community_events_frontend_list", "conditions": [{"name": "ARGS:dayofyear", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-12646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12646", "description": "Community Events <=1.5.4 unauthenticated SQL injection via dayofyear parameter in frontend event list AJAX handler (GET variant)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "community-events", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-12649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sorttablepost[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2025-12649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12649", "description": "SortTable Post <=4.2 Stored XSS via sorttablepost shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sorttable-post", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2"}, "RULE-CVE-2025-12650-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12650-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[postlist\\\\b[^\\\\]]*class_name\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<[^>]*>|on\\\\w+\\\\s*=|javascript\\\\s*:)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12650", "description": "Simple Post Listing <=0.2 stored XSS via class_name shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-post-listing", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2"}, "RULE-CVE-2025-12654-01": {"ajax_action": "wpvividstg_check_filesystem_permissions_free", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:create_new_wp", "type": "equals", "value": "1"}, {"name": "ARGS:pwd", "type": "regex", "value": "~(^/|^[A-Za-z]:\\\\\\\\|\\\\.{2}|[/\\\\\\\\]{2,}|/etc/|^/var/|^/tmp/|/\\\\.|\\\\\\\\\\\\.)~i"}], "cve": "CVE-2025-12654", "method": "POST", "mode": "block", "severity": 2.7, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.120"}, "RULE-CVE-2025-12658-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[preload_progress_bar\\\\b[^\\\\]]*complete\\\\s*=[^\\\\]]*<[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12658", "description": "Preload Current Images <=1.3 authenticated stored XSS via [preload_progress_bar] shortcode complete attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "preload-current-images", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12660-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(wallwisher|padlet)\\\\s[^\\\\]]*key\\\\s*=\\\\s*[\\"\'](?:[^\\\\]\\\\r\\\\n]|\\\\\\\\.)*?(<|>|on[a-z]+\\\\s*=|javascript:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12660", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12660", "description": "Padlet Shortcode <=1.3 Stored XSS via key attribute in [wallwisher]/[padlet] shortcode through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wallwisher-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-12661-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post[.]php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12661-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|[?])rest_route=)/wp/v2/posts(/|[?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]pollcaster[^]]*height *=[^]]*(?:[<>]|on[a-zA-Z]+=|javascript *:)~i"}], "cve": "CVE-2025-12661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12661", "description": "Pollcaster Shortcode <=1.0 Stored XSS via shortcode height attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "pollcaster-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-12673-01": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-02": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:logo", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-03": {"ajax_action": "flexqr_update_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12673-04": {"ajax_action": "flexqr_save_qr", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "FILES:qr_image", "type": "exists"}], "cve": "CVE-2025-12673", "method": "POST", "mode": "block", "severity": 9.8, "slug": "flex-qr-code-generator", "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-12677-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kiot(?:viet(?:sync)?)/(?:v[0-9]+/)?webhook(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12677", "description": "KiotViet Sync <=1.8.5 unauthenticated sensitive information exposure via webhook REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "kiotvietsync", "tags": ["information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-12681-01": {"ajax_action": "sce_get_comment", "conditions": [{"name": "ARGS:comment_id", "type": "exists"}], "cve": "CVE-2025-12681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12681", "description": "Simple Comment Editing <=3.1.0 unauthenticated sensitive information exposure via sce_get_comment AJAX action", "mode": "block", "severity": 5.3, "slug": "simple-comment-editing", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-12682-01": {"action": "init", "conditions": [{"name": "FILES:file_during_checkout", "type": "exists"}], "cve": "CVE-2025-12682", "method": "POST", "mode": "block", "severity": 9.8, "slug": "easy-upload-files-during-checkout", "target": "plugin", "versions": "<=2.9.8"}, "RULE-CVE-2025-12691-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<img\\\\b[^>]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12691-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[photonic\\\\b[^\\\\]]*caption\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]]*)(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<img\\\\b[^>]+\\\\bon)~i"}], "cve": "CVE-2025-12691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12691", "description": "Photonic Gallery & Lightbox <=3.21 stored XSS via [photonic] shortcode caption attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "photonic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.21"}, "RULE-CVE-2025-12707-01": {"ajax_action": "owt_lib_handler", "conditions": [{"name": "ARGS:bid", "type": "regex", "value": "~(?:VU5JT04=|U0VMRUNU|SU5TRVJU|VVBEQVRF|REVMRVRF|RFJPUA==|QU5E|T1I=|U0xFRVA=|RVhUUkFDVFZBTFVF|Q09OQ0FU|T1JERVIgQlk=|R1JPVVAgQlk=)~i"}], "cve": "CVE-2025-12707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12707", "description": "Library Management System <=3.2.1 unauthenticated SQL injection via bid parameter in owt_lib_handler AJAX handler", "mode": "block", "severity": 7.5, "slug": "library-management-system", "tags": ["sql-injection", "unauthenticated", "base64-encoded-parameter"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-12709-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/interact/v1/update_interaction(?:/|\\\\?|&|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[^>]*>|</?(?:svg|iframe|embed|object|math|details)[\\\\s/>]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12709", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12709", "description": "Interactions <= 1.3.1 Authenticated (Contributor+) Stored XSS via event selectors in update_interaction REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "interactions", "tags": ["xss", "stored-xss", "rest-api", "missing-capability"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-12718-01": {"ajax_action": "qcf_validate_form", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2025-12718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12718", "description": "Quick Contact Form <=8.2.6 unauthenticated open mail relay via email header injection in qcf_validate_form AJAX handler", "method": "POST", "mode": "block", "severity": 5.8, "slug": "quick-contact-form", "tags": ["email-header-injection", "open-mail-relay", "unauthenticated", "improper-input-validation"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2025-12721-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fflcockpit/v1/server_status(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12721", "description": "g-FFL Cockpit <=1.7.1 unauthenticated information disclosure via /fflcockpit/v1/server_status REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "g-ffl-cockpit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-12746-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "detectXSS"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via search parameter in front-end template", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12746-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(\\\\\\"|\')\\\\s*on\\\\w+\\\\s*=|<(script|svg|iframe|img)[\\\\s/>]|javascript\\\\s*:~i"}], "cve": "CVE-2025-12746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12746", "description": "Tainacan <=1.0.0 reflected XSS via arbitrary GET parameters reflected into hidden form fields", "method": "GET", "mode": "block", "severity": 6.1, "slug": "tainacan", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12747-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?i)^/wp-content/uploads/tainacan-items/\\\\d+/_x_\\\\d+/~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-12747", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12747", "description": "Tainacan <=1.0.0 unauthenticated information exposure via direct access to private files in tainacan-items uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "tainacan", "tags": ["information-exposure", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-12754-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[geopost\\\\b[^\\\\]]*(?:height|width)\\\\s*=\\\\s*[^\\\\]]*(?:<script|<svg|<iframe|<img|<details|<body|<marquee|on(?:error|load|click|mouseover|focus|blur|mouse(?:enter|leave|move|out|up|down))\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12754", "description": "Geopost <=1.1 Stored XSS via height/width shortcode attribute injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "geopost", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-12778-01": {"ajax_action": "wp_filter_users", "conditions": [{"type": "missing_capability", "value": "list_users"}], "cve": "CVE-2025-12778", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12778", "description": "Ultimate Member Widgets for Elementor <=2.3 unauthenticated information exposure via wp_filter_users AJAX handler", "mode": "block", "severity": 5.3, "slug": "ultimate-member-widgets-for-elementor", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-12778-02": {"ajax_action": "um_filter_users", "conditions": [{"type": "missing_capability", "value": "list_users"}], "cve": "CVE-2025-12778", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12778", "description": "Ultimate Member Widgets for Elementor <=2.3 unauthenticated information exposure via um_filter_users AJAX handler", "mode": "block", "severity": 5.3, "slug": "ultimate-member-widgets-for-elementor", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-12787-01": {"ajax_action": "tfhb_meeting_form_cencel", "conditions": [{"name": "ARGS:hash", "type": "regex", "value": "~^.{0,7}$|[<>\'\\";&|`]~"}], "cve": "CVE-2025-12787", "method": "POST", "mode": "block", "severity": 5.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2025-12800-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "su_generator_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_csv_table[^\\\\]]*url\\\\s*=~i"}], "cve": "CVE-2025-12800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12800", "description": "Shortcodes Ultimate <=7.4.5 Server-Side Request Forgery via su_csv_table shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["ssrf", "server-side-request-forgery", "shortcode"], "target": "plugin", "versions": "<=7.4.5"}, "RULE-CVE-2025-12804-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (classic editor injection phase)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12804-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bookingcalendar\\\\b[^\\\\]]{0,500}aggregate\\\\s*=[\\\\s\\"\']*[^\\\\]]{0,500}(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-12804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12804", "description": "Booking Calendar <=10.14.6 Stored XSS via bookingcalendar shortcode aggregate attribute (REST API PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=10.14.6"}, "RULE-CVE-2025-12814-01": {"ajax_action": "siteseo_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings reset via siteseo_reset_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-02": {"ajax_action": "siteseo_export_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings export via siteseo_export_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-03": {"ajax_action": "siteseo_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized settings import via siteseo_import_settings AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control", "settings-injection"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12814-04": {"ajax_action": "siteseo_migrate_seo", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12814", "description": "SiteSEO <=1.3.2 unauthorized SEO data migration via siteseo_migrate_seo AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "siteseo", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-12824-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[player_leaderboard\\\\b[^\\\\]]*mode\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data)://)~i"}], "cve": "CVE-2025-12824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12824", "description": "Player Leaderboard <=1.0.2 authenticated (Contributor+) Local File Inclusion via player_leaderboard shortcode mode attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "player-leaderboard", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12824-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[player_leaderboard\\\\b[^\\\\]]*mode\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data)://)~i"}], "cve": "CVE-2025-12824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12824", "description": "Player Leaderboard <=1.0.2 authenticated (Contributor+) Local File Inclusion via REST API post content containing malicious player_leaderboard shortcode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "player-leaderboard", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-12826-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cptui_process_post_type"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12826", "description": "Custom Post Type UI <=1.18.0 missing authorization on custom post type modification via cptui_process_post_type", "method": "POST", "mode": "block", "severity": 4.8, "slug": "custom-post-type-ui", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2025-12826-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "cptui_process_taxonomy"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12826", "description": "Custom Post Type UI <=1.18.0 missing authorization on custom taxonomy modification via cptui_process_taxonomy", "method": "POST", "mode": "block", "severity": 4.8, "slug": "custom-post-type-ui", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2025-12830-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "contains", "value": "better-slider"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~better-slider[\\\\s\\\\S]{0,500}(?:<script[\\\\s>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|embed|object|details|math)[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12830", "description": "Better Elementor Addons <=1.5.5 Stored XSS via Slider widget title_html_tag and title fields in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "better-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.5.5"}, "RULE-CVE-2025-12836-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s(?:on\\\\w+)\\\\s*=~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description event-handler injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12836-02": {"action": "init", "conditions": [{"name": "ARGS:vkjp_description", "type": "regex", "value": "~<(?:script[\\\\s>]|/script>|iframe[\\\\s>]|svg[\\\\s/>]|embed[\\\\s>]|object[\\\\s>]|scrscriptipt\\\\b)|\\\\b(?:href|src|xlink:href)\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-12836", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12836", "description": "VK Google Job Posting Manager <=1.2.23 Stored XSS via vkjp_description dangerous element injection", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vk-google-job-posting-manager", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-12837-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:waf_probe", "type": "regex", "value": "~<script[\\\\s/>]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in REST API content save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12837-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[\\\\s/>]|<[^>]+\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-12837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12837", "description": "aThemes Addons for Elementor Lite <=1.1.5 Stored XSS via Call To Action widget settings in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-12841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/bookit/v1/commerce/stripe/return(?:/|\\\\?|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12841-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookit/v1/commerce/stripe/return(?:/|$)~"}, {"name": "ARGS:stripe", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12841", "description": "Bookit <=2.5.0 unauthenticated Stripe settings update via REST API /commerce/stripe/return endpoint (rest_route fallback)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "bookit", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-12844-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTranscribeAudio(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTranscribeAudio REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleVisionQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleVisionQuery REST endpoint", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleFastTextQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleFastTextQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12844-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/simpleJsonQuery(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~phar\\\\s*://~i"}], "cve": "CVE-2025-12844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12844", "description": "AI Engine <=3.1.8 authenticated (Subscriber+) PHP Object Injection via PHAR deserialization in simpleJsonQuery REST endpoint (options.path vector)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "ai-engine", "tags": ["object-injection", "phar-deserialization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-12845-01": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12845", "description": "Tablesome <=1.2.1 missing authorization on get_tables_data AJAX action allows subscriber+ to retrieve sensitive table data", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-12851-01": {"action": "init", "conditions": [{"name": "ARGS:controller", "type": "regex", "value": "~(?:[\\\\.\\\\\\\\/-]|%2[dDeEfF]|%5[cC])~"}], "cve": "CVE-2025-12851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12851", "description": "My auctions allegro <=3.6.32 unauthenticated Local File Inclusion via controller parameter on init hook", "mode": "block", "severity": 8.1, "slug": "my-auctions-allegro-free-edition", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=3.6.32"}, "RULE-CVE-2025-1287-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:text_days|text_hours|text_minutes|text_seconds|cpybtntext|lanugaetext|copiedbtntext|cpyerrbtntext|dwnldBtnText|nav_dots_tooltips|fp-slideid)[^}]{0,200}(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1287", "description": "The Plus Addons for Elementor <=6.2.2 Stored XSS via Countdown/Syntax Highlighter/Page Scroll widget settings in post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2025-1287-02": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:text_days|text_hours|text_minutes|text_seconds|cpybtntext|lanugaetext|copiedbtntext|cpyerrbtntext|dwnldBtnText|nav_dots_tooltips|fp-slideid)[^}]{0,200}(?:<script|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1287", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1287", "description": "The Plus Addons for Elementor <=6.2.2 Stored XSS via Countdown/Syntax Highlighter/Page Scroll widget settings in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=6.2.2"}, "RULE-CVE-2025-12876-01": {"ajax_action": "pto_delete_file", "conditions": [{"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-12876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12876", "description": "Projectopia - WordPress Project Management <=5.1.19 missing authorization on pto_delete_file AJAX action allowing unauthenticated arbitrary attachment deletion", "method": "POST", "mode": "block", "severity": 5.3, "slug": "projectopia-core", "tags": ["missing-authorization", "unauthenticated", "arbitrary-deletion"], "target": "plugin", "versions": "<=5.1.19"}, "RULE-CVE-2025-12891-01": {"ajax_action": "ays_survey_show_results", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12891", "mode": "block", "severity": 5.3, "slug": "survey-maker", "target": "plugin", "versions": "<=5.1.9.4"}, "RULE-CVE-2025-12894-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/exportwp(?:/|%2f).*(?:\\\\.(csv|xml|json|log|txt|gz|zip))([?#]|$)~i"}], "cve": "CVE-2025-12894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12894", "description": "Import WP <=2.14.17 unauthenticated access to exported data files via /exportwp/ directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "jc-importer", "tags": ["information-disclosure", "unauthenticated", "sensitive-file-access"], "target": "plugin", "versions": "<=2.14.17"}, "RULE-CVE-2025-12894-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/importwp(?:/|%2f).*(?:\\\\.(csv|xml|json|log|txt|gz|zip))([?#]|$)~i"}], "cve": "CVE-2025-12894", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12894", "description": "Import WP <=2.14.17 unauthenticated access to import session data and debug logs via /importwp/ directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "jc-importer", "tags": ["information-disclosure", "unauthenticated", "sensitive-file-access"], "target": "plugin", "versions": "<=2.14.17"}, "RULE-CVE-2025-12904-01": {"ajax_action": "insert_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|mouse(?:over|out|enter|leave))\\\\s*=|javascript\\\\s*:|<(?:svg|img|iframe|object|embed|math|details|body|marquee)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-12904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12904", "description": "H5PxAPIkatchu <= 0.4.17 Unauthenticated Stored XSS via insert_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "h5pxapikatchu", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.17"}, "RULE-CVE-2025-1291-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-1291-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/testimonial~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']icon[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<script\\\\b|<[^>]+\\\\bon\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1291", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1291", "description": "Kadence Blocks <=3.4.9 Authenticated (Contributor+) Stored XSS via testimonial block icon attribute in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2025-12934-01": {"ajax_action": "fl_builder_duplicate_wpml_layout", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}, {"name": "ARGS:original_post_id", "type": "exists"}], "cve": "CVE-2025-12934", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12934", "description": "Beaver Builder <= 2.9.4.1 missing authorization on duplicate_wpml_layout AJAX handler allows Subscriber+ arbitrary post update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "beaver-builder-lite-version", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-update"], "target": "plugin", "versions": "<=2.9.4.1"}, "RULE-CVE-2025-12935-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12935-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentcrm_content\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<svg|<iframe|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12935", "description": "FluentCRM <=2.9.84 Stored XSS via [fluentcrm_content] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-crm", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.9.84"}, "RULE-CVE-2025-12955-01": {"ajax_action": "pisol_live_orders", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12955", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12955", "description": "Live Sales Notification for WooCommerce <=2.3.39 missing authorization on pisol_live_orders AJAX handler exposing customer order data", "mode": "block", "severity": 7.5, "slug": "live-sales-notifications-for-woocommerce", "tags": ["missing-authorization", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.3.39"}, "RULE-CVE-2025-12960-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12960-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[csv\\\\b[^\\\\]]*\\\\bhref\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12960", "description": "Simple CSV Table <=1.0.1 directory traversal via [csv href] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-csv-table", "tags": ["path-traversal", "local-file-inclusion", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-12963-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazytasks/api/v1/user/role/edit(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12963", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lazytasks-project-task-management", "target": "plugin", "versions": "<=1.2.29"}, "RULE-CVE-2025-12964-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_title_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdpr_subtitle_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdpr_subtitle_tag in Pricing Table Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mpdal_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mpdal_title_tag in Products Awesome List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpcar_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpcar_title_tag in Products Carousel Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-05": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdeg_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdeg_title_tag in Products Grid/Tab Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12964-06": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~[\\"\']mgpdel_title_tag[\\"\']\\\\s*:\\\\s*[\\"\'](?!(h[1-6]|div|span|p)[\\"\',\\\\}\\\\]])[^\\"\']+[\\"\']~i"}], "cve": "CVE-2025-12964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12964", "description": "Magical Products Display <=1.1.29 Stored XSS via mgpdel_title_tag in Products List Elementor widget", "method": "POST", "mode": "block", "severity": 6.4, "slug": "magical-products-display", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.29"}, "RULE-CVE-2025-12973-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "s2b_store_chatbot_upload"}, {"name": "FILES:s2baia_chatbot_config_database", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-12973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12973", "description": "S2B AI Assistant <=1.7.8 arbitrary file upload via s2b_store_chatbot_upload admin-post action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "s2b-ai-assistant", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.7.8"}, "RULE-CVE-2025-12984-01": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-12984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-12984", "description": "Advanced Ads <=2.0.15 authenticated (admin+) SQL injection via order parameter in placement list table", "method": "GET", "mode": "block", "severity": 4.9, "slug": "advanced-ads", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.0.15"}, "RULE-CVE-2025-13006-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/fsd(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/fsd REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/responses/[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/responses/{id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13006-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/surveyfunnel/v2/surveys/survey_id=[0-9-]+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13006", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13006", "description": "SurveyFunnel Lite <=1.1.5 unauthenticated sensitive information exposure via /surveyfunnel/v2/surveys/survey_id={id} REST endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "surveyfunnel-lite", "tags": ["information-exposure", "missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-13031-01": {"action": "admin_post_save_wpematico_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Stored XSS via unsanitized settings output in settings_form()", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-02": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:return_url", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:(?:text/html|application/xhtml)|on\\\\w+\\\\s*=|<script)~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via return_url in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-03": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:item_hash", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via item_hash in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-04": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:feed", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via feed parameter in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-05": {"action": "admin_post_wpematico_campaign_preview_item", "conditions": [{"name": "ARGS:campaign", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via campaign parameter in campaign preview item", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13031-06": {"action": "admin_post_wpematico_campaign_preview", "conditions": [{"name": "ARGS:p", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13031", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13031", "description": "WPeMatico <=2.8.12 Reflected XSS via p parameter in campaign preview", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wpematico", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.8.12"}, "RULE-CVE-2025-13035-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "POST", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13035-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "POST", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13035-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "PUT", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13035-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\[code_snippet[^\\\\]]*filepath\\\\s*=\\\\s*[\\"\']?php://~i"}], "cve": "CVE-2025-13035", "method": "PATCH", "mode": "block", "severity": 8.0, "slug": "code-snippets", "target": "plugin", "versions": "<=3.9.1"}, "RULE-CVE-2025-13048-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/(?:profile|user-edit)\\\\.php)~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:<script[\\\\s>]|<[^>]+[\\\\s/]+on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13048", "description": "Official StatCounter Plugin <=2.1.0 Authenticated (Contributor+) Stored XSS via Nickname", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored-xss", "missing-output-escaping"], "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-13054-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-02-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*\\\\bon[a-z]+\\\\s*=~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height event handler injection via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13054-04-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-embed[^\\\\]]*(?:width|height)\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*<[a-z]~i"}], "cve": "CVE-2025-13054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13054", "description": "Profile Builder <=3.14.8 Stored XSS via wppb-embed shortcode width/height HTML tag breakout via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.14.8"}, "RULE-CVE-2025-13072-01": {"action": "init", "conditions": [{"name": "ARGS:utm_source", "type": "detectXSS"}], "cve": "CVE-2025-13072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13072", "description": "HandL UTM Grabber <=2.8 Reflected XSS via utm_source query parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2025-13073-01": {"ajax_action": "handl_get_zapier_log", "conditions": [{"name": "ARGS:handl_landing_page", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13073", "description": "HandL UTM Grabber <=2.8 reflected XSS via handl_landing_page in handl_get_zapier_log AJAX handler", "mode": "block", "severity": 7.1, "slug": "handl-utm-grabber", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<2.8.1"}, "RULE-CVE-2025-1309-01": {"ajax_action": "uip_save_form_as_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1309", "description": "UiPress Lite <=3.5.04 missing authorization on uip_save_form_as_option AJAX handler allows arbitrary options update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "uipress-lite", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-options-update"], "target": "plugin", "versions": "<=3.5.04"}, "RULE-CVE-2025-1310-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~job-postings-get-file/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (rewrite rule path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1310-02": {"action": "parse_request", "conditions": [{"name": "ARGS:job_postings_get_file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]|\\\\.\\\\.%2f|\\\\.\\\\.%5c|\\\\.\\\\.%252f|\\\\.\\\\.%255c|%2e%2e%2f|%2e%2e%5c|%252e%252e%252f|%252e%252e%255c|^/)~i"}], "cve": "CVE-2025-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1310", "description": "Job Postings <=2.7.11 authenticated arbitrary file read via path traversal in job_postings_get_file (query string path)", "mode": "block", "severity": 6.5, "slug": "job-postings", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-1311-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcfmmp/v1/deliveries/[^/]*[^0-9/][^/]*~i"}], "cve": "CVE-2025-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1311", "description": "WCFM Marketplace REST API <=1.6.2 authenticated SQL injection via non-numeric id path segment in /wcfmmp/v1/deliveries/{id}", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wcfm-marketplace-rest-api", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2025-1312-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1312-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "ultimate-blocks/call-to-action"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"buttonTextColor\\"\\\\s*:\\\\s*\\"[^\\"]*[<>][^\\"]*\\"~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1312", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1312", "description": "Ultimate Blocks <=3.2.7 Stored XSS via unescaped buttonTextColor attribute in Call-to-Action block (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-13153-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "logosliderwp"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on logosliderwp post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13153-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "lgx_lsp_shortcodes"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:autofocus|on[a-z]+)\\\\s*=|<\\\\s*(?:script|svg|iframe|img|object|embed|math|details|body|video|audio|input|textarea|select|button|form|marquee|isindex|xmp)\\\\b)~i"}], "cve": "CVE-2025-13153", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13153", "description": "Logo Slider <4.9.0 Contributor+ Stored XSS via unescaped slider options on lgx_lsp_shortcodes post type save", "method": "POST", "mode": "block", "severity": 6.1, "slug": "logo-slider-wp", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<4.9.0"}, "RULE-CVE-2025-13156-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|aspx?|jspx?|cfm|user\\\\.ini)~i"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-13156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13156", "description": "VitePos Lite <=3.3.0 authenticated arbitrary file upload via REST API leading to RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "vitepos-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-13206-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_first", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor first name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13206-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give_last", "type": "detectXSS"}], "cve": "CVE-2025-13206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13206", "description": "GiveWP <= 4.13.0 stored XSS via donor last name in donation form submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "give", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.13.0"}, "RULE-CVE-2025-13217-01": {"ajax_action": "um_update_profile_full", "conditions": [{"name": "ARGS:youtube_video", "type": "exists"}, {"name": "ARGS:youtube_video", "type": "regex", "value": "~(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13217", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13217", "description": "Ultimate Member <=2.11.0 Stored XSS via youtube_video profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-member", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.11.0"}, "RULE-CVE-2025-1324-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[public-form"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[public-form\\\\s[^\\\\]]*(?:<script|<svg|<iframe|<img|<object|<embed|javascript:|on(?:error|load|focus|click|mouseover)\\\\s*=)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1324", "description": "WP-Recall <=16.26.10 stored XSS via [public-form] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-recall", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=16.26.10"}, "RULE-CVE-2025-1325-01": {"ajax_action": "rcl_preview_post", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-1325", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1325", "description": "WP-Recall <=16.26.10 missing authorization on rcl_preview_post AJAX endpoint allows Subscriber+ arbitrary shortcode execution", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-recall", "tags": ["missing-authorization", "arbitrary-shortcode-execution", "broken-access-control"], "target": "plugin", "versions": "<=16.26.10"}, "RULE-CVE-2025-13308-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "auth_app"}, {"name": "ARGS:reject_url", "type": "regex", "value": "~(?i)(?:j[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*v[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*s[\\\\x00-\\\\x20]*c[\\\\x00-\\\\x20]*r[\\\\x00-\\\\x20]*i[\\\\x00-\\\\x20]*p[\\\\x00-\\\\x20]*t|data|vbscript)[\\\\x00-\\\\x20]*:~"}], "cve": "CVE-2025-13308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13308", "description": "Application Passwords <=0.1.3 Reflected XSS via reject_url parameter on auth_app admin page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "application-passwords", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-13308-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "auth_app"}, {"name": "ARGS:success_url", "type": "regex", "value": "~(?i)(?:j[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*v[\\\\x00-\\\\x20]*a[\\\\x00-\\\\x20]*s[\\\\x00-\\\\x20]*c[\\\\x00-\\\\x20]*r[\\\\x00-\\\\x20]*i[\\\\x00-\\\\x20]*p[\\\\x00-\\\\x20]*t|data|vbscript)[\\\\x00-\\\\x20]*:~"}], "cve": "CVE-2025-13308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13308", "description": "Application Passwords <=0.1.3 Reflected XSS via success_url parameter on auth_app admin page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "application-passwords", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-13308-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "auth_app"}, {"name": "ARGS:app_name", "type": "detectXSS"}], "cve": "CVE-2025-13308", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13308", "description": "Application Passwords <=0.1.3 Reflected XSS via app_name parameter on auth_app admin page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "application-passwords", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-13311-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "sigijh_plugin_options"}, {"name": "ARGS:sigijh_color_select", "type": "regex", "value": "~[<>\\"\']|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13311", "description": "Just Highlight <=1.0.3 authenticated (Administrator+) stored XSS via sigijh_color_select setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "just-highlight", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13314-01": {"ajax_action": "filter_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on filter_save_settings AJAX action allows unauthenticated settings modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "settings-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13314-02": {"ajax_action": "add_filter_options", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13314", "description": "Filter Plus <=1.1.6 missing authorization on add_filter_options AJAX action allows unauthenticated post creation and meta write", "method": "POST", "mode": "block", "severity": 5.3, "slug": "filter-plus", "tags": ["missing-authorization", "arbitrary-post-creation", "unauthenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-13320-01": {"action": "admin_init", "conditions": [{"name": "ARGS:account[user_avatar][path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|[/\\\\\\\\]etc[/\\\\\\\\]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-13320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13320", "description": "WP User Manager <=2.9.12 arbitrary file deletion via path traversal in avatar path parameter during profile update", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-user-manager", "tags": ["arbitrary-file-deletion", "path-traversal", "external-file-control"], "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-13329-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/[^/]+/v[0-9]+/add-image-data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:fileName", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2025-13329", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-uploader-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-13334-01": {"ajax_action": "blaze_demo_importer_install_demo", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:reset", "type": "equals", "value": "true"}], "cve": "CVE-2025-13334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13334", "description": "Blaze Demo Importer <=1.0.13 missing authorization on blaze_demo_importer_install_demo AJAX action allows subscriber+ site reset", "method": "POST", "mode": "block", "severity": 8.1, "slug": "blaze-demo-importer", "tags": ["missing-authorization", "broken-access-control", "database-reset"], "target": "plugin", "versions": "<=1.0.13"}, "RULE-CVE-2025-13342-02": {"ajax_action": "frontend_admin/forms/update_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13342", "description": "Frontend Admin (ACF Frontend Form Element) <=3.28.20 unauthenticated arbitrary options update via update_field AJAX action", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-frontend-form-element", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.28.20"}, "RULE-CVE-2025-13358-01": {"ajax_action": "ccpcaCreatePage", "conditions": [{"type": "missing_capability", "value": "publish_pages"}], "cve": "CVE-2025-13358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13358", "description": "CodeConfig Accessibility <=1.0.0 missing authorization on ccpcaCreatePage AJAX action allows Subscriber+ arbitrary page creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "codeconfig-accessibility", "tags": ["missing-authorization", "broken-access-control", "arbitrary-content-creation"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-13359-01": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_orderby in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-02": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via existing_terms_order in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-03": {"ajax_action": "taxopress_ai_preview_feature", "conditions": [{"name": "ARGS:existing_terms_maximum_terms", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 SQL injection via existing_terms_maximum_terms in taxopress_ai_preview_feature AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-04": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_orderby", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_orderby in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13359-05": {"ajax_action": "simpletags", "conditions": [{"name": "ARGS:suggest_local_terms_order", "type": "detectSQLi"}], "cve": "CVE-2025-13359", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13359", "description": "TaxoPress <=3.40.1 time-based SQL injection via suggest_local_terms_order in simpletags AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-tags", "tags": ["sql-injection", "time-based-blind", "ajax"], "target": "plugin", "versions": "<=3.40.1"}, "RULE-CVE-2025-13364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (classic editor)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13364-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[put_wpgm\\\\s[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3[Cc]script|%6[Ff]n(?:error|load|mouseover|click))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13364", "description": "WP Google Map Plugin <=4.8.7 stored XSS via put_wpgm shortcode attributes in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "wp-google-map-plugin", "target": "plugin", "versions": "<=4.8.7"}, "RULE-CVE-2025-13367-01": {"action": "init", "conditions": [{"name": "ARGS:username", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via username GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-02": {"action": "init", "conditions": [{"name": "ARGS:info", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via info GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13367-03": {"action": "init", "conditions": [{"name": "ARGS:transaction_id", "type": "detectXSS"}], "cve": "CVE-2025-13367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13367", "description": "User Registration & Membership <=4.4.6 reflected XSS via transaction_id GET parameter on thank-you page", "method": "GET", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2025-13369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:money_spent_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via money_spent_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_from", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_from filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13369-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:registered_to", "type": "detectXSS"}], "cve": "CVE-2025-13369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13369", "description": "Premmerce WooCommerce Customers Manager <=1.1.14 Reflected XSS via registered_to filter parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "woo-customers-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.14"}, "RULE-CVE-2025-13370-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) time-based SQL injection via id parameter on pl-add admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13370-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pl-add"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:(?:UNION(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|\\\\+|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:[\'\\"\\\\d])(?:\\\\s|/\\\\*[^*]*\\\\*/)*(?:OR|AND)(?:\\\\s|/\\\\*[^*]*\\\\*/)+[\'\\"]?[\\\\w\'\\"]|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s[^;]*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-13370", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13370", "description": "ProjectList <=0.3.0 authenticated (Editor+) SQL injection via id parameter on pl-add admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "projectlist", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13376-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "projectlist-add"}, {"name": "FILES:pl_image", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13376", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13376", "description": "ProjectList <=0.3.0 authenticated arbitrary file upload via pl_image on Add Project page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "projectlist", "tags": ["arbitrary-file-upload", "file-upload", "authenticated"], "target": "plugin", "versions": "<=0.3.0"}, "RULE-CVE-2025-13383-01": {"action": "init", "conditions": [{"name": "ARGS:jbbrd_save_search", "type": "equals", "value": "1"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|iframe|object|embed|svg|math|img|video|audio|body|details|marquee|isindex|form|input|button|select|textarea|keygen|meta|link|base|style)[\\\\s/>]|\\\\bon(?:error|load|focus|click|mouse(?:over|out|enter)|change|blur|submit|reset|key(?:up|down|press)|contextmenu|dblclick|drag|drop|input|invalid|scroll|wheel|animat(?:ion|ed)|transition)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13383", "description": "Job Board by BestWebSoft <=1.2.1 stored XSS via CSRF through unsanitized $_GET array storage in save-search", "method": "GET", "mode": "block", "severity": 6.1, "slug": "job-board", "tags": ["xss", "stored-xss", "csrf", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-13387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_first_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_first_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/checkout|[?&]wc-ajax=checkout)~i"}, {"name": "ARGS:billing_last_name", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-13387", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13387", "description": "Kadence WooCommerce Email Designer <=1.5.17 unauthenticated stored XSS via billing_last_name at checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "kadence-woocommerce-email-designer", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.17"}, "RULE-CVE-2025-13403-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-in via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13403-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "employee-spotlight_check_optin"}, {"name": "ARGS:employee-spotlight_no_optin", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13403", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13403", "description": "Employee Spotlight <=5.1.3 missing authorization on tracking opt-out via admin_post handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "employee-spotlight", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-13409-01": {"ajax_action": "fv_get_analytics_data", "conditions": [{"name": "ARGS:params", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13409", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13409", "description": "Form Vibes <=1.4.13 authenticated SQL injection via params parameter in fv_get_analytics_data AJAX handler", "mode": "block", "severity": 4.9, "slug": "form-vibes", "tags": ["sql-injection", "authenticated", "admin-plus"], "target": "plugin", "versions": "<=1.4.13"}, "RULE-CVE-2025-13414-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export_businesses", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13414-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:cdash_export", "type": "exists"}], "cve": "CVE-2025-13414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13414", "description": "Chamber Dashboard Business Directory <= 3.3.11 unauthenticated business information export via cdash_watch_for_export (alt trigger cdash_export)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "chamber-dashboard-business-directory", "tags": ["missing-authorization", "unauthenticated", "data-export"], "target": "plugin", "versions": "<=3.3.11"}, "RULE-CVE-2025-13419-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bfe/v1/revert(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-13419", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13419", "description": "Front Editor <=5.0.0 unauthenticated arbitrary media deletion via /bfe/v1/revert REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "front-editor", "tags": ["missing-authorization", "unauthenticated", "rest-api", "idor"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-13431-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_load_report AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13431-02": {"ajax_action": "slimstat_fetch_chart_data", "conditions": [{"name": "ARGS:args", "type": "regex", "value": "~(?i)(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SELECT\\\\s+.*\\\\bFROM\\\\b|INSERT\\\\s+INTO\\\\b|DELETE\\\\s+FROM\\\\b|UPDATE\\\\s+.*\\\\bSET\\\\b|DROP\\\\s+TABLE\\\\b|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE|[\\\\x27\\"]\\\\s*(?:OR|AND)\\\\s+[\\\\x27\\"\\\\d]|[\\\\x27\\"]\\\\s*;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:ORDER|GROUP)\\\\s+BY\\\\s+\\\\d+)~"}], "cve": "CVE-2025-13431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13431", "description": "SlimStat Analytics <=5.3.1 authenticated SQL injection via args parameter in slimstat_fetch_chart_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-13440-01": {"action": "admin_post_premmerce_delete_wishlist", "conditions": [{"name": "ARGS:wishlist", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13440", "description": "Premmerce Wishlist for WooCommerce <=1.1.10 missing authorization on deleteWishlist via admin_post action", "method": "GET", "mode": "block", "severity": 5.3, "slug": "premmerce-woocommerce-wishlist", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2025-13448-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13448-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:demo|ci-demo)\\\\s+[^\\\\]]*element\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\\\]\\"\']*)(?:script\\\\b|img\\\\b|svg\\\\b|iframe\\\\b|object\\\\b|embed\\\\b|body\\\\b|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13448", "description": "CSSIgniter Shortcodes <=2.4.1 Stored XSS via \'element\' shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cssigniter-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.1"}, "RULE-CVE-2025-13463-01": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_get_html AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13463-02": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|focusin|pointerenter|animationend)\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}], "cve": "CVE-2025-13463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13463", "description": "Bold Page Builder <=5.5.3 Stored DOM-based XSS via bt_bb_fe_save AJAX handler content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=5.5.3"}, "RULE-CVE-2025-13486-01": {"ajax_action": "acfe/form/render_form_ajax", "conditions": [{"name": "ARGS:_acf_form", "type": "regex", "value": "~(?i)\\\\b(system|exec|passthru|shell_exec|popen|proc_open|file_put_contents|assert|eval)\\\\b~i"}], "cve": "CVE-2025-13486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": ">=0.9.0.5 <=0.9.1.1"}, "RULE-CVE-2025-13497-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13497-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[recras-booking[^\\\\]]*recrasname\\\\s*=\\\\s*(?:\\"[^\\"]*[\');}<>][^\\"]*\\"|\'[^\']*[\\");}<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13497", "description": "Recras <=6.4.1 Stored XSS via recras-booking shortcode recrasname attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recras", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.4.1"}, "RULE-CVE-2025-13516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-content/uploads/suremails/attachments/[^/]+\\\\.(?:php\\\\d*|phtml|phar|phps|pht|phpt|inc)(?:\\\\?|$)~i"}], "cve": "CVE-2025-13516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13516", "description": "SureMail <=1.9.0 unauthenticated RCE via direct access to uploaded PHP files in suremails attachments directory", "mode": "block", "severity": 8.1, "slug": "suremails", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "dangerous-file-type"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-13525-01": {"action": "init", "conditions": [{"name": "ARGS:order_by", "type": "detectXSS"}], "cve": "CVE-2025-13525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13525", "description": "WP Directory Kit <=1.4.5 Reflected Cross-Site Scripting via order_by parameter", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wpdirectorykit", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2025-13534-01": {"ajax_action": "eh_crm_edit_agent", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:user_id", "type": "regex", "value": "~.+~"}, {"name": "ARGS:rights", "type": "regex", "value": "~.+~"}], "cve": "CVE-2025-13534", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2025-13537-01": {"ajax_action": "dslc-ajax-save-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-02": {"ajax_action": "dslc-ajax-save-draft-composer", "conditions": [{"name": "ARGS:dslc_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-save-draft-composer AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-03": {"ajax_action": "dslc-ajax-import-template", "conditions": [{"name": "ARGS:dslc_template_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-template AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13537-04": {"ajax_action": "dslc-ajax-import-modules-section", "conditions": [{"name": "ARGS:dslc_modules_section_code", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-13537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13537", "description": "Live Composer <=2.0.2 DOM-Based Stored XSS via dslc-ajax-import-modules-section AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "live-composer-page-builder", "tags": ["xss", "stored-xss", "dom-based-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-13592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~change-ad__content~"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13592-02": {"ajax_action": "advads-ad-injection-content", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~change-ad__content\\\\s*=~i"}], "cve": "CVE-2025-13592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13592", "description": "Advanced Ads <=2.0.14 authenticated (Editor+) RCE via change-ad__content shortcode attribute in AJAX injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-ads", "tags": ["code-injection", "remote-code-execution", "shortcode", "ajax"], "target": "plugin", "versions": "<=2.0.14"}, "RULE-CVE-2025-13604-03": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:\\\\s*(?:text/html|application/xhtml))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via javascript:/data: URI scheme in GET query parameter values", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:<|%3[Cc])(?:script|img|svg|iframe|object|embed|body|input|details|math|video|audio|style|form|base|link|meta)(?:\\\\s|/|>|%20|%09|%2[Ff]|%3[Ee])~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via HTML tags in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13604-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^[^?]*(?:%6[Ff]|o)n(?:error|load|click|mouseover|focus|toggle)(?:\\\\s*(?:=|%3[Dd]))~i"}], "cve": "CVE-2025-13604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13604", "description": "Security & Malware scan by CleanTalk <=2.168 unauthenticated stored XSS via event handlers in URL path segment", "method": "GET", "mode": "block", "severity": 7.2, "slug": "security-malware-firewall", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.168"}, "RULE-CVE-2025-13608-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-13608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[child_pages\\\\b[^\\\\]]*\\\\buse_custom_(?:link|link_target|thumbs|excerpt)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13608", "description": "CC Child Pages <=2.0.0 Authenticated (Contributor+) Stored XSS via child_pages shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cc-child-pages", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-1361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "ip2location-country-blocker"}, {"type": "missing_capability", "value": "administrator"}], "cve": "CVE-2025-1361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1361", "description": "IP2Location Country Blocker <=2.38.8 missing authorization on admin_init allows unauthenticated settings disclosure", "mode": "block", "severity": 5.3, "slug": "ip2location-country-blocker", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.38.8"}, "RULE-CVE-2025-13610-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[RM_Forms\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|on(?:error|load|click|mouseover|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13610", "description": "RegistrationMagic <=6.0.6.7 Stored XSS via RM_Forms shortcode theme attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=6.0.6.7"}, "RULE-CVE-2025-13610-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[RM_Forms\\\\b[^\\\\]]*theme\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|on(?:error|load|click|mouseover|animationstart|focus|blur)\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13610", "description": "RegistrationMagic <=6.0.6.7 Stored XSS via RM_Forms shortcode theme attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=6.0.6.7"}, "RULE-CVE-2025-13620-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu/v1/save_cache/[^/?&]+(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13620", "description": "WP Social <=3.1.3 unauthenticated cache overwrite via wslu/v1/save_cache REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-social", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-13620-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu/v1/check_cache/[^/?&]+(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13620", "description": "WP Social <=3.1.3 unauthenticated cache probe via wslu/v1/check_cache REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-social", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-13620-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wslu/v1/settings/clear_counter_cache(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13620", "description": "WP Social <=3.1.3 unauthenticated cache wipe via wslu/v1/settings/clear_counter_cache REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-social", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-13622-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "jabbernotification.php"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:%2522|%253[Cc]|%253[Ee]|\\"|<|>|on\\\\w+\\\\s*=)[^?]*(?:\\\\?|$)~i"}], "cve": "CVE-2025-13622", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13622", "description": "Jabbernotification <=0.99-RC2 reflected XSS via PATH_INFO in admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "jabberbenachrichtigung", "tags": ["xss", "reflected-xss", "path-info"], "target": "plugin", "versions": "<=0.99-RC2"}, "RULE-CVE-2025-13626-01": {"ajax_action": "mylco_pagerank", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_pagerank AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-02": {"ajax_action": "mylco_alexa", "conditions": [{"name": "ARGS:url", "type": "detectXSS"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via unsanitized url parameter in mylco_alexa AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php/(?:[^?]*(?:[<>\\"\']|%3c|%3e|%22|%27).*)?[?&]page=mylco(?:&|$)~i"}], "cve": "CVE-2025-13626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13626", "description": "myLCO <=0.8.1 reflected XSS via $_SERVER[\'PHP_SELF\'] path-info injection on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mylco", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.8.1"}, "RULE-CVE-2025-13641-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in post content (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?(?:/|[A-Za-z]:[/\\\\\\\\])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (absolute path)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "php-file-inclusion", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13641-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:nggallery|nggtags|ngg_images|ngg|slideshow|imagebrowser)[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13641", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13641", "description": "NextGEN Gallery <=3.59.12 Local File Inclusion via shortcode template attribute in REST API content field (directory traversal)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "nextgen-gallery", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.59.12"}, "RULE-CVE-2025-13645-01": {"ajax_action": "modula_unzip_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13645", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13645", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file/directory deletion via path traversal in ajax_unzip_file \\u2014 over-protection capability gate (payload is in zip binary, not HTTP params)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated", "over-protection"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13646-01": {"ajax_action": "modula_unzip_file", "conditions": [{"name": "ARGS:fileID", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13646", "description": "Modula Image Gallery <=2.13.2 authenticated arbitrary file upload via modula_unzip_file AJAX handler", "method": "POST", "mode": "block", "severity": 6.6, "slug": "modula-best-grid-gallery", "tags": ["arbitrary-file-upload", "race-condition", "authenticated"], "target": "plugin", "versions": "<=2.13.2"}, "RULE-CVE-2025-13678-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<script|javascript:|[\\"\']\\\\s*[>/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13678-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thailottery\\\\b[^\\\\]]*(?:width|height)\\\\s*=[\\\\s\\"\']*[^\\\\]]*(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<script|javascript:|[\\"\']\\\\s*[>/])~i"}], "cve": "CVE-2025-13678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13678", "description": "Thai Lottery Widget <=2.5 authenticated stored XSS via thailottery shortcode width/height attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "thai-lottery-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.5"}, "RULE-CVE-2025-13679-01": {"ajax_action": "tutor_order_details", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13679", "description": "Tutor LMS <=3.9.3 missing authorization on tutor_order_details AJAX action allows subscriber+ to exfiltrate order PII", "mode": "block", "severity": 6.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2025-13681-01": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:%2e%2e[%2f%5c]){2,})~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated path traversal via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "missing-authorization"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13681-02": {"action": "admin_post_bfgtoexz_zip", "conditions": [{"name": "ARGS:first_file", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13681", "description": "BFG Tools \\u2013 Extension Zipper <=1.0.7 authenticated sensitive file read via first_file parameter in admin_post_bfgtoexz_zip handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bfg-tools-extension-zipper", "tags": ["path-traversal", "arbitrary-file-read", "sensitive-file-disclosure"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-13682-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit\\\\.php~"}, {"name": "ARGS:bulk_trail_networks_changed", "type": "regex", "value": "~<[a-zA-Z]{2,}|<!|on[a-zA-Z]+=|javascript:|&#~i"}], "cve": "CVE-2025-13682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13682", "description": "Trail Manager <=1.0.0 stored XSS via unsanitized bulk_trail_networks_changed parameter in admin notice", "mode": "block", "severity": 4.4, "slug": "trail-manager", "tags": ["xss", "stored-xss", "admin-notice"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-13693-01": {"ajax_action": "save_gallery", "conditions": [{"name": "ARGS:ftg_script", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13693", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13693", "description": "Final Tiles Grid Gallery <=3.6.8 authenticated (Author+) stored XSS via ftg_script parameter in save_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=3.6.8"}, "RULE-CVE-2025-13697-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~blockart/countdown(?:(?:[^\\"}]|\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\")*)\\"timestamp\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\\\\\u0027|\'\\\\s*(?:on[a-z]+\\\\s*=|style\\\\s*=|href\\\\s*=)|<[a-z]|on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-13697", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13697", "description": "BlockArt Blocks <=2.2.13 Stored XSS via Countdown block timestamp attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2025-13697-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~blockart/countdown(?:(?:[^\\"}]|\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\")*)\\"timestamp\\"\\\\s*:\\\\s*\\"[^\\"]*(?:\\\\\\\\u0027|\'\\\\s*(?:on[a-z]+\\\\s*=|style\\\\s*=|href\\\\s*=)|<[a-z]|on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-13697", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13697", "description": "BlockArt Blocks <=2.2.13 Stored XSS via Countdown block timestamp attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2025-13705-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[customframe\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*(?:\\"[^\\"]*\\"|\'[^\']*\')[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|<img|<svg|<iframe|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13705", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13705", "description": "Custom Frames <=1.0.1 authenticated (Contributor+) stored XSS via class shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "custom-frames", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13724-01": {"action": "admin_post_nopriv_vikrentcar", "conditions": [{"name": "ARGS:month", "type": "detectSQLi"}], "cve": "CVE-2025-13724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13724", "description": "VikRentCar <=1.4.4 unauthenticated SQL injection via month parameter on admin_post_nopriv_vikrentcar", "method": "POST", "mode": "block", "severity": 7.5, "slug": "vikrentcar", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-13724-02": {"action": "admin_post_vikrentcar", "conditions": [{"name": "ARGS:month", "type": "detectSQLi"}], "cve": "CVE-2025-13724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13724", "description": "VikRentCar <=1.4.4 authenticated SQL injection via month parameter on admin_post_vikrentcar", "method": "POST", "mode": "block", "severity": 7.5, "slug": "vikrentcar", "tags": ["sql-injection", "time-based-blind"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-13724-03": {"ajax_action": "vikrentcar", "conditions": [{"name": "ARGS:month", "type": "detectSQLi"}], "cve": "CVE-2025-13724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13724", "description": "VikRentCar <=1.4.4 authenticated SQL injection via month parameter on wp_ajax_vikrentcar", "method": "POST", "mode": "block", "severity": 7.5, "slug": "vikrentcar", "tags": ["sql-injection", "time-based-blind"], "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2025-13725-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/block-renderer/thim-blocks/icon(?:/|\\\\?|$)~"}, {"name": "ARGS:attributes[iconSVG]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-13725", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13725", "description": "Gutenberg Thim Blocks <=1.0.1 authenticated arbitrary file read via iconSVG path traversal in thim-blocks/icon block renderer", "method": "GET", "mode": "block", "severity": 6.5, "slug": "thim-blocks", "tags": ["path-traversal", "arbitrary-file-read", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13728-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*redirect_to\\\\s*=~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|<script|javascript:)~i"}], "cve": "CVE-2025-13728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13728", "description": "FluentAuth <=2.0.3 Stored XSS via fluent_auth_reset_password shortcode redirect_to attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-security", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-13728-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*redirect_to\\\\s*=~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluent_auth_reset_password\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|<script|javascript:)~i"}], "cve": "CVE-2025-13728", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13728", "description": "FluentAuth <=2.0.3 Stored XSS via fluent_auth_reset_password shortcode redirect_to attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluent-security", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-13730-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[openid_connect_generic_auth_url\\\\b[^\\\\]]*(?:<[^>]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13730-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[openid_connect_generic_auth_url\\\\b[^\\\\]]*(?:<[^>]+>|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13730", "description": "OpenID Connect Generic Client <=3.10.0 Stored XSS via shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "daggerhart-openid-connect-generic", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2025-13732-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13732", "description": "s2Member <=251005 Stored XSS via s2Eot shortcode past_format/future_format/next_format/empty_format attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "s2member", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=251005"}, "RULE-CVE-2025-13732-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13732", "description": "s2Member <=251005 Stored XSS via s2Eot shortcode attributes in post_content parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "s2member", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=251005"}, "RULE-CVE-2025-13732-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[s2Eot\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13732", "description": "s2Member <=251005 Stored XSS via s2Eot shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "s2member", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=251005"}, "RULE-CVE-2025-13739-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cryptx\\\\b[^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13739", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13739", "description": "CryptX <=4.0.5 Authenticated (Contributor+) Stored XSS via cryptx shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cryptx", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-13739-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cryptx\\\\b[^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13739", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13739", "description": "CryptX <=4.0.5 Authenticated (Contributor+) Stored XSS via cryptx shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cryptx", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-13746-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:display_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Display Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Nickname on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:first_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User First Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13746-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:profile\\\\.php|user-edit\\\\.php)~"}, {"name": "ARGS:last_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13746", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13746", "description": "ForumWP <=2.1.6 Stored XSS via User Last Name on profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forumwp", "tags": ["xss", "stored-xss", "profile-update"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-13838-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13838-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wishsuite_button[^\\\\]]*button_(?:text|added_text|exist_text)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*<[^>]*(?:on\\\\w+\\\\s*=|script|iframe|object|embed)~i"}], "cve": "CVE-2025-13838", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13838", "description": "WishSuite <=1.5.1 Stored XSS via wishsuite_button shortcode button_text attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wishsuite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.1"}, "RULE-CVE-2025-13840-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13840-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bukazu_search\\\\b[^\\\\]]*shortcode\\\\s*=\\\\s*(?:\\"[^\\"]*<|\'[^\']*<|[^\\\\s\\\\]]*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13840", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13840", "description": "BUKAZU Search Widget <=3.4 stored XSS via bukazu_search shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bukazu-search-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.4"}, "RULE-CVE-2025-13846-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13846-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[easy_map_creator\\\\b[^\\\\]]*\\\\bwidth\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\'][^\\\\]]*(?:<|>|on\\\\w+\\\\s*=|javascript:|style\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13846", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13846", "description": "Easy Map Creator <=3.0.2 Stored XSS via shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-map-creator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2025-13852-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13852-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[lead_form\\\\s[^\\\\]]*configuration\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=)|\'[^\']*(?:<[a-z]|&#x?[0-9a-f]+;|javascript:|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=))~i"}], "cve": "CVE-2025-13852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13852", "description": "Debt.com Business in a Box <=4.1.0 Stored XSS via lead_form shortcode configuration attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "debtcom-business-in-a-box", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-13853-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]nn-tech[^]]*data_tech *=[^]]*(<[^>]+on[a-zA-Z]+=|<script|<img[^>]+onerror|<iframe|javascript:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13853", "description": "Nearby Now Reviews <=5.2 Stored XSS via nn-tech shortcode data_tech attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "nearby-now-reviews", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.2"}, "RULE-CVE-2025-13859-01": {"ajax_action": "save_customization_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_customization_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13859", "description": "AffiliateX <=1.3.9.3 missing authorization on save_customization_settings AJAX action allowing Subscriber+ stored XSS", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliatex", "tags": ["missing-authorization", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=1.3.9.3"}, "RULE-CVE-2025-13861-01": {"ajax_action": "hf_form_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:script|svg|img|iframe|object|embed|details|marquee|video|audio|body|math|xmp|isindex|style|link|base|meta|form|input|button|select|textarea|keygen|source|track|frameset|frame|applet|xml)[\\\\s/>#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via form field values on hf_form_submit AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13861-02": {"action": "init", "conditions": [{"name": "ARGS:_hf_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|svg|img|iframe|object|embed|details|marquee|video|audio|body|math|xmp|isindex|style|link|base|meta|form|input|button|select|textarea|keygen|source|track|frameset|frame|applet|xml)[\\\\s/>#]|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|start|animationend|beforeprint|change|dblclick|drag|drop|ended|hashchange|input|invalid|key(?:down|press|up)|mouse(?:down|enter|leave|move|out|over|up)|page(?:show|hide)|paste|play|pointer|progress|resize|scroll|search|select|submit|touch|transition|unload|wheel)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64\\\\s*,~i"}], "cve": "CVE-2025-13861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13861", "description": "HTML Forms <=1.6.0 unauthenticated stored XSS via non-AJAX form submission with _hf_form_id", "method": "POST", "mode": "block", "severity": 6.1, "slug": "html-forms", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-13864-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/breeze/v1/clear-all-cache(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13864", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13864", "description": "Breeze <=2.2.21 unauthenticated cache clearing via REST API endpoint breeze/v1/clear-all-cache", "method": "POST", "mode": "block", "severity": 5.3, "slug": "breeze", "tags": ["missing-authorization", "unauthenticated", "rest-api", "cache-deletion"], "target": "plugin", "versions": "<=2.2.21"}, "RULE-CVE-2025-13880-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated access to advanced settings via REST API (GET)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13880-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-social-reviews/v1/advance-settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13880", "description": "WP Social Ninja <=4.0.1 unauthenticated modification of advanced settings via REST API (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-social-reviews", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-13886-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[book\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [book] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13886-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[books\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/])~i"}], "cve": "CVE-2025-13886", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13886", "description": "LT Unleashed <=1.1.1 Local File Inclusion via [books] shortcode template attribute (Gutenberg REST API)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lt-unleashed", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13887-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13887-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ai_botkit_widget\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*(?:[<>\\"\']|&#|on\\\\w+\\\\s*=)|(?=[^\\\\s\\\\]\\"\'])[^^\\\\s\\\\]]*(?:[<>]|on\\\\w+\\\\s*=))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13887", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13887", "description": "AI BotKit <=1.1.7 Authenticated (Contributor+) Stored XSS via ai_botkit_widget shortcode id attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-botkit-for-lead-generation", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-13889-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13889-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[snivo\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-13889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13889", "description": "Simple Nivo Slider <=0.5.6 Stored XSS via [snivo] shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-nivo-slider", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=0.5.6"}, "RULE-CVE-2025-13896-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[igp-wp\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*[<>;()\\\\\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13896", "description": "Social Feed Gallery Portfolio <=1.3 Stored XSS via igp-wp shortcode id attribute (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-feed-gallery-portfolio", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-13897-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_name metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13897-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:aft_testimonial_meta_company", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-13897", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13897", "description": "Client Testimonial Slider <=2.0 stored XSS via aft_testimonial_meta_company metabox field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-client-testimonial", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-13898-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:<script|on[a-zA-Z]+\\\\s*=|javascript:|<img|<iframe|<svg|<object|<embed|<details[^>]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via [ultra_skype] shortcode btn_id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13898-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ultra_skype\\\\b[^\\\\]]*btn_id\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:<script|on[a-zA-Z]+\\\\s*=|javascript:|<img|<iframe|<svg|<object|<embed|<details[^>]*ontogg)~i"}], "cve": "CVE-2025-13898", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13898", "description": "Ultra Skype Button <=1.0 Stored XSS via REST API post creation with [ultra_skype] shortcode btn_id attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultra-skype-button", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-13904-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gancio-events?\\\\b[^\\\\]]*(?:on[a-z]+=|javascript\\\\s*:|<script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13904", "description": "WPGancio <=1.12 Stored XSS via gancio-event/gancio-events shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpgancio", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-13904-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gancio-events?\\\\b[^\\\\]]*(?:on[a-z]+=|javascript\\\\s*:|<script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13904", "description": "WPGancio <=1.12 Stored XSS via gancio-event/gancio-events shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpgancio", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-13906-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:linechart|barchart|piechart)\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13906-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:linechart|barchart|piechart)\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|[\'\\"]\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-13906", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13906", "description": "WP Flot <=0.2.2 Stored XSS via [linechart] shortcode attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-flot", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.2.2"}, "RULE-CVE-2025-13907-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]button[^]]*(?:\\\\b(?:href|url|link)\\\\s*=\\\\s*([\\"\'])\\\\s*(?:javascript:|data:)|on(?:abort|blur|change|click|dblclick|error|focus|input|keydown|keypress|keyup|load|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|reset|resize|scroll|submit|unload)\\\\s*=|<script)~i"}], "cve": "CVE-2025-13907", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13907", "description": "CSS3 Buttons <=0.1 Stored XSS via [button] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "css3-buttons", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-13908-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[the_tooltip\\\\b[^\\\\]]*(?:[\\\\s\\"\']on(?:click|error|load|mouseover|focus|blur|toggle|change|submit|key(?:down|up|press)|pointer(?:down|up)|mouseenter|mouseleave)\\\\s*=|javascript:|<script|<img|<svg|<iframe|<embed|<object|<details[^>]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13908-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[the_tooltip\\\\b[^\\\\]]*(?:[\\\\s\\"\']on(?:click|error|load|mouseover|focus|blur|toggle|change|submit|key(?:down|up|press)|pointer(?:down|up)|mouseenter|mouseleave)\\\\s*=|javascript:|<script|<img|<svg|<iframe|<embed|<object|<details[^>]*ontoggle)~i"}], "cve": "CVE-2025-13908", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13908", "description": "The Tooltip <=1.0.2 Stored XSS via [the_tooltip] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-tooltip", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-13958-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection in post content", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode attribute event handler injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*\\\\]\\\\s*\\\\}~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode JS context breakout via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13958-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[yamap[^\\\\]]*[\'\\"]\\\\s*/?>\\\\s*<~i"}], "cve": "CVE-2025-13958", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13958", "description": "YaMaps for WordPress <0.6.40 stored XSS via [yamap] shortcode HTML tag injection via REST API", "method": "POST", "mode": "block", "severity": 5.9, "slug": "yamaps", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<0.6.40"}, "RULE-CVE-2025-13963-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*(?:tmpl|prefix|suffix)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|<details\\\\b[^>]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode attributes (tmpl/prefix/suffix)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13963-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fxcc_convert\\\\b[^\\\\]]*\\\\][^\\\\[]*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|<details\\\\b[^>]*\\\\bontoggle\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-13963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13963", "description": "FX Currency Converter <=0.2.0 Stored XSS via fxcc_convert shortcode enclosed content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fx-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2025-13964-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_add_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section creation via lp-load-ajax=course_add_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-02": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section update via lp-load-ajax=course_update_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_delete_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated course section deletion via lp-load-ajax=course_delete_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "course_update_section_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated section reorder via lp-load-ajax=course_update_section_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-05": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "create_item_add_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item creation via lp-load-ajax=create_item_add_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-06": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "add_items_to_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item addition via lp-load-ajax=add_items_to_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-07": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "delete_item_from_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item deletion via lp-load-ajax=delete_item_from_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-08": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_section_and_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item move via lp-load-ajax=update_item_section_and_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-09": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_items_position"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item reorder via lp-load-ajax=update_items_position", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13964-10": {"action": "wp_loaded", "conditions": [{"name": "ARGS:lp-load-ajax", "type": "equals", "value": "update_item_of_section"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-13964", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13964", "description": "LearnPress <=4.3.2 unauthenticated item update via lp-load-ajax=update_item_of_section", "method": "POST", "mode": "block", "severity": 5.3, "slug": "learnpress", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2025-13972-01": {"action": "parse_request", "conditions": [{"name": "ARGS:wht_download_big_object", "type": "exists"}, {"name": "ARGS:wht_download_big_object_origin", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|[\\\\\\\\/]proc[\\\\\\\\/]|[\\\\\\\\/]var[\\\\\\\\/]log|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-13972", "mode": "block", "severity": 4.9, "slug": "watchtowerhq", "target": "plugin", "versions": "<=3.16.0"}, "RULE-CVE-2025-13973-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/uploads/stickeasy-protected-contact-form/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/uploads/stickeasy-protected-contact-form/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.0 uploads directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13973-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-content/spcf-logs/spcf-log(?:(?:\\\\.|%2e)(?:txt|log))?|wp-content/spcf-logs/)(?:$|[\\\\?#])~i"}], "cve": "CVE-2025-13973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13973", "description": "StickEasy Protected Contact Form <=1.0.1 unauthenticated information disclosure via predictable spam log file path (v1.0.1 spcf-logs directory)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "stickeasy-protected-contact-form", "tags": ["information-disclosure", "unauthenticated", "predictable-resource-location"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-13974-01": {"ajax_action": "thwecmf_template_actions", "conditions": [{"name": "ARGS:contents", "type": "regex", "value": "~<\\\\s*(?:script|iframe|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|change|submit|input)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[^>]+\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-13974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13974", "description": "Email Customizer for WooCommerce <=2.6.7 authenticated stored XSS via template content save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "email-customizer-for-woocommerce", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.6.7"}, "RULE-CVE-2025-13977-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13977-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|\\\\?(?:.*&)?rest_route=/wp/v2/posts/\\\\d+)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script[\\\\s>]|<\\\\s*svg[^>]*\\\\bon\\\\w+\\\\s*=)~is"}], "cve": "CVE-2025-13977", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.5.3"}, "RULE-CVE-2025-13989-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13989-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_dropzone[^\\\\]]*callback\\\\s*=~i"}], "cve": "CVE-2025-13989", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13989", "description": "WP Dropzone <=1.1.1 authenticated (Contributor+) stored XSS via callback shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-dropzone", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-13999-01": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|tftp|ldap|ssh)://~i"}, {"name": "ARGS:url", "type": "exists"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data AJAX action url parameter", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-13999-02": {"ajax_action": "h5ap_get_stream_data", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "h5ap_get_stream_data"}, {"name": "ARGS:url", "type": "regex", "value": "~https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|\\\\[?::1\\\\]?|\\\\[?::ffff:127\\\\.|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0177\\\\.|0x7f|2130706433|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2025-13999", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-13999", "description": "HTML5 Audio Player <=2.5.1 unauthenticated SSRF via h5ap_get_stream_data targeting localhost/internal IPs", "mode": "block", "severity": 7.2, "slug": "html5-audio-player", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": ">=2.4.0 <=2.5.1"}, "RULE-CVE-2025-14000-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[restrict\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [restrict] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14000-02": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[register_form\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*svg\\\\b|<\\\\s*img\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14000", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.15 authenticated (Contributor+) stored XSS via [register_form] shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "restrict-content", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.15"}, "RULE-CVE-2025-14001-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14001-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action2", "type": "equals", "value": "wp_duplicate_page_bulk_action"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-14001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14001", "description": "WP Duplicate Page <=1.8 missing authorization on bulk post duplication via action2 parameter", "mode": "block", "severity": 5.4, "slug": "wp-duplicate-page", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-14030-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*aife_post_meta\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14030", "description": "AI Feeds <=1.0.22 Authenticated (Contributor+) Stored XSS via aife_post_meta shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-feeds", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.22"}, "RULE-CVE-2025-14032-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14032-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:bold_timeline_group|bold_timeline_item)\\\\b[^\\\\]]*\\\\btitle\\\\s*=\\\\s*(?:\\"[^\\"]*[<>][^\\"]*\\"|\'[^\']*[<>][^\']*\')~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14032", "description": "Bold Timeline Lite <=1.2.7 stored XSS via title attribute in bold_timeline_group shortcode (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-timeline-lite", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-14039-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_client_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_client_name meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|</?(?:iframe|object|embed|form|input|textarea|button|select|details|marquee)[\\\\s/>])~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via _simple_folio_item_link meta field (HTML injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14039-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "simple_folio_item"}, {"name": "ARGS:_simple_folio_item_link", "type": "regex", "value": "~j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:~i"}], "cve": "CVE-2025-14039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14039", "description": "Simple Folio <=1.1.1 stored XSS via javascript protocol in _simple_folio_item_link href", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-folio", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14049-01": {"action": "admin_post_nopriv_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on unauthenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-14049-02": {"action": "admin_post_vikrentitems", "conditions": [{"name": "ARGS:delto", "type": "detectXSS"}], "cve": "CVE-2025-14049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14049", "description": "VikRentItems <=1.2.0 reflected XSS via delto parameter on authenticated admin-post endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "vikrentitems", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-1405-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[show_products"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[show_products\\\\s[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1405", "description": "Product Catalog Simple <=1.7.11 Stored XSS via show_products shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-type-x", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.7.11"}, "RULE-CVE-2025-1405-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "[show_products"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[show_products\\\\s[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1405", "description": "Product Catalog Simple <=1.7.11 Stored XSS via show_products shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-type-x", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.7.11"}, "RULE-CVE-2025-1405-03": {"action": "init", "conditions": [{"name": "ARGS:product_order", "type": "detectXSS"}], "cve": "CVE-2025-1405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1405", "description": "Product Catalog Simple <=1.7.11 Reflected XSS via product_order parameter on product listing pages", "mode": "block", "severity": 5.4, "slug": "post-type-x", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=1.7.11"}, "RULE-CVE-2025-14050-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:import", "type": "equals", "value": "design-import-export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14050", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14050", "description": "Design Import/Export <=2.2 authenticated (Administrator+) SQL injection via XML file import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "design-import-export", "tags": ["sql-injection", "authenticated", "file-upload"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-14056-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cptui_tools"}, {"name": "ARGS:cptui_post_import", "type": "regex", "value": "~<[a-zA-Z!/][^>]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_post_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-14056-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "cptui_tools"}, {"name": "ARGS:cptui_tax_import", "type": "regex", "value": "~<[a-zA-Z!/][^>]*>~"}], "cve": "CVE-2025-14056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14056", "description": "Custom Post Type UI <=1.18.1 Stored XSS via label in cptui_tax_import JSON on Tools page", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-post-type-ui", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.18.1"}, "RULE-CVE-2025-1406-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-1406-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[npc\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|>|on\\\\w+\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1406", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1406", "description": "Newpost Catch <=1.3.19 authenticated (contributor+) stored XSS via npc shortcode id attribute in REST content field", "method": "POST", "mode": "block", "severity": 5.4, "slug": "newpost-catch", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.19"}, "RULE-CVE-2025-14061-01": {"ajax_action": "gdpr_delete_policy_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14061", "description": "WP Cookie Consent <=4.0.7 missing authorization on gdpr_delete_policy_data AJAX handler allowing unauthenticated arbitrary post deletion", "mode": "block", "severity": 5.3, "slug": "gdpr-cookie-consent", "tags": ["missing-authorization", "arbitrary-post-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.0.7"}, "RULE-CVE-2025-14064-01": {"ajax_action": "get_board", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_board AJAX endpoint allows unauthorized access to any group task board", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-02": {"ajax_action": "add_new_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_new_task AJAX endpoint allows unauthorized task creation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-03": {"ajax_action": "edit_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_task AJAX endpoint allows unauthorized task modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-04": {"ajax_action": "delete_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on delete_task AJAX endpoint allows unauthorized task deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-05": {"ajax_action": "reorder_task", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on reorder_task AJAX endpoint allows unauthorized task reordering", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-06": {"ajax_action": "get_tasks", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on get_tasks AJAX endpoint allows unauthorized task data access", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-07": {"ajax_action": "edit_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on edit_list AJAX endpoint allows unauthorized list modification", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-08": {"ajax_action": "users_autocomplete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on users_autocomplete AJAX endpoint allows unauthorized user enumeration", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control", "info-disclosure"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14064-09": {"ajax_action": "add_users_to_assign_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14064", "description": "BuddyTask <=1.3.0 missing authorization on add_users_to_assign_list AJAX endpoint allows unauthorized user assignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "buddytask", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-14069-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14069-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:saswp_custom_schema_field", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14069", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14069", "description": "Schema & Structured Data for WP & AMP <=1.54 Stored XSS via saswp_custom_schema_field on user-edit profile update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.54"}, "RULE-CVE-2025-14079-01": {"ajax_action": "eh_crm_ticket_general", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14079", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14079", "description": "ELEX WordPress HelpDesk & Customer Support Ticket System <=3.3.5 missing authorization on eh_crm_ticket_general AJAX settings update", "method": "POST", "mode": "block", "severity": 5.3, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2025-14109-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14109-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[column\\\\s[^\\\\]]*column\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14109", "description": "AH Shortcodes <=1.0.2 Stored XSS via [column] shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ah-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-14110-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(list-pages|child-pages|tree-pages)\\\\s[^\\\\]]*class\\\\s*=\\\\s*[\\\\\\"\'][^\\\\]]*(?:<|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14110", "description": "WP Js List Pages Shortcodes <=1.21 stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-js-list-pages-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.21"}, "RULE-CVE-2025-14112-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14112-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~snillrik_restaurant_menu[^\\\\]]*menu_style\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[^>]+>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-14112", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14112", "description": "Snillrik Restaurant Menu <=2.2.1 Stored XSS via menu_style shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "snillrik-restaurant-menu", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-14113-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14113-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[link\\\\b[^\\\\]]*(?:javascript\\\\s*:|data\\\\s*:|\\\\bon[a-z]+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-14113", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14113", "description": "Viitor Button Shortcodes <=3.0.0 Stored XSS via [link] shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "viitor-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-14114-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14114-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(row|span|column)[^\\\\]]*class\\\\s*=\\\\s*[\'\\"][^\'\\"]*(<|on[a-z]+=|javascript:|&#)~i"}], "cve": "CVE-2025-14114", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14114", "description": "1180px Shortcodes <=1.1.1 authenticated (Contributor+) stored XSS via shortcode class attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "1180px-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2025-14119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[atvc_video_play\\\\b[^\\\\]]*(?:on[a-zA-Z]+=|javascript:|<script|data:[a-zA-Z]+/[a-zA-Z]+;base64)~i"}], "cve": "CVE-2025-14119", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14119", "description": "App Landing Template Blocks for WPBakery <=2.0.2 stored XSS via atvc_video_play shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "app-template-blocks-for-wpbakery-page-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14119-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[atvc_video_play\\\\b[^\\\\]]*(?:on[a-zA-Z]+=|javascript:|<script|data:[a-zA-Z]+/[a-zA-Z]+;base64)~i"}], "cve": "CVE-2025-14119", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14119", "description": "App Landing Template Blocks for WPBakery <=2.0.2 stored XSS via atvc_video_play shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "app-template-blocks-for-wpbakery-page-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-14120-01": {"ajax_action": "bfu_chunker", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg[z]?(?:\\\\.|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14120", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14120", "description": "URL Image Importer <=1.0.7 authenticated (Author+) stored XSS via SVG file upload in bfu_chunker AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "url-image-importer", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2025-14122-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sliding_faq\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b|<embed\\\\b|<object\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14122", "description": "AD Sliding FAQ <=2.4 Stored XSS via sliding_faq shortcode attributes in post content (admin post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-sliding-faq", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2025-14122-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sliding_faq\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b|<embed\\\\b|<object\\\\b)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14122", "description": "AD Sliding FAQ <=2.4 Stored XSS via sliding_faq shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ad-sliding-faq", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2025-14124-01": {"ajax_action": "ttp_Layout_Ajax_Action", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:^|[\'\\"])\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2025-14124", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14124", "description": "Team \\u2013 Team Members Showcase <=5.0.10 unauthenticated SQL injection via search parameter in ttp_Layout_Ajax_Action AJAX handler", "method": "POST", "mode": "block", "severity": 8.6, "slug": "tlp-team", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14142-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[electric-enquiry\\\\b[^\\\\]]*button\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[<>]|\\\\bon\\\\w+\\\\s*=)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-14142", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14142", "description": "Electric Enquiries <=1.1 Stored XSS via button attribute of electric-enquiry shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "electric-enquiries", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-14143-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute containing javascript URI in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute with tag injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (event handler)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*(?:javascript|expression)\\\\s*[:(/]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14143-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ayo_action\\\\b[^\\\\]]*color\\\\s*=[^\\\\]]*<[a-z]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14143", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14143", "description": "Ayo Shortcodes <=0.2 Stored XSS via ayo_action shortcode color attribute in REST API post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayo-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-14144-01": {"ajax_action": "ajax_live_preview", "conditions": [{"name": "ARGS:shortcodeData", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseout|mousemove|keydown|keyup|keypress|submit|change|input|animationend|animationstart)\\\\s*=~i"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via shortcodeData in ajax_live_preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14144-02": {"ajax_action": "mstoic_shortcodes_print_images", "conditions": [{"name": "ARGS:mstoicImgCount", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-14144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14144", "description": "Mstoic Shortcodes <=2.0 reflected XSS via mstoicImgCount in mstoic_shortcodes_print_images AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mstoic-shortcodes", "tags": ["xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14147-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14147-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gist\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-14147", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14147", "description": "Easy GitHub Gist Shortcodes <=1.0 Stored XSS via gist shortcode id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-github-gist-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14151-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:outbound_resource", "type": "regex", "value": "~(?i)(?:<\\\\s*(?:script|svg)\\\\b|\\\\bon(?:load|error)\\\\s*=|\\\\bjavascript\\\\s*:)~"}], "cve": "CVE-2025-14151", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14151", "description": "SlimStat Analytics <=5.3.2 unauthenticated stored XSS via outbound_resource parameter in slimtrack AJAX action", "mode": "block", "severity": 6.1, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.2"}, "RULE-CVE-2025-14154-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~join_chat$~"}, {"name": "ARGS:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14154", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14154", "description": "Better Messages <=2.10.2 stored XSS via unauthenticated guest display name in join chat", "method": "POST", "mode": "block", "severity": 6.1, "slug": "bp-better-messages", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-14156-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fox-lms/v1/payments/create-order(/|\\\\?|&|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-14156", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14156", "description": "Fox LMS >=1.0.4.7 <=1.0.5.1 unauthenticated privilege escalation via role parameter in create-order REST endpoint", "method": "POST", "mode": "block", "severity": 9.8, "slug": "fox-lms", "tags": ["privilege-escalation", "unauthenticated", "rest-api"], "target": "plugin", "versions": ">=1.0.4.7 <=1.0.5.1"}, "RULE-CVE-2025-14172-01": {"ajax_action": "cwpp_trigger_flush_rewrite_rules", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14172", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14172", "description": "WP Page Permalink Extension <=1.5.4 missing authorization on cwpp_trigger_flush_rewrite_rules AJAX action allows Subscriber+ to flush rewrite rules", "mode": "block", "severity": 6.5, "slug": "change-wp-page-permalinks", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-14293-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:\\\\\\\\)~"}], "cve": "CVE-2025-14293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14293", "description": "WP Job Portal <=2.4.0 authenticated arbitrary file read via path traversal in filename parameter", "mode": "block", "severity": 6.5, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-read", "local-file-inclusion"], "target": "plugin", "versions": "<=2.4.0"}, "RULE-CVE-2025-14298-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*</style>~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php, event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*<script~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes in post content (post.php, script tag injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*</style>~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (style breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (event handler breakout)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14298-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[thegem_te_search[^\\\\]]*<script~i"}], "cve": "CVE-2025-14298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14298", "description": "FiboSearch <= 1.32.0 Stored XSS via thegem_te_search shortcode attributes via REST API (script tag injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ajax-search-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2025-14344-01": {"ajax_action": "gfmu_delete_file", "conditions": [{"name": "ARGS:file_id", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-14344", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gf-multi-uploader", "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-14344-02": {"ajax_action": "gfmu_delete_file", "conditions": [{"name": "ARGS:tmp_name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-14344", "method": "POST", "mode": "block", "severity": 9.8, "slug": "gf-multi-uploader", "target": "plugin", "versions": "<=1.1.7"}, "RULE-CVE-2025-14348-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wemail/v1/csv(/|\\\\?|$)~"}, {"name": "REQUEST_HEADERS:x-wemail-user", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14348", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14348", "description": "weMail <=2.0.7 unauthenticated information disclosure via x-wemail-user header spoofing on REST CSV endpoints", "method": "GET", "mode": "block", "severity": 5.3, "slug": "wemail", "tags": ["improper-authorization", "information-disclosure", "unauthenticated", "rest-api", "header-spoofing"], "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2025-14351-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:bcf_google_font_delete_all", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14351", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14351", "description": "Custom Fonts <=2.1.16 unauthenticated font directory deletion via bcf_google_font_delete_all", "method": "GET", "mode": "block", "severity": 5.3, "slug": "custom-fonts", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.1.16"}, "RULE-CVE-2025-14351-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:bcf_google_font_delete", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14351", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14351", "description": "Custom Fonts <=2.1.16 unauthenticated single font deletion via bcf_google_font_delete", "method": "GET", "mode": "block", "severity": 5.3, "slug": "custom-fonts", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.1.16"}, "RULE-CVE-2025-14351-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/~"}, {"name": "ARGS:bcf_rebuild_fonts", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14351", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14351", "description": "Custom Fonts <=2.1.16 unauthenticated font rebuild triggering theme.json rewrite via bcf_rebuild_fonts", "method": "GET", "mode": "block", "severity": 5.3, "slug": "custom-fonts", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=2.1.16"}, "RULE-CVE-2025-14375-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:className", "type": "detectXSS"}], "cve": "CVE-2025-14375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14375", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via className parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.1, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14383-01": {"ajax_action": "WPBC_AJX_CALENDAR_LOAD", "conditions": [{"name": "ARGS:dates_to_check", "type": "detectSQLi"}], "cve": "CVE-2025-14383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14383", "description": "Booking Calendar <=10.14.8 unauthenticated SQL injection via dates_to_check parameter in WPBC_AJX_CALENDAR_LOAD AJAX handler", "mode": "block", "severity": 7.5, "slug": "booking", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=10.14.8"}, "RULE-CVE-2025-14386-01": {"ajax_action": "generate_sso_url", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on generate_sso_url AJAX handler allows Subscriber+ to extract admin SSO token", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-02": {"ajax_action": "validate_sso_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on validate_sso_token AJAX handler allows Subscriber+ to validate/consume admin SSO token", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14386-03": {"ajax_action": "check_sso_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386", "description": "Search Atlas SEO (metasync) <=2.5.11 missing authorization on check_sso_status AJAX handler allows Subscriber+ to query SSO status", "method": "POST", "mode": "block", "severity": 8.8, "slug": "metasync", "tags": ["missing-authorization", "authentication-bypass", "privilege-escalation"], "target": "plugin", "versions": ">=2.4.4 <=2.5.11"}, "RULE-CVE-2025-14388-01": {"action": "init", "conditions": [{"name": "ARGS:phast", "type": "exists"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:%00|%2500|\\\\x00)~"}], "cve": "CVE-2025-14388", "method": "GET", "mode": "block", "severity": 9.8, "slug": "phastpress", "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-1440-01": {"ajax_action": "aip_map_url_action", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?!https?://)~i"}], "cve": "CVE-2025-1440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1440", "description": "Advanced iFrame <=2024.5 unauthenticated URL mapping injection via aip_map_url_action - blocks non-HTTP(S) scheme URLs (javascript, data, ftp, etc.)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "advanced-iframe", "tags": ["improper-input-validation", "option-manipulation", "unauthenticated"], "target": "plugin", "versions": "<=2024.5"}, "RULE-CVE-2025-1441-01": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_no_results", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_no_results param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-02": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_number_of_words", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_number_of_words param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-03": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_view_result_text", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_view_result_text param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-04": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:wpr_ajax_search_link_target", "type": "detectXSS"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (wpr_ajax_search_link_target param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-1441-05": {"ajax_action": "wpr_filter_woo_products", "conditions": [{"name": "ARGS:grid_settings", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-1441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1441", "description": "Royal Elementor Addons <=1.7.1007 CSRF to Reflected XSS via wpr_filter_woo_products AJAX handler (grid_settings JSON param)", "mode": "block", "severity": 8.8, "slug": "royal-elementor-addons", "tags": ["csrf", "xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1007"}, "RULE-CVE-2025-14437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-action=download~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wphb-log-module=~i"}], "cve": "CVE-2025-14437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14437", "description": "Hummingbird Performance <=3.18.0 unauthenticated log file download via Logger::process_actions wphb-log-action parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hummingbird-performance", "tags": ["information-disclosure", "sensitive-data-exposure", "unauthenticated", "log-file-download"], "target": "plugin", "versions": "<=3.18.0"}, "RULE-CVE-2025-14440-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "jay_login_register_switch_back"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14440", "method": "GET", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.4.01"}, "RULE-CVE-2025-14441-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popupkit/v1/subscribers(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14441", "description": "PopupKit (Starter Templates & Starter Blocks for Starter Sites) <=2.2.0 missing authorization on DELETE /popupkit/v1/subscribers REST endpoint allows authenticated subscriber+ arbitrary subscriber data deletion", "method": "DELETE", "mode": "block", "severity": 5.3, "slug": "popup-builder-block", "tags": ["missing-authorization", "broken-access-control", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14442-01": {"ajax_action": "ays_sccp_results_export_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_file AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14442-02": {"ajax_action": "ays_sccp_results_export_filter", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14442", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14442", "description": "Secure Copy Content Protection <=4.9.2 unauthenticated information disclosure via ays_sccp_results_export_filter AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "secure-copy-content-protection", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.9.2"}, "RULE-CVE-2025-14445-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "points_image"}, {"name": "ARGS", "type": "regex", "value": "~(?:PHNjcmlwdD|PGltZyBzcmM9eCBvbmVycm9y|PGltZyBzcmM9eCBvbm|b25sb2FkPQ|b25lcnJvcj|b25jbGljaz|b25tb3VzZW92ZXI9|amF2YXNjcmlwdDo|PHN2Zy|PGJvZHkgb25sb2Fk|PGRldGFpbHMgb3Blbg|PGlmcmFtZSBzcmNkb2M)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 stored XSS via pointdata custom field on points_image post type save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14445-02": {"ajax_action": "devvn_ihotspot_clone_point", "conditions": [{"type": "missing_capability", "value": "edit_posts"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2025-14445", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14445", "description": "Image Hotspot by DevVN <=1.2.9 missing authorization on devvn_ihotspot_clone_point AJAX handler allows authenticated users to clone hotspot posts", "method": "POST", "mode": "block", "severity": 6.4, "slug": "devvn-image-hotspot", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2025-14446-01": {"ajax_action": "easynotify_cp_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14446", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14446", "description": "Popup Builder (Easy Notify Lite) <=1.1.37 missing authorization on easynotify_cp_reset AJAX action allows authenticated Subscriber+ users to reset plugin settings", "mode": "block", "severity": 6.5, "slug": "easy-notify-lite", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.1.37"}, "RULE-CVE-2025-14448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)profile\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on profile.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)user-edit\\\\.php~"}, {"name": "ARGS:wpmem_dynamic_field", "type": "regex", "value": "~(?:<|&(?:#0*60|#x0*3c|lt);)[a-z/!].*?(?:>|&(?:#0*62|#x0*3e|gt);)|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|(?:<|&(?:#0*60|#x0*3c|lt);)script~i"}], "cve": "CVE-2025-14448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14448", "description": "WP-Members <=3.5.4.3 stored XSS via unsanitized multiselect/multicheckbox profile fields on user-edit.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.5.4.3"}, "RULE-CVE-2025-14452-01": {"action": "admin_init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "wpcr3_review"}, {"name": "ARGS:wpcr3_fname", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|focus|click|mouseover|mouseout|keydown|keyup|change|submit|blur|dblclick|input|resize)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14452", "description": "WP Customer Reviews <=3.7.5 reflected XSS via wpcr3_fname parameter on admin review list", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-customer-reviews", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.7.5"}, "RULE-CVE-2025-14453-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*style_css\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via style_css shortcode attribute breakout into event handlers", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14453-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*margin\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via margin shortcode attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14453-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*padding\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via padding shortcode attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14453-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[myg_album_gallery\\\\b[^\\\\]]*border_color\\\\s*=[^\\\\]]*(?:\\"|\')[^\\"\']*(?:on\\\\w+\\\\s*=|<script|</style|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14453", "description": "My Album Gallery <=1.0.4 Stored XSS via border_color shortcode attribute breakout", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14455-01": {"ajax_action": "delete_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on delete_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-02": {"ajax_action": "clone_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on clone_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-03": {"ajax_action": "update_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on update_gallery_configuration AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-04": {"ajax_action": "save_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on save_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-05": {"ajax_action": "delete_image", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on delete_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-06": {"ajax_action": "add_image", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on add_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-07": {"ajax_action": "add_new_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on add_new_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-08": {"ajax_action": "save_image", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on save_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-09": {"ajax_action": "sort_images", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on sort_images AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-10": {"ajax_action": "toggle_visibility", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on toggle_visibility AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-11": {"ajax_action": "assign_filters", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on assign_filters AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-12": {"ajax_action": "assign_group", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on assign_group AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-13": {"ajax_action": "save_video", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on save_video AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14455-14": {"ajax_action": "refresh_gallery", "conditions": [{"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2025-14455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14455", "description": "Final Tiles Grid Gallery <=3.6.7 missing authorization on refresh_gallery AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control", "gallery-management"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-14467-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:wpjobportalme", "type": "equals", "value": "job"}, {"name": "ARGS:description", "type": "regex", "value": "~<script[\\\\s/>]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14467-02": {"action": "init", "conditions": [{"name": "ARGS:wpjobportalme", "type": "equals", "value": "job"}, {"name": "ARGS:description", "type": "regex", "value": "~<script[\\\\s/>]~i"}], "cve": "CVE-2025-14467", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.3.9"}, "RULE-CVE-2025-14477-01": {"ajax_action": "ajaxUpdatePaginationLinks", "conditions": [{"name": "ARGS:filterText", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:SELECT|DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|/\\\\*[^*]*\\\\*/\\\\s*(?:UNION|SELECT|DROP|INSERT|UPDATE|DELETE))~i"}], "cve": "CVE-2025-14477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14477", "description": "404 Solution <=3.1.0 authenticated (Admin+) SQL injection via filterText parameter in ajaxUpdatePaginationLinks AJAX action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "404-solution", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-14506-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14506-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:convertforce/conversion"}, {"name": "ARGS:post_content", "type": "contains", "value": "\\"type\\":\\"slide_in\\""}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\"entrance_animation\\"\\\\s*:\\\\s*\\\\{[^}]*\\"name\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|\\\\\\\\\\"|\\\\s+on[a-z]+\\\\s*=)(?:\\\\\\\\.|[^\\"\\\\\\\\])*\\"~i"}], "cve": "CVE-2025-14506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14506", "description": "ConvertForce Popup Builder <=0.0.7 stored XSS via entrance_animation block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "convertforce-popup-builder", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.0.7"}, "RULE-CVE-2025-14508-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mediacommander/v1/import-csv(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14508", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14508", "description": "MediaCommander <=2.3.1 missing authorization on import-csv REST endpoint allows Author+ to delete all media folder data", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mediacommander", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-1453-01": {"ajax_action": "save-widget", "conditions": [{"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (AJAX save-widget path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-1453-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/widgets\\\\.php~"}, {"name": "ARGS:id_base", "type": "equals", "value": "category-posts"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1453", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1453", "description": "Category Posts Widget <=4.9.19 stored XSS via widget template field (classic widgets.php POST path)", "method": "POST", "mode": "block", "severity": 4.8, "slug": "category-posts", "tags": ["xss", "stored-xss", "widget"], "target": "plugin", "versions": "<=4.9.19"}, "RULE-CVE-2025-14533-01": {"ajax_action": "nopriv_endpoint/form/shortcode", "conditions": [{"type": "missing_capability", "value": "promote_users"}, {"name": "ARGS", "type": "regex", "value": "~^(?:administrator|super_admin)$~"}], "cve": "CVE-2025-14533", "method": "POST", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.1"}, "RULE-CVE-2025-14539-01": {"ajax_action": "shortcode_ajax", "conditions": [{"name": "ARGS:code", "type": "regex", "value": "~\\\\[[a-zA-Z_][^\\\\]]*\\\\]~"}], "cve": "CVE-2025-14539", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14539", "description": "Shortcode Ajax <=1.0 unauthenticated arbitrary shortcode execution via code parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcode-ajax", "tags": ["code-injection", "arbitrary-shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-14548-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:event_title", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on add action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_desc", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_desc on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-14548-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "calendar"}, {"name": "ARGS:action", "type": "equals", "value": "edit_save"}, {"name": "ARGS:event_title", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|focus|blur|toggle|mouseover|mouseenter)\\\\s*=|javascript\\\\s*:|<(?:svg|iframe|object|embed|form)[^>]*>~i"}], "cve": "CVE-2025-14548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14548", "description": "Calendar <=1.3.16 Stored XSS via event_title on edit_save action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calendar", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.16"}, "RULE-CVE-2025-1455-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget settings on Elementor REST save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-1455-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:_elementor_data", "type": "contains", "value": "wpr-woo-grid"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:popup_notification_animation|popup_notification_fade_out_in|popup_notification_animation_duration|element_open_links_in_new_tab)~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~(?:\\\\\\"|&quot;)(?:\\\\s)*(?:on[a-z]{3,20}\\\\s*=|>[^<]{0,200}<\\\\s*(?:script|svg|img|iframe)\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1455", "description": "Royal Elementor Addons <=1.7.1012 Stored XSS via Woo Grid widget in _elementor_data on classic editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.7.1012"}, "RULE-CVE-2025-14552-01": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-title", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-title in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14552-02": {"ajax_action": "mpp_update_gallery_details", "conditions": [{"name": "ARGS:mpp-gallery-description", "type": "regex", "value": "~<[a-zA-Z][^>]*(?:on\\\\w+\\\\s*=|javascript:|src\\\\s*=|href\\\\s*=)|<\\\\s*(?:script|svg|img|iframe|object|embed|link|style|body|marquee|details|math|video|audio|base)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14552", "description": "MediaPress <=1.6.1 Stored XSS via mpp-gallery-description in mpp_update_gallery_details AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mediapress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.6.1"}, "RULE-CVE-2025-14554-01": {"ajax_action": "orderform_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-z/!?]~i"}], "cve": "CVE-2025-14554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14554", "description": "Sell BTC - Cryptocurrency Selling Calculator <=1.5 unauthenticated stored XSS via orderform_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sell-btc-by-hayyatapps", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-14555-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpdevart_countdown\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14555", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14555", "description": "Countdown Timer - Widget Countdown <=2.7.7 Stored XSS via wpdevart_countdown shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-countdown", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.7"}, "RULE-CVE-2025-14555-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdevart_countdown\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14555", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14555", "description": "Countdown Timer - Widget Countdown <=2.7.7 Stored XSS via wpdevart_countdown shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "widget-countdown", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.7"}, "RULE-CVE-2025-1457-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~element_pack_wrapper_link~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:javascript)\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)~i"}], "cve": "CVE-2025-1457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1457", "description": "Element Pack Addons <=5.10.28 Stored DOM XSS via Wrapper Link javascript:/data: URI in Elementor widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.10.28"}, "RULE-CVE-2025-1457-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ep_countdown_redirect_link~"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"[\\\\s\\\\S]*?(?:javascript)\\\\s*:|(?:javascript)\\\\s*:[\\\\s\\\\S]*?\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"|\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"[\\\\s\\\\S]*?data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/)[\\\\s\\\\S]*?\\"endActionType\\"\\\\s*:\\\\s*\\"url\\"~i"}], "cve": "CVE-2025-1457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1457", "description": "Element Pack Addons <=5.10.28 Stored DOM XSS via Countdown redirect URL javascript:/data: URI in Elementor widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=5.10.28"}, "RULE-CVE-2025-1458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[\\\\s>]|[\'\\"]javascript\\\\s*:|on(?:error|load|click|mouseover|focus|mouse(?:over|out|enter|move))\\\\s*[=|]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1458", "description": "Element Pack Addons for Elementor <=5.10.29 Stored XSS via Elementor widget settings in post editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-addon"], "target": "plugin", "versions": "<=5.10.29"}, "RULE-CVE-2025-1459-01": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-02": {"ajax_action": "so_panels_builder_content_json", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in builder content JSON preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-1459-03": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS:panels_data", "type": "exists"}, {"name": "ARGS:panels_data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*\\\\bsrcdoc\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1459", "description": "Page Builder by SiteOrigin <=2.31.4 Stored XSS via Embedded Video widget in live editor preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "siteorigin-panels", "tags": ["xss", "stored-xss", "page-builder"], "target": "plugin", "versions": "<=2.31.4"}, "RULE-CVE-2025-14610-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"csv_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via csv_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14610-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"json_url\\"\\\\s*:\\\\s*\\"\\\\s*(?:(?:file|gopher|dict|ftp|ldap):|https?://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-14610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14610", "description": "TableMaster for Elementor <=1.3.6 SSRF via json_url parameter in Data Table widget settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "tablemaster-for-elementor", "tags": ["ssrf", "server-side-request-forgery", "elementor-widget"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-14627-01": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:localhost|127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|\\\\[f[cd])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - direct internal/private IP in url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "internal-network-access"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14627-02": {"ajax_action": "get_csv_url", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://bit\\\\.ly/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14627", "description": "WP Ultimate CSV Importer <=7.35 SSRF via get_csv_url AJAX action - bit.ly redirect bypass to internal endpoints", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ultimate-csv-importer", "tags": ["ssrf", "server-side-request-forgery", "redirect-bypass"], "target": "plugin", "versions": "<=7.35"}, "RULE-CVE-2025-14632-01": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~\\\\.html?(?:[\\"\'\\\\s,}]|$)~i"}], "cve": "CVE-2025-14632", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14632", "description": "Filr - Secure document library <=1.2.11 stored XSS via HTML file upload through chunked upload path (_chunkedd parameter)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "filr-protection", "tags": ["file-upload", "xss", "dangerous-file-type"], "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2025-14635-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "equals", "value": "/wp-admin/post.php"}, {"name": "ARGS:ha_page_custom_js", "type": "detectXSS"}], "cve": "CVE-2025-14635", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "target": "plugin", "versions": "<=3.20.3"}, "RULE-CVE-2025-14657-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v1/[^/]+/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14657", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "target": "plugin", "versions": "<=4.0.51"}, "RULE-CVE-2025-14718-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow creation REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow update REST endpoint", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow deletion REST endpoint", "method": "DELETE", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14718-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/publishpress-future/v1/workflows/\\\\d+/publish(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14718", "description": "PublishPress Future <=4.9.3 missing authorization on workflow publish REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "post-expirator", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.9.3"}, "RULE-CVE-2025-14720-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~refund~i"}, {"name": "ARGS", "type": "regex", "value": "~payment_id~i"}], "cve": "CVE-2025-14720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14720", "description": "Amelia Booking <=2.0 unauthenticated Square refund webhook forgery via missing signature verification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ameliabooking", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "webhook-forgery"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-14732-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:meta[_elementor_data]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14732", "description": "Elementor <=3.35.5 stored XSS via REST API meta _elementor_data field", "mode": "block", "severity": 6.4, "slug": "elementor", "tags": ["stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.35.5"}, "RULE-CVE-2025-14745-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|<svg[^>]*/?\\\\s*>|<img[^>]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized template parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-02": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:className", "type": "regex", "value": "~(?:[\\"\'][\\\\s>]|<[a-z]+[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized className parameter in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-14745-03": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:/^(?:source|sources|feeds|exclude|category|folders)$/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur|mouse\\\\w+|key\\\\w+|submit|change|input|drag\\\\w*|drop|scroll|resize|copy|paste|cut|select|end|start|invalid|toggle|pointer\\\\w*)\\\\s*=|javascript\\\\s*:|<svg[^>]*/?\\\\s*>|<img[^>]+src\\\\s*=\\\\s*[\'\\"]\\\\s*[xX]|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-14745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14745", "description": "WP RSS Aggregator <=5.0.10 reflected XSS via unsanitized source/sources/feeds/exclude/category/folders parameters in wpra.render.display AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2025-1475-01": {"ajax_action": "wpcom_login", "conditions": [{"name": "ARGS:user_phone", "type": "exists"}], "cve": "CVE-2025-1475", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wpcom-member", "target": "plugin", "versions": "<=1.7.5"}, "RULE-CVE-2025-14757-01": {"ajax_action": "complete_payment", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14757", "description": "Cost Calculator Builder <=3.6.9 missing authorization on complete_payment AJAX action allows unauthenticated order status manipulation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-14793-01": {"action": "init", "conditions": [{"name": "ARGS:dkpdfg", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14793", "description": "DK PDF <=2.3.0 authenticated (Author+) SSRF via PDF generation trigger (dkpdfg parameter)", "method": "GET", "mode": "block", "severity": 5.0, "slug": "dk-pdf", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-14796-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "attachment"}, {"name": "ARGS:post_title", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core post.php attachment edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14796-02": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[title]", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|iframe|details|marquee|object|embed|video|audio|body|input|form|link|meta|style|base|math|a\\\\b)[^>]*(?:\\\\bon\\\\w+\\\\s*=|javascript:|data:\\\\s*text/html)|<\\\\s*script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14796", "description": "My Album Gallery <=1.0.4 Stored XSS via image title in WordPress core save-attachment AJAX", "method": "POST", "mode": "block", "severity": 6.4, "slug": "my-album-gallery", "tags": ["xss", "stored-xss", "unpatched"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-14797-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:tag-name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term creation (tag-name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14797-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editedtag"}, {"name": "ARGS:name", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|details|body|video|audio|marquee|math|base|form|input|button|select|textarea|link|style|meta|applet)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|toggle|resize|scroll|drag|drop|abort|animat|begin|end|input|invalid|key|mouse|pointer|touch|transition|wheel)\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-14797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14797", "description": "Same Category Posts <=1.1.19 Stored XSS via taxonomy term edit (name) in widget title placeholder", "method": "POST", "mode": "block", "severity": 5.4, "slug": "same-category-posts", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.19"}, "RULE-CVE-2025-14799-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailin/v1/mailin_disconnect(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14799", "description": "Brevo (Mailin) <=3.3.0 unauthenticated authorization bypass via type juggling on mailin_disconnect REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "mailin", "tags": ["authorization-bypass", "type-juggling", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.3.0"}, "RULE-CVE-2025-14800-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/wpcf7r/v1/download-file(/|\\\\?|$)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)(wp-config\\\\.php|php\\\\.ini|\\\\.htaccess|\\\\.user\\\\.ini)(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(^|.*/)([^/]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx))(\\\\?.*)?$~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~(\\\\.\\\\./|\\\\.\\\\./|\\\\.\\\\.\\\\\\\\|%2e%2e%2f|%2e%2e/|/etc/passwd|/windows/win\\\\.ini)~i"}, {"name": "ARGS:file_key", "type": "regex", "value": "~^(https?|ftp)://[^\\\\s]+\\\\.(php[0-9]?|phtml|phar|pht|cgi|exe|sh|jsp|asp|aspx)(\\\\?.*)?$~i"}], "cve": "CVE-2025-14800", "method": "GET", "mode": "block", "severity": 8.1, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-14803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_update_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|&lt;|&#0*60;?|&#x0*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14803-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "nf_insert_record"}, {"name": "ARGS", "type": "regex", "value": "~(<|%3[cC]|&lt;|&#0*60;?|&#x0*3[cC];?)\\\\s*(script|img|svg|iframe|object|embed|body|input|details|marquee|div|style|link|base|form|video|audio|math|table|meta|select|textarea|button|isindex|keygen|source|template|noscript|a[\\\\s/>=])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14803", "description": "NEX-Forms <= 9.1.7 authenticated stored XSS via nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "missing-sanitization"], "target": "plugin", "versions": "<=9.1.7"}, "RULE-CVE-2025-14804-01": {"ajax_action": "wpfm_delete_file", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_delete_file AJAX action (IDOR, no ownership check)", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "arbitrary-file-deletion", "idor"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14804-02": {"ajax_action": "wpfm_save_file_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14804", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14804", "description": "Frontend File Manager <=23.4 authenticated arbitrary file deletion via wpfm_save_file_data path traversal in filename", "method": "POST", "mode": "block", "severity": 7.7, "slug": "nmedia-user-file-uploader", "tags": ["path-traversal", "arbitrary-file-deletion", "file-name-manipulation"], "target": "plugin", "versions": "<=23.4"}, "RULE-CVE-2025-14842-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\.(?:phar|svg)(?:\\\\s|$)~i"}], "cve": "CVE-2025-14842", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14842", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.2 \\u2013 best-effort block of .phar/.svg strings in POST/GET params on upload AJAX (NOTE: does not inspect multipart filenames in $_FILES; partial coverage only)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["dangerous-file-upload", "unauthenticated", "cwe-434", "partial-coverage"], "target": "plugin", "versions": "<=1.3.9.2"}, "RULE-CVE-2025-14844-01": {"ajax_action": "rcp_stripe_create_setup_intent_for_saved_card", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14844", "description": "Restrict Content <=3.2.16 unauthenticated Stripe SetupIntent client_secret leak via rcp_stripe_create_setup_intent_for_saved_card AJAX action (IDOR/Missing Auth)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authentication", "idor", "sensitive-data-exposure", "unauthenticated"], "target": "plugin", "versions": "<=3.2.16"}, "RULE-CVE-2025-14855-02": {"ajax_action": "validation_ajax_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|math|details|embed|object)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer[a-z]*)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-14855", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14855", "description": "SureForms <=2.2.0 unauthenticated stored XSS via validation AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "sureforms", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-14865-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*headline\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode headline attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14865-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:content_protector|passster)[^\\\\]]*acf\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z][^>]*\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<\\\\s*script|\\"\\\\s+\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-14865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14865", "description": "Passster \\u2013 Password Protect Pages and Content <=4.2.24 Stored XSS via content_protector/passster shortcode acf attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-protector", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.24"}, "RULE-CVE-2025-14867-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via path traversal in post_content shortcode source attribute", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[flashcard[^\\\\]]*source\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:\\\\.\\\\.[\\\\\\\\/]|/etc/|php://|file://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14867", "description": "Flashcard Plugin for WordPress <=0.9 authenticated (Contributor+) arbitrary file read via REST API post creation with path traversal in content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "flashcard", "tags": ["path-traversal", "arbitrary-file-read", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.9"}, "RULE-CVE-2025-14875-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "hblpay_return"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on wc-api callback", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-14875-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~hblpay-payment-gateway-for-woocommerce/return\\\\.php~"}, {"name": "ARGS:cusdata", "type": "regex", "value": "~<[a-z/!]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-14875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14875", "description": "HBLPAY Payment Gateway for WooCommerce <=5.0.0 reflected XSS via cusdata parameter on direct return.php access", "method": "GET", "mode": "block", "severity": 6.1, "slug": "hblpay-payment-gateway-for-woocommerce", "tags": ["xss", "reflected-xss", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2025-1489-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-1489-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[appbox\\\\b[^\\\\]]*(?:<[a-zA-Z]|\\\\bon\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-1489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1489", "description": "WP-Appbox <=4.5.4 Stored XSS via [appbox] shortcode attributes in post_content param (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-appbox", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.4"}, "RULE-CVE-2025-14891-01": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:displayName", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-14891", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14891", "description": "Customer Reviews for WooCommerce <=5.93.1 Stored XSS via displayName in cr_local_forms_submit AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.93.1"}, "RULE-CVE-2025-14893-01": {"action": "init", "conditions": [{"name": "ARGS:tel", "type": "regex", "value": "~<[a-zA-Z/!]~"}], "cve": "CVE-2025-14893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14893", "description": "IndieWeb <=4.0.5 Stored XSS via Telephone profile field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "indieweb", "tags": ["xss", "stored-xss", "user-profile"], "target": "plugin", "versions": "<=4.0.5"}, "RULE-CVE-2025-1490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "smart-maintenance-mode"}, {"name": "ARGS:setstatus", "type": "detectXSS"}], "cve": "CVE-2025-1490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1490", "description": "Smart Maintenance Mode <=1.5.2 reflected XSS via setstatus parameter on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "smart-maintenance-mode", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-14948-01": {"ajax_action": "mo_wc_notification_enable", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:notification", "type": "exists"}], "cve": "CVE-2025-14948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14948", "description": "OTP Verification & SMS Notification <=4.3.8 missing authorization on mo_wc_notification_enable AJAX action allows unauthenticated notification settings toggle", "method": "POST", "mode": "block", "severity": 5.3, "slug": "miniorange-sms-order-notification-otp-verification", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2025-14973-01": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[0][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[0][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-02": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[1][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[1][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14973-03": {"ajax_action": "wpzoom_import_recipes", "conditions": [{"name": "ARGS:recipes[2][recipe_id]", "type": "detectSQLi"}], "cve": "CVE-2025-14973", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14973", "description": "Recipe Card Blocks by WPZOOM <=3.4.12 authenticated SQL injection via recipes[2][recipe_id] in wpzoom_import_recipes AJAX handler", "method": "POST", "mode": "block", "severity": 6.8, "slug": "recipe-card-blocks-by-wpzoom", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.4.12"}, "RULE-CVE-2025-14975-02": {"action": "wp_loaded", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rp"}, {"name": "ARGS:pass1", "type": "exists"}, {"name": "ARGS:rp_key", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-14975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14975", "description": "Login Customizer <=2.5.3 unauthenticated arbitrary password reset via rp action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "login-customizer", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "password-reset"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2025-14976-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^user-registration~"}, {"name": "ARGS:action", "type": "equals", "value": "delete"}, {"name": "ARGS:post", "type": "regex", "value": "~^\\\\d+$~"}], "cve": "CVE-2025-14976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14976", "description": "User Registration & Membership <=4.4.8 CSRF to arbitrary post deletion via process_row_actions delete action", "method": "GET", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["csrf", "arbitrary-post-deletion", "missing-nonce"], "target": "plugin", "versions": "<=4.4.8"}, "RULE-CVE-2025-14977-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to read other vendors\' store settings", "method": "GET", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14977-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/dokan/v1/settings(?:/|\\\\?|&|$)~"}, {"name": "ARGS:store_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14977", "description": "Dokan Lite <=4.2.4 IDOR via REST API dokan/v1/settings allows authenticated users to modify other vendors\' store settings including payment info", "method": "POST", "mode": "block", "severity": 8.1, "slug": "dokan-lite", "tags": ["idor", "broken-access-control", "rest-api", "account-takeover"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-14983-01": {"ajax_action": "ACFFA_delete_icon_set", "conditions": [{"name": "ARGS:icon_set_name", "type": "regex", "value": "~<[^>]*(?:script|img|svg|iframe|object|embed|link|style|form|input|body|meta|marquee|details|math|isindex|base|area)|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseenter|mouseleave|mouseout|mousemove|dblclick|contextmenu|wheel|pointerover|animationend|toggle|resize|beforeunload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}], "cve": "CVE-2025-14983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14983", "description": "Advanced Custom Fields: Font Awesome <=5.0.1 Stored XSS via ACFFA_delete_icon_set icon_set_name parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-custom-fields-font-awesome", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2025-14985-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~</style\\\\s*>~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14985-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~</style\\\\s*>~i"}], "cve": "CVE-2025-14985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14985", "description": "Alpha Blocks <=1.5.0 Authenticated (Contributor+) Stored XSS via alpha_block_css post meta on REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "alpha-blocks", "tags": ["xss", "stored-xss", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-14997-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/members/.+/profile/edit/)~"}, {"name": "ARGS:/^field_\\\\d+$/", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 path traversal payload injection via xprofile field value during BuddyPress profile save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14997-02": {"ajax_action": "bpxcftr_remove_user_tag", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-14997", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-14997", "description": "BuddyPress Xprofile Custom Field Types <=1.2.8 missing authorization on bpxcftr_remove_user_tag AJAX action (defense-in-depth)", "method": "POST", "mode": "block", "severity": 7.2, "slug": "bp-xprofile-custom-field-types", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-14998-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:rp|resetpass)$~i"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-14998-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-activate\\\\.php~"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2025-14998", "method": "POST", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<3.4.29"}, "RULE-CVE-2025-15019-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:bialty_cs_alt", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|input|change|submit|keyup|keydown)\\\\s*=)~i"}], "cve": "CVE-2025-15019", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15019", "description": "BIALTY - Bulk Image Alt Text with Yoast SEO + WooCommerce <=2.2.1 authenticated stored XSS via bialty_cs_alt post meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bulk-image-alt-text-with-yoast", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15027-01": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_capabilities", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15027-02": {"ajax_action": "jay_login_register_ajax_create_final_user", "conditions": [{"name": "ARGS:meta_wp_user_level", "type": "exists"}], "cve": "CVE-2025-15027", "method": "POST", "mode": "block", "severity": 9.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1503-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][name]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe Name field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-02": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][link]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe link field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][credit]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe credit field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-04": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][button]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe button field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-1503-05": {"action": "admin_init", "conditions": [{"name": "ARGS:wprm_roundup_items[0][data][image_url]", "type": "detectXSS"}], "cve": "CVE-2025-1503", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1503", "description": "WP Recipe Maker <=9.8.0 Stored XSS via Roundup Recipe image_url field (Contributor+)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-recipe-maker", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=9.8.0"}, "RULE-CVE-2025-15030-01": {"action": "init", "conditions": [{"name": "ARGS:passw1", "type": "exists"}, {"name": "ARGS:passw2", "type": "exists"}, {"name": "ARGS:loginName", "type": "exists"}, {"name": "ARGS:key", "type": "exists"}, {"name": "ARGS:finalAction", "type": "equals", "value": "yes"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15030", "description": "Profile Builder <=3.15.1 unauthenticated account takeover via password reset bypass", "method": "POST", "mode": "block", "severity": 9.8, "slug": "profile-builder", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=3.15.1"}, "RULE-CVE-2025-15041-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/save_site_option(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15041", "method": "POST", "mode": "block", "severity": 7.2, "slug": "backwpup", "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2025-15057-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15057", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15057", "description": "SlimStat Analytics <=5.3.3 unauthenticated stored XSS via fh parameter in slimtrack AJAX handler", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.3.3"}, "RULE-CVE-2025-15058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "pricing_table"}, {"name": "ARGS:table_currency", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2025-15058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15058", "description": "Responsive Pricing Table <=5.1.12 authenticated (Contributor+) Stored XSS via table_currency parameter in pricing_table CPT", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dk-pricr-responsive-pricing-table", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=5.1.12"}, "RULE-CVE-2025-1507-01": {"action": "init", "conditions": [{"name": "ARGS:ga_action", "type": "regex", "value": "~^ga_action_(auth|sharethis_invite|update_terms|enable_all_features|disable_all_features)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1507", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1507", "description": "ShareThis Dashboard for Google Analytics <=3.2.1 missing authorization on handle_actions() allows unauthenticated feature deactivation", "mode": "block", "severity": 5.3, "slug": "googleanalytics", "tags": ["missing-authorization", "unauthenticated", "feature-deactivation"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-15100-01": {"ajax_action": "jay_login_register_create_final_user", "conditions": [{"name": "ARGS:/(?i)^meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-15100-03": {"ajax_action": "jay_panel_update_profile", "conditions": [{"name": "ARGS:/(?i)^jay_panel_meta_(wp_.*|session_tokens.*)/", "type": "exists"}], "cve": "CVE-2025-15100", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jay-login-register", "target": "plugin", "versions": "<=2.6.03"}, "RULE-CVE-2025-1511-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ur-member~"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-1511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1511", "description": "User Registration & Membership <=4.0.4 Reflected XSS via search parameter on membership admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.0.4"}, "RULE-CVE-2025-1513-01": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Name", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Name field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-1513-02": {"ajax_action": "post_cg_set_comment_v10", "conditions": [{"name": "ARGS:Comment", "type": "detectXSS"}], "cve": "CVE-2025-1513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1513", "description": "Contest Gallery <=26.0.0.1 unauthenticated stored XSS via Comment field in comment submission", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=26.0.0.1"}, "RULE-CVE-2025-15260-01": {"ajax_action": "lws_adminpanel_editlist", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15260", "description": "MyRewards \\u2013 Loyalty Points and Rewards for WooCommerce <=5.6.0 missing authorization on lws_adminpanel_editlist allowing subscriber+ to modify loyalty rules", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woorewards", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2025-15266-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_frontendajax chat message", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-15266-02": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-15266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15266", "description": "GeekyBot <=1.1.8 unauthenticated stored XSS via geekybot_ajax chat handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "geeky-bot", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-1527-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Gutenberg REST API post update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "rest-api"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-1527-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:save_builder|elementor_ajax)$~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1527", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1527", "description": "ShopLentor (WooLentor) <=3.1.0 Stored DOM-Based XSS via Flash Sale Countdown widget attributes in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "woolentor-addons", "tags": ["xss", "stored-xss", "dom-based-xss", "elementor"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-15283-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "exists"}, {"name": "ARGS:name_directory_name", "type": "regex", "value": "~(?:<|&lt;?|&#0*60;?|&#x0*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|&gt;?|&#0*62;?|&#x0*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|&#0*106;?avascript\\\\s*:|&#x0*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_name parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "exists"}, {"name": "ARGS:name_directory_description", "type": "regex", "value": "~(?:<|&lt;?|&#0*60;?|&#x0*3[cC];?)(?:script|svg|iframe|body|marquee|object|embed|math)(?:[\\\\s/>]|&gt;?|&#0*62;?|&#x0*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|&#0*106;?avascript\\\\s*:|&#x0*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_description parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15283-03": {"action": "init", "conditions": [{"name": "ARGS:name_directory_submitter", "type": "exists"}, {"name": "ARGS:name_directory_submitter", "type": "regex", "value": "~(?:<|&lt;?|&#0*60;?|&#x0*3[cC];?)(?:script|svg|iframe|img|body|marquee|object|embed|video|audio|details|math)(?:[\\\\s/>]|&gt;?|&#0*62;?|&#x0*3[eE];?)|\\\\bon(?:error|load|click|mouse\\\\w+|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:|&#0*106;?avascript\\\\s*:|&#x0*6[aA];?avascript\\\\s*:~i"}], "cve": "CVE-2025-15283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15283", "description": "Name Directory <=1.30.3 unauthenticated stored XSS via name_directory_submitter parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.30.3"}, "RULE-CVE-2025-15285-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post modification via REST API", "method": "PUT", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/blog(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated blog post deletion via REST API", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-deletion"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15285-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lupsonlinelinknetwerk/category(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_categories"}], "cve": "CVE-2025-15285", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15285", "description": "SEO Flow by LupsOnline <=2.2.1 unauthenticated category creation via REST API", "method": "POST", "mode": "block", "severity": 7.5, "slug": "lupsonline-link-netwerk", "tags": ["missing-authorization", "unauthenticated", "rest-api", "content-modification"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-15347-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/settings(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-15347", "method": "POST", "mode": "block", "severity": 8.8, "slug": "creatorlms", "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2025-15368-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15368-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~template\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:php|data|expect|phar|zip|glob|file)://|[\\\\\\\\/]etc[\\\\\\\\/])~i"}], "cve": "CVE-2025-15368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15368", "description": "SportsPress <=2.7.26 authenticated local file inclusion via shortcode template attribute in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sportspress", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.26"}, "RULE-CVE-2025-15386-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<a\\\\s[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with inline event handler in anchor tag", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<a\\\\s[^>]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via comment with javascript URI in anchor href", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<a\\\\s[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with inline event handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15386-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/comments(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<a\\\\s[^>]*href\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:~i"}], "cve": "CVE-2025-15386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15386", "description": "Responsive Lightbox & Gallery <=2.6.0 unauthenticated stored XSS via REST API comment with javascript URI", "method": "POST", "mode": "block", "severity": 8.8, "slug": "responsive-lightbox", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.6.0"}, "RULE-CVE-2025-15396-01": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-error-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-error-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15396-02": {"action": "init", "conditions": [{"name": "ARGS:library-viewer-success-message", "type": "detectXSS"}], "cve": "CVE-2025-15396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15396", "description": "Library Viewer <3.2.0 reflected XSS via library-viewer-success-message GET parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "library-viewer", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<3.2.0"}, "RULE-CVE-2025-15403-01": {"ajax_action": "rm_user_exists", "conditions": [{"name": "ARGS:admin_order", "type": "exists"}], "cve": "CVE-2025-15403", "method": "POST", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2025-15466-01": {"ajax_action": "delete_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-02": {"ajax_action": "clone_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on clone_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-03": {"ajax_action": "add_new_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_new_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-04": {"ajax_action": "save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-05": {"ajax_action": "get_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-06": {"ajax_action": "get_image_size_url", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on get_image_size_url AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-07": {"ajax_action": "delete_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on delete_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-08": {"ajax_action": "save_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-09": {"ajax_action": "add_image", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on add_image AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-10": {"ajax_action": "sort_images", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on sort_images AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-11": {"ajax_action": "assign_filters", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_filters AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-12": {"ajax_action": "toggle_visibility", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on toggle_visibility AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-13": {"ajax_action": "assign_group", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on assign_group AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-14": {"ajax_action": "update_gallery_configuration", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on update_gallery_configuration AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-15": {"ajax_action": "refresh_gallery", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on refresh_gallery AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15466-16": {"ajax_action": "save_video", "conditions": [{"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-15466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15466", "description": "Final Tiles Grid Gallery <=3.6.9 missing authorization on save_video AJAX action", "mode": "block", "severity": 5.4, "slug": "final-tiles-grid-gallery-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.9"}, "RULE-CVE-2025-15477-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-post\\\\.php)~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15477-02": {"action": "rest_api_init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[bucketlister\\\\b[^\\\\]]*(?:category|id)\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]+)(?:(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|EXEC|DECLARE|CAST|CONVERT|WAITFOR|BENCHMARK|SLEEP|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE)\\\\b|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d|--\\\\s|/\\\\*|#\\\\s|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\b)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}], "cve": "CVE-2025-15477", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15477", "description": "The Bucketlister <=0.1.5 SQL injection via shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-bucketlister", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=0.1.5"}, "RULE-CVE-2025-15521-01": {"ajax_action": "academy/shortcode/password_reset_handler", "cve": "CVE-2025-15521", "method": "POST", "mode": "block", "severity": 9.8, "slug": "academy", "target": "plugin", "versions": "<=3.5.0"}, "RULE-CVE-2025-15522-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (post save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-15522-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[automator_discord_user_mapping\\\\b[^\\\\]]*verified_message\\\\s*=\\\\s*[^\\\\]]*<[^>]+[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-15522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-15522", "description": "Uncanny Automator <=6.10.0.2 Stored XSS via automator_discord_user_mapping shortcode verified_message attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "uncanny-automator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.10.0.2"}, "RULE-CVE-2025-1560-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wee [^]]*(?:on[a-zA-Z]+=|javascript:|<script)~i"}], "cve": "CVE-2025-1560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1560", "description": "WOW Entrance Effects (WEE) <=0.1 Stored XSS via [wee] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-entrance-effects-wee", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-1560-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]wee [^]]*(?:on[a-zA-Z]+=|javascript:|<script)~i"}], "cve": "CVE-2025-1560", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1560", "description": "WOW Entrance Effects (WEE) <=0.1 Stored XSS via [wee] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wow-entrance-effects-wee", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-1561-01": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:title", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via title parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-02": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:var", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via var parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-03": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:file", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via file parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-04": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:function", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via function parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1561-05": {"ajax_action": "appp_log", "conditions": [{"name": "ARGS:line", "type": "detectXSS"}], "cve": "CVE-2025-1561", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1561", "description": "AppPresser \\u2013 Mobile App Framework <=4.4.10 unauthenticated stored XSS via line parameter in appp_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "apppresser", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.4.10"}, "RULE-CVE-2025-1562-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/funnelkit-automations/v[0-9]+/plugin/install_and_activate~"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-1562", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2025-1571-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|save_builder)$~"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:exad_animated_text|exad_image_comparison|image.comparison)~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?i)(?:<\\\\s*script\\\\b|on(?:error|load)\\\\s*=|javascript:|<\\\\s*svg\\\\b)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1571", "description": "Exclusive Addons for Elementor <=2.7.6 authenticated (Contributor+) Stored XSS via Animated Text and Image Comparison widget settings", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2025-1572-01": {"ajax_action": "ajax_get", "conditions": [{"name": "ARGS:u_id", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-1572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1572", "description": "KiviCare \\u2013 Clinic & Patient Management System (EHR) <=3.6.7 authenticated SQL injection via u_id parameter in ajax_get AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-1572-02": {"ajax_action": "ajax_post", "conditions": [{"name": "ARGS:u_id", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-1572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1572", "description": "KiviCare \\u2013 Clinic & Patient Management System (EHR) <=3.6.7 authenticated SQL injection via u_id parameter in ajax_post AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.6.7"}, "RULE-CVE-2025-1620-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "floating-button"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|</\\\\s*style\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via floating-button settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "branding"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|</\\\\s*style\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via branding settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1620-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "moove-gdpr"}, {"name": "ARGS:tab", "type": "equals", "value": "banner-settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|object|embed|math)\\\\b|\\\\bon(?:mouse\\\\w+|load|error|focus|blur|click|dblclick|key\\\\w+|change|submit|reset|select|abort|resize)\\\\s*=|javascript\\\\s*:|</\\\\s*style\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2025-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1620", "description": "GDPR Cookie Compliance <=4.15.6 stored XSS via banner-settings tab", "method": "POST", "mode": "block", "severity": 4.8, "slug": "gdpr-cookie-compliance", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.15.6"}, "RULE-CVE-2025-1625-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:<script[\\\\s>]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1625-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:qi-blocks/counter\\\\s*\\\\{[^}]*(?:<script[\\\\s>]|\\\\bon(?:error|load|mouseover|focus|click)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1625", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1625", "description": "Qi Blocks <1.4 stored XSS via Counter block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<1.4"}, "RULE-CVE-2025-1626-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in REST API post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Countdown block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1626-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:qi-blocks/counter"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|focus|mouseover|click|animationend|transitionend)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1626", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1626", "description": "Qi Blocks <=1.3.6 Stored XSS via Counter block options in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "qi-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-1662-01": {"ajax_action": "url_media_uploader_url_upload", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:^https?://(?:localhost|\\\\[?::1\\\\]?|0(?:\\\\.0){0,3}|127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0x[0-9a-f]{8}|[0-9]{8,10})(?:[:/]|$))~i"}], "cve": "CVE-2025-1662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1662", "description": "URL Media Uploader <=1.0.0 authenticated SSRF via url parameter in url_media_uploader_url_upload AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "url-media-uploader", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2025-1664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post create)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (REST API post update)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1664-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/parallax-slider"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}], "cve": "CVE-2025-1664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1664", "description": "Essential Blocks <=5.3.1 Stored XSS via javascript: protocol in Parallax Slider block link attribute (classic editor post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "classic-editor"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-1702-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~\'\\\\s*(?:OR|AND|UNION)\\\\s|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|--\\\\s*$|/\\\\*~i"}], "cve": "CVE-2025-1702", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1702", "description": "Ultimate Member <=2.10.0 unauthenticated SQL injection via search parameter in member directory AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ultimate-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.10.0"}, "RULE-CVE-2025-1703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s>/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1703-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:<script[\\\\s>/]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1703", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1703", "description": "Ultimate Blocks <=3.2.7 Stored XSS via content parameter in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-blocks", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-1717-01": {"action": "init", "conditions": [{"name": "ARGS:lmn", "type": "exists"}], "cve": "CVE-2025-1717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1717", "description": "Login Me Now <=1.7.2 unauthenticated authentication bypass via transient-based auto-login (lmn parameter)", "method": "GET", "mode": "block", "severity": 8.1, "slug": "login-me-now", "tags": ["authentication-bypass", "unauthenticated", "missing-authentication"], "target": "plugin", "versions": "<=1.7.2"}, "RULE-CVE-2025-1730-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~(?:(?:\\\\\\\\.\\\\\\\\.[\\\\\\\\\\\\/]){2,}|^/etc/|wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) arbitrary file read via sdc_download post creation with malicious sdc_download_path", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "missing-authorization", "path-traversal"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-02": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "regex", "value": "~^(?:file://|php://|expect://|data://|glob://|phar://|ssh2://|ogg://|zlib://|rar://|zip://|ftp://|dict://|gopher://|ldap://|telnet://|smtp://|imap://|pop3://|http://(?:127\\\\.|0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|localhost|\\\\[::1\\\\]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) SSRF/arbitrary file read via sdc_download post creation with malicious remote URL", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["arbitrary-file-read", "ssrf", "missing-authorization"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1730-03": {"action": "save_post", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "sdc_download"}, {"name": "ARGS:sdc_download_path", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1730", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1730", "description": "Simple Download Counter <=2.0 authenticated (Author+) capability bypass - non-admin creating sdc_download posts", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-counter", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2025-1766-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1766-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/eventin/v2/payment(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-1766", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1766", "description": "Eventin <=4.0.24 unauthenticated payment status update via REST API /eventin/v2/payment endpoint (PATCH method)", "method": "PATCH", "mode": "block", "severity": 5.3, "slug": "wp-event-solution", "tags": ["missing-authorization", "unauthenticated", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=4.0.24"}, "RULE-CVE-2025-1768-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^sq_(ajax_)?(assistant|audits|bulkseo|focuspages|onboarding|post|saveseo)$~i"}, {"name": "ARGS:skeyword", "type": "regex", "value": "~\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+UNION(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(?:ALL(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+)?SELECT|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*[\\\\d(]|\'\\\\s*;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(AND|OR)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))+(IF|SLEEP|EXTRACTVALUE|BENCHMARK)(?:[\\\\s]|(?:/\\\\*.*?\\\\*/))*\\\\(~i"}], "cve": "CVE-2025-1768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1768", "description": "Squirrly SEO <=12.4.05 authenticated blind SQL injection via skeyword parameter in AJAX search handlers", "method": "POST", "mode": "block", "severity": 6.5, "slug": "squirrly-seo", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=12.4.05"}, "RULE-CVE-2025-1783-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-02": {"action": "admin_init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1783-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gallery"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-1783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1783", "description": "Gallery Styles <=1.3.4 Stored Cross-Site Scripting via Gallery Block attributes through REST API post partial update (PATCH)", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "gallery-styles", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2025-1784-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:uagb/[a-z0-9-]+\\\\s+\\\\{[^}]*\\"block_id\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*(?:\\\\\\\\.[^\\"\\\\\\\\]*)*\\"[^}]*\\\\}\\\\s*-->[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (post.php entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1784-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<!--\\\\s*wp:uagb/[a-z0-9-]+\\\\s+\\\\{[^}]*\\"block_id\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]*(?:\\\\\\\\.[^\\"\\\\\\\\]*)*\\"[^}]*\\\\}\\\\s*-->[\\\\s\\\\S]{0,2000}(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-1784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1784", "description": "Spectra (Ultimate Addons for Gutenberg) <=2.19.0 Stored XSS via uagb block_id attribute in post content (REST API entrypoint)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ultimate-addons-for-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=2.19.0"}, "RULE-CVE-2025-1785-01": {"ajax_action": "wpdm_newfile", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.\\\\.[\\\\\\\\/]~"}], "cve": "CVE-2025-1785", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1785", "description": "Download Manager <=3.3.08 authenticated (Author+) path traversal via wpdm_newfile AJAX action allowing limited file overwrite", "method": "POST", "mode": "block", "severity": 8.1, "slug": "download-manager", "tags": ["path-traversal", "file-overwrite", "authenticated"], "target": "plugin", "versions": "<=3.3.08"}, "RULE-CVE-2025-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-login\\\\.php(?:$|[/?])~i"}, {"name": "ARGS:bb_social_login", "type": "equals", "value": "apple"}], "cve": "CVE-2025-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1909", "description": "BuddyBoss Platform Pro <=2.7.01 Apple OAuth authentication bypass (CWE-288) \\u2014 web flow wp-login.php?bb_social_login=apple", "method": "POST", "mode": "block", "severity": 9.8, "slug": "buddyboss-platform-pro", "target": "plugin", "versions": "<=2.7.01"}, "RULE-CVE-2025-1912-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wt_iew_export_download", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via export download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-02": {"action": "admin_init", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}, {"name": "ARGS:page", "type": "regex", "value": "~^wt-iew-(?:history|export)$~"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via history/export page download_file admin_init handler", "method": "GET", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1912-03": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:file_url", "type": "regex", "value": "~(?:https?|ftp|file|gopher|dict)\\\\s*:~i"}], "cve": "CVE-2025-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1912", "description": "Product Import Export for WooCommerce <=2.5.0 SSRF via iew_import_ajax_basic validate_file", "method": "POST", "mode": "block", "severity": 7.6, "slug": "product-import-export-for-woo", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2025-1971-01": {"ajax_action": "iew_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in export AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-1971-02": {"ajax_action": "iew_import_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-1971", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-1971", "description": "Export and Import Users and Customers <=2.6.2 PHP Object Injection via form_data in import AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "users-customers-import-export-for-wp-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.6.2"}, "RULE-CVE-2025-2004-01": {"ajax_action": "wpe_delete_file", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2e%2e[%2f/\\\\\\\\]|%252e%252e%252f)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2004", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2004", "description": "Simple WP Events <=1.8.17 unauthenticated arbitrary file deletion via wpe_delete_file AJAX action", "method": "POST", "mode": "block", "severity": 9.1, "slug": "simple-wp-events", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.8.17"}, "RULE-CVE-2025-2009-01": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber name field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2009-02": {"ajax_action": "wpmlsubscribe", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|input|details|math|isindex|marquee|meta|link|base|style)\\\\s[^>]*\\\\bon[a-z]+\\\\s*=)~i"}], "cve": "CVE-2025-2009", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2009", "description": "Newsletters <=4.9.9.7 unauthenticated stored XSS via subscriber email field in wpmlsubscribe AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "newsletters-lite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.9.9.7"}, "RULE-CVE-2025-2025-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:view", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2025-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "give-reports"}, {"name": "ARGS:tab", "type": "equals", "value": "earnings"}, {"type": "missing_capability", "value": "view_give_reports"}], "cve": "CVE-2025-2025", "method": "GET", "mode": "block", "severity": 7.5, "slug": "give", "target": "plugin", "versions": "<=3.22.0"}, "RULE-CVE-2025-2055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mappress_maps"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*\\\\bon[a-zA-Z]+=|<script[\\\\s/>]|<iframe[\\\\s/>]|javascript\\\\s*:|<svg[\\\\s/][^>]*\\\\bon[a-zA-Z]+=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2055", "description": "MapPress Maps for WordPress <=2.94.8 authenticated (Contributor+) stored XSS via map marker fields on admin page", "method": "POST", "mode": "block", "severity": 6.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.94.8"}, "RULE-CVE-2025-2056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via REQUEST_URI in showFile (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-03": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)){2,}~"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url parameter (multi-level traversal)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2056-04": {"action": "init", "conditions": [{"name": "ARGS:hmwp_url", "type": "regex", "value": "~\\\\.\\\\.(?:[\\\\\\\\/]|%2f|%2F)~"}, {"name": "ARGS:hmwp_url", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2056", "description": "Hide My WP Ghost <=5.4.01 unauthenticated path traversal via hmwp_url targeting sensitive files", "method": "GET", "mode": "block", "severity": 7.5, "slug": "hide-my-wp", "tags": ["path-traversal", "unauthenticated", "file-read"], "target": "plugin", "versions": "<=5.4.01"}, "RULE-CVE-2025-2083-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2083-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~awesome-logo-carousel-block[/\\\\\\\\]slider[\\\\s\\\\S]*?\\"sliderId\\"\\\\s*:\\\\s*\\"[^\\"]*[^a-zA-Z0-9_\\\\-.\\\\\\"](?=[\\\\s\\\\S]*?/-->)~i"}], "cve": "CVE-2025-2083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2083", "description": "Logo Carousel Gutenberg Block <=2.1.6 Stored XSS via sliderId block attribute in wp-admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "awesome-logo-carousel-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-2109-01": {"action": "init", "conditions": [{"name": "ARGS:css", "type": "regex", "value": "~^(?:https?://|//|ftp://|file://|php://|phar://|data://|expect://|glob://)~i"}], "cve": "CVE-2025-2109", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2109", "description": "WP Compress <=6.30.15 unauthenticated SSRF via css query parameter in init hook", "mode": "block", "severity": 5.8, "slug": "wp-compress-image-optimizer", "tags": ["ssrf", "unauthenticated", "file-get-contents"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-01": {"ajax_action": "wps_ic_saveSetting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_saveSetting AJAX handler allows Subscriber+ to modify plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-02": {"ajax_action": "wps_ic_get_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_get_setting AJAX handler allows Subscriber+ to read plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-03": {"ajax_action": "wps_ic_settings_change", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_settings_change AJAX handler allows Subscriber+ to alter plugin settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-04": {"ajax_action": "wpc_ic_checkCFConnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFConnect AJAX handler allows Subscriber+ to overwrite Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-05": {"ajax_action": "wpc_ic_checkCFDisconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_checkCFDisconnect AJAX handler allows Subscriber+ to delete Cloudflare config", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-06": {"ajax_action": "wpc_ic_set_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_set_mode AJAX handler allows Subscriber+ to change plugin operation mode", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-07": {"ajax_action": "wps_ic_purge_cdn", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_cdn AJAX handler allows Subscriber+ to purge CDN cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-08": {"ajax_action": "wps_ic_purge_html", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_purge_html AJAX handler allows Subscriber+ to purge HTML cache", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-09": {"ajax_action": "wpc_ic_start_bulk_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_restore AJAX handler allows Subscriber+ to trigger bulk image restore", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-10": {"ajax_action": "wpc_ic_start_bulk_compress", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wpc_ic_start_bulk_compress AJAX handler allows Subscriber+ to trigger bulk image compression", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-11": {"ajax_action": "wps_ic_save_excludes_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_save_excludes_settings AJAX handler allows Subscriber+ to modify exclude settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-12": {"ajax_action": "wps_lite_connect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_lite_connect AJAX handler allows Subscriber+ to connect plugin to external API", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-13": {"ajax_action": "wps_ic_cname_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_cname_add AJAX handler allows Subscriber+ to add CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-14": {"ajax_action": "wps_ic_remove_cname", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_cname AJAX handler allows Subscriber+ to remove CNAME records", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2110-15": {"ajax_action": "wps_ic_remove_key", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2110", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2110", "description": "WP Compress <=6.30.15 missing authorization on wps_ic_remove_key AJAX handler allows Subscriber+ to remove plugin API key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-compress-image-optimizer", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.30.15"}, "RULE-CVE-2025-2111-02": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"name": "ARGS:page", "type": "equals", "value": "wpb-debug"}], "cve": "CVE-2025-2111", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2111", "description": "WP Headers And Footers <=3.1.1 CSRF to arbitrary options update via debug page POST request (set_option_name/option_value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-headers-and-footers", "tags": ["csrf", "arbitrary-option-update", "privilege-escalation"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-2128-01": {"ajax_action": "ccb_update_order", "conditions": [{"name": "ARGS:order_ids", "type": "regex", "value": "~[^0-9,]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2128", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2128", "description": "Cost Calculator Builder <=3.2.67 authenticated SQL injection via order_ids parameter in Payments::update_payment_status_by_order_ids", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cost-calculator-builder", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=3.2.67"}, "RULE-CVE-2025-2162-01": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized width setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "settings-injection"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2162-02": {"ajax_action": "mapp_options_save", "conditions": [{"name": "ARGS:base_font_size", "type": "regex", "value": "~<[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2162", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2162", "description": "MapPress Maps for WordPress <=2.94.9 stored XSS via unsanitized base_font_size setting in mapp_options_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mappress-google-maps-for-wordpress", "tags": ["xss", "stored-xss", "style-breakout"], "target": "plugin", "versions": "<=2.94.9"}, "RULE-CVE-2025-2164-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:sortby", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via sortby parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via post_id parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:pixelstats_page", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via pixelstats_page parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2164-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "pixelstats"}, {"name": "ARGS:last_day", "type": "detectXSS"}], "cve": "CVE-2025-2164", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2164", "description": "Pixelstats <=0.8.2 reflected XSS via last_day parameter in admin stats page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "pixelstats", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.8.2"}, "RULE-CVE-2025-2166-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cm-faq($|-)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:[\\"\'`]\\\\s*>\\\\s*<|<\\\\s*(?:script|svg|img|iframe|object|embed|body|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2166", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2166", "description": "CM FAQ <=1.2.5 Reflected XSS via remove_query_arg without esc_url on admin page URL", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cm-faq", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-2167-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages))~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[events_list\\\\b[^\\\\]]*(?:before_title|title|after_title)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|<details[^>]+\\\\bontoggle\\\\s*=|javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|toggle)\\\\s*=)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2167", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2167", "description": "Event Post <=5.9.9 Stored XSS via events_list shortcode attributes (before_title, title, after_title) in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "event-post", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.9.9"}, "RULE-CVE-2025-2186-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bwfan_get_automation_wc_dynamic_coupon"}, {"name": "ARGS:automationId", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2186", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2186", "description": "FunnelKit Automations <=3.5.1 unauthenticated SQL injection via automationId parameter in bwfan_get_automation_wc_dynamic_coupon AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-marketing-automations", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2025-2203-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/funnelkit-app/funnel-analytics/\\\\d+/contacts~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:\'[\\\\s)]*(?:UNION[\\\\s/\\\\*]+SELECT|OR[\\\\s/\\\\*]+[\'\\"]?\\\\w+[\'\\"]?\\\\s*[=<>]|AND[\\\\s/\\\\*]+[\'\\"]?\\\\w+|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)|INTO[\\\\s/\\\\*]+(?:OUT|DUMP)FILE|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE|UPDATEXML|LOAD_FILE))~i"}], "cve": "CVE-2025-2203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2203", "description": "FunnelKit Funnel Builder <=3.10.1 authenticated SQL injection via search parameter in funnel analytics contacts REST endpoint", "method": "GET", "mode": "block", "severity": 6.1, "slug": "funnel-builder", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.10.1"}, "RULE-CVE-2025-2221-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_login"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated time-based SQL injection via user_phone parameter in wpcom_login AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_register"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_register AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_send_sms_code"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_send_sms_code AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_lostpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_lostpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_resetpassword"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_resetpassword AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2221-06": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpcom_accountbind"}, {"name": "ARGS:user_phone", "type": "detectSQLi"}], "cve": "CVE-2025-2221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2221", "description": "WPCOM Member <=1.7.6 unauthenticated SQL injection via user_phone parameter in wpcom_accountbind AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpcom-member", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.7.6"}, "RULE-CVE-2025-2225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~\\"rael_title_tag\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<\\\\s*(?:script|img|svg|iframe|body|marquee|details|math|a\\\\b|div\\\\s|input)[^\\"]*|\\\\bon(?:error|load|click|mouseover|focus|toggle|start)\\\\s*=)[^\\"]*\\"~i"}], "cve": "CVE-2025-2225", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2225", "description": "Responsive Addons for Elementor <=1.6.9 Stored XSS via rael_title_tag in Icon Box widget (post.php save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "responsive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2025-2228-01": {"action": "init", "conditions": [{"name": "ARGS:rael-register-submit", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}, {"name": "ARGS:page_id", "type": "exists"}, {"type": "missing_capability", "value": "create_users"}], "cve": "CVE-2025-2228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2228", "description": "Responsive Addons for Elementor <=1.6.8 sensitive information exposure via register_user \\u2014 blocks registration form submissions for users lacking create_users capability. NOTE: This also blocks anonymous self-registration on vulnerable versions as a protective measure.", "method": "POST", "mode": "block", "severity": 5.7, "slug": "responsive-addons-for-elementor", "tags": ["sensitive-information-exposure", "credential-leak"], "target": "plugin", "versions": "<=1.6.8"}, "RULE-CVE-2025-22295-01": {"ajax_action": "tripetto_submit", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~<script[^>]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated form submission (tripetto_submit snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22295-02": {"ajax_action": "tripetto_pause", "conditions": [{"name": "ARGS:snapshot", "type": "regex", "value": "~<script[^>]*>|<[^>]+\\\\son\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-22295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22295", "description": "Tripetto <= 8.0.6 Stored XSS via unauthenticated paused form data (tripetto_pause snapshot parameter)", "method": "POST", "mode": "block", "severity": 7.1, "slug": "tripetto", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=8.0.6"}, "RULE-CVE-2025-22317-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpape-gallery-settings"}, {"name": "ARGS:tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:onfocus|onload|onerror|onmouseover|onclick)\\\\s*=)~i"}], "cve": "CVE-2025-22317", "description": "Gallery Images Ape <=2.2.8 reflected XSS via tab parameter on admin settings page", "mode": "block", "severity": 7.1, "slug": "gallery-images-ape", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2025-22349-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:bid_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via bid_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-manage"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-manage admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-22349-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-auctions-add"}, {"name": "ARGS:wpa_id", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-22349", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22349", "description": "WordPress Auction Plugin <=3.7 SQL injection via wpa_id parameter in wp-auctions-add admin page", "mode": "block", "severity": 7.6, "slug": "wp-auctions", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2025-2252-01": {"ajax_action": "edd_get_download_title", "conditions": [{"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:action", "type": "equals", "value": "edd_get_download_title"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "code_analyst.json:file-GWz1zUnizLcTqJCyFWThCg", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7"], "name": "ARGS:edd_get_download_title", "type": "regex", "value": "~^[0-9]+$~"}, {"citation": ["exploit_feeder.json:file-HKtP2uRHwvfkcjYvBh9vft", "free_run_concept.md:file-CbnNkdMBAXqX24rSYAdyu7", "author_report.json:file-S6ZFTyHKyXhYs5pWZxQcgo"], "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2252", "mode": "block", "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.6.1"}, "RULE-CVE-2025-2257-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "boldgrid-backup-settings"}, {"name": "ARGS:compression_level", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-2257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2257", "description": "Total Upkeep \\u2013 BoldGrid Backup <=1.16.10 authenticated OS command injection via compression_level setting", "method": "POST", "mode": "block", "severity": 7.2, "slug": "boldgrid-backup", "tags": ["command-injection", "authenticated", "settings-update"], "target": "plugin", "versions": "<=1.16.10"}, "RULE-CVE-2025-2262-01": {"action": "template_include", "conditions": [{"name": "ARGS:gslogo_shortcode_preview", "type": "regex", "value": "~[\\\\[\\\\]\\"\'<>]~"}], "cve": "CVE-2025-2262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2262", "description": "GS Logo Slider <=3.7.3 unauthenticated arbitrary shortcode execution via gslogo_shortcode_preview parameter", "mode": "block", "severity": 7.3, "slug": "gs-logo-slider", "tags": ["missing-authorization", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2025-2269-01": {"ajax_action": "editimage_bwg", "conditions": [{"name": "ARGS:image_id", "type": "regex", "value": "~[<>\\"\'()]~"}], "cve": "CVE-2025-2269", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2269", "description": "Photo Gallery by 10Web <=1.8.34 reflected XSS via image_id in editimage_bwg AJAX handler", "mode": "block", "severity": 6.1, "slug": "photo-gallery", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.8.34"}, "RULE-CVE-2025-2270-01": {"action": "init", "conditions": [{"name": "ARGS:ycd_type", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:php|phar|zip|data|expect|glob|ogg)://)~i"}], "cve": "CVE-2025-2270", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2270", "description": "Countdown Builder <=2.8.9.1 unauthenticated Local File Inclusion via ycd_type parameter in RegisterPostType::createCdObj", "mode": "block", "severity": 8.1, "slug": "countdown-builder", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.8.9.1"}, "RULE-CVE-2025-22735-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via unsanitized $_SERVER[\'REQUEST_URI\'] in admin settings view templates", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~on(?:error|load|click|focus|mouseover|mouseout|submit|change|input|keydown|keyup)\\\\s*=~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via event handler injection in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22735-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "tag-groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:img|svg|iframe|body|embed|object|video|audio|details|math|marquee)[\\\\s/]~i"}], "cve": "CVE-2025-22735", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-22735", "description": "Tag Groups <=2.0.4 reflected XSS via HTML tag injection (img/svg/iframe/body/embed/object) in admin settings pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "tag-groups", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-22800-01": {"action": "admin_post_regenerate-qrcode", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "regenerate-qrcode"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-22800", "mode": "block", "severity": 8.8, "slug": "post-smtp", "target": "plugin", "versions": ">=2.8.3 <=2.9.11"}, "RULE-CVE-2025-2299-01": {"ajax_action": "lwptoc_block_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_edit AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2299-02": {"ajax_action": "lwptoc_block_view", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|details|video|audio|body|input|select|textarea|form|meta|link|style|base)\\\\b[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2299", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2299", "description": "LuckyWP Table of Contents <=2.1.10 CSRF to Reflected XSS via lwptoc_block_view AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "luckywp-table-of-contents", "tags": ["xss", "csrf", "reflected-xss"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-2302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2302-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[aws_search_terms\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-2302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2302", "description": "Advanced Woo Search <=3.28 Stored XSS via aws_search_terms shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-woo-search", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.28"}, "RULE-CVE-2025-2314-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in REST API post/page content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2314-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-logout\\\\b[^\\\\]]*\\\\blink_text\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-logout] link_text shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.5"}, "RULE-CVE-2025-2314-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wppb-restrict\\\\b[^\\\\]]*\\\\bmessage\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\\"]*\\"|\'[^\']*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:)[^\']*\'|[^\\\\s\\\\]]*(?:<script|<iframe|<svg[\\\\s/]|<embed|<object|<[a-z][^>]*\\\\bon[a-z]+=|javascript\\\\s*:))[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-2314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2314", "description": "Profile Builder <=3.13.5 stored XSS via [wppb-restrict] message shortcode attribute in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.6"}, "RULE-CVE-2025-2317-01": {"ajax_action": "woo_product_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\'[) ]*(?:/[*][^*]*[*]/[ ]*)*(?:UNION(?:[ ]+|/[*][^*]*[*]/)(?:ALL(?:[ ]+|/[*][^*]*[*]/))?SELECT|(?:OR|AND)(?:[ ]+|/[*][^*]*[*]/)(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|[0-9]+[ ]*=[ ]*[0-9]))~i"}], "cve": "CVE-2025-2317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2317", "description": "Product Filter by WBW <=2.7.9 unauthenticated SQL injection via filtersDataBackend parameter in woo_product_filter AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woo-product-filter", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.7.9"}, "RULE-CVE-2025-2319-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_USER", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_USER parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:db_date", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in db_date parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_NAME", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_NAME parameter used in backup shell commands", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:Download_SQL_Backup", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|\\\\x0d|\\\\x0a)~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to path traversal and header injection via Download_SQL_Backup parameter", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "path-traversal", "header-injection"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_PASSWORD", "type": "regex", "value": "~[;`|\\\\x0a\\\\x0d]|\\\\$\\\\(~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell injection constructs in DB_PASSWORD parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2319-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "elisqlreports"}, {"name": "ARGS:DB_HOST", "type": "regex", "value": "~[;`|&$()\\\\x0a\\\\x0d]~"}], "cve": "CVE-2025-2319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2319", "description": "EZ SQL Reports <=5.25.08 CSRF to RCE via shell metacharacters in DB_HOST parameter passed to passthru()", "method": "POST", "mode": "block", "severity": 8.8, "slug": "elisqlreports", "tags": ["csrf", "command-injection", "remote-code-execution"], "target": "plugin", "versions": "<=5.25.08"}, "RULE-CVE-2025-2328-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/])+~"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary file deletion via path traversal in dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2328-02": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-2328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2328", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.8.7 arbitrary sensitive file deletion via dnd_codedropz_upload_delete AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.3.8.7"}, "RULE-CVE-2025-2330-01": {"action": "init", "conditions": [{"name": "ARGS:_elementor_data", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in _elementor_data (post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-2330-02": {"action": "init", "conditions": [{"name": "ARGS:elements", "type": "regex", "value": "~button[\\\\-_]modal~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|change|input|submit|keydown|keyup|mouseout|mouseenter|mouseleave|dblclick|contextmenu|resize)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2330", "description": "WidgetKit for Elementor <=2.5.4 Stored XSS via button-modal widget in elements param (Elementor AJAX save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "widgetkit-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.5.4"}, "RULE-CVE-2025-23843-01": {"action": "init", "conditions": [{"name": "ARGS:filter_designation", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_designation parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-02": {"action": "init", "conditions": [{"name": "ARGS:filter_department", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_department parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-03": {"action": "init", "conditions": [{"name": "ARGS:filter_employment_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_employment_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-04": {"action": "init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via orderby parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-05": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via order parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-06": {"action": "init", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via status parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-07": {"action": "init", "conditions": [{"name": "ARGS:post_mime_type", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via post_mime_type parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-08": {"action": "init", "conditions": [{"name": "ARGS:detached", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via detached parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-09": {"action": "init", "conditions": [{"name": "ARGS:search_employee", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via search_employee parameter", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-10": {"action": "init", "conditions": [{"name": "ARGS:from", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via from parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-11": {"action": "init", "conditions": [{"name": "ARGS:to", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via to parameter in leave holiday views", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23843-12": {"action": "init", "conditions": [{"name": "ARGS:filter_duration", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-23843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23843", "description": "WP-HR Manager <=3.1.0 reflected XSS via filter_duration parameter in audit log", "method": "GET", "mode": "block", "severity": 7.1, "slug": "wp-hr-manager", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-23942-01": {"ajax_action": "wpgallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wpgallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-02": {"ajax_action": "wplg_edit_gallery", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 authenticated arbitrary file upload via wplg_edit_gallery AJAX action", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-03": {"ajax_action": "wplg_loadmore_gallery", "conditions": [{"name": "ARGS:options", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via options parameter in wplg_loadmore_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-23942-04": {"ajax_action": "wplg_navigation_gallery", "conditions": [{"name": "ARGS:gallery_id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2025-23942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-23942", "description": "WP Load Gallery <=2.1.6 unauthenticated local file inclusion via gallery_id parameter in wplg_navigation_gallery", "mode": "block", "severity": 9.1, "slug": "wp-load-gallery", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2025-24000-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/post-smtp/v1/logs/[^/]+/resend(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 post-smtp/v1/logs/{id}/resend REST endpoint callable by non-admin users, allowing abuse of password reset emails.", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs", "resend"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/email-count(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/email-count REST endpoint accessible to non-admin users.", "method": "GET", "mode": "block", "severity": 6.5, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/minimize-maximize-ad(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/minimize-maximize-ad REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/get-failed-logs(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/get-failed-logs REST endpoint accessible to non-admin users, exposing failed email log contents.", "method": "GET", "mode": "block", "severity": 8.8, "slug": "post-smtp", "tags": ["auth-bypass", "privilege-escalation", "rest-api", "email-logs"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/open-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/open-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24000-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/psd/v1/remove-notification(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24000", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24000", "description": "Post SMTP <= 3.2.0 psd/v1/remove-notification REST endpoint accessible to non-admin users.", "mode": "block", "severity": 4.3, "slug": "post-smtp", "tags": ["auth-bypass", "rest-api"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-24563-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:user_name_search", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via user_name_search parameter in author-search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-04": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_latitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_latitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-05": {"action": "template_redirect", "conditions": [{"name": "ARGS:address_longitude", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via address_longitude parameter in listing_search.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-06": {"action": "template_redirect", "conditions": [{"name": "ARGS:dir_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via dir_id parameter in claim.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24563-07": {"action": "template_redirect", "conditions": [{"name": "ARGS:package_id", "type": "detectXSS"}], "cve": "CVE-2025-24563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24563", "description": "Cleanup \\u2013 Directory Listing & Classifieds <=1.0.4 reflected XSS via package_id parameter in wizard-style-2.php template", "method": "GET", "mode": "block", "severity": 7.1, "slug": "cleanup-light", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-24573-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|change|input|submit|keydown|keyup|pointerover|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-24573", "description": "PageLayer <=1.9.4 contributor+ stored XSS via pagelayer_save_content AJAX handler", "mode": "block", "severity": 6.5, "slug": "pagelayer", "target": "plugin", "versions": "<=1.9.4"}, "RULE-CVE-2025-24587-01": {"ajax_action": "getEmailTemplate", "conditions": [{"name": "ARGS:entrant", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,.*,|CASE\\\\s+WHEN\\\\s+.*\\\\s+THEN\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24587", "description": "Email Subscription Popup <=1.2.23 authenticated blind SQL injection via entrant parameter in getEmailTemplate AJAX handler", "mode": "block", "severity": 7.6, "slug": "email-subscribe", "target": "plugin", "versions": "<=1.2.23"}, "RULE-CVE-2025-24601-01": {"action": "init", "conditions": [{"name": "ARGS:dn-listener", "type": "equals", "value": "paypal"}, {"name": "ARGS:custom", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-24601", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24601", "description": "FundPress <=2.0.6 unauthenticated PHP object injection via PayPal IPN custom parameter", "mode": "block", "severity": 9.8, "slug": "fundpress", "tags": ["object-injection", "deserialization", "unauthenticated", "paypal-ipn"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-24648-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:login_redirect_url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 privilege escalation via login_redirect_url in profile update", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-02": {"ajax_action": "save_custom_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-03": {"ajax_action": "save_custom_menu_order", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_custom_menu_order AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24648-04": {"ajax_action": "save_hidden_menu_items", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24648", "description": "Admin and Site Enhancements (ASE) <=7.6.2.1 missing authorization on save_hidden_menu_items AJAX handler", "mode": "block", "severity": 7.5, "slug": "admin-site-enhancements", "target": "plugin", "versions": "<=7.6.2.1"}, "RULE-CVE-2025-24677-01": {"ajax_action": "pp_wpspin_import_json", "conditions": [{"name": "FILES:pp_wpspin_import_json_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 authenticated remote code execution via arbitrary file write in pp_wpspin_import_json AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["remote-code-execution", "arbitrary-file-write", "code-injection"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24677-02": {"ajax_action": "pp_wpspin_export_json", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-24677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-24677", "description": "Post/Page Import Export <=2.0.3 missing authorization on pp_wpspin_export_json allows authenticated users to export arbitrary posts via IDOR", "method": "POST", "mode": "block", "severity": 9.9, "slug": "postpage-import-export-with-custom-fields-taxonomies", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=2.0.3"}, "RULE-CVE-2025-24752-01": {"action": "init", "conditions": [{"name": "ARGS:popup-selector", "type": "regex", "value": "~[<>\\"\'(){}]|javascript\\\\s*:|on(?:error|load|focus|click|mouseover|mouseout|keyup|keydown|submit|change|input|blur)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|body|details|marquee|video|audio|form|math|base)~i"}], "cve": "CVE-2025-24752", "method": "GET", "mode": "block", "severity": 6.1, "slug": "essential-addons-for-elementor-lite", "target": "plugin", "versions": "<=6.0.14"}, "RULE-CVE-2025-24753-01": {"ajax_action": "kadence_import_get_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-02": {"ajax_action": "kadence_import_reload_prebuilt_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-03": {"ajax_action": "kadence_import_get_new_connection_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-04": {"ajax_action": "kadence_import_get_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-05": {"ajax_action": "kadence_import_reload_prebuilt_templates_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-06": {"ajax_action": "kadence_import_get_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-07": {"ajax_action": "kadence_import_reload_prebuilt_pages_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-08": {"ajax_action": "kadence_import_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-09": {"ajax_action": "kadence_import_process_image_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-10": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-24753-11": {"ajax_action": "kadence_subscribe_process_data", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-24753", "method": "POST", "mode": "block", "severity": 8.8, "slug": "kadence-blocks", "target": "plugin", "versions": "<=3.3.1"}, "RULE-CVE-2025-2478-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-edit"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 time-based blind SQL injection via snippetId on snippet-edit admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2478-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "snippet-delete"}, {"name": "ARGS:snippetId", "type": "regex", "value": "~`|--[\\\\s\\\\-]|/\\\\*|\\\\bunion\\\\s+(?:all\\\\s+)?select\\\\b|\\\\bsleep\\\\s*\\\\(|\\\\bbenchmark\\\\s*\\\\(|\\\\bextractvalue\\\\s*\\\\(|\\\\bupdatexml\\\\s*\\\\(|\\\\bload_file\\\\s*\\\\(|\\\\binformation_schema\\\\b|\'\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\\\\\\"\\\\s*[\\\\)\\\\(]?\\\\s*(?:union|select|sleep|benchmark|extractvalue|updatexml|;|--|/\\\\*)|\'\\\\s*(?:or|and)\\\\s+(?:[\\\\d]+\\\\s*=|sleep\\\\s*\\\\(|extractvalue|updatexml|true\\\\b|false\\\\b)|\\\\border\\\\s+by\\\\s+\\\\d+\\\\s*--|\\\\bif\\\\s*\\\\(\\\\s*\\\\d|\\\\bwhere\\\\s+if\\\\s*\\\\(|\\\\b(?:or|and)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+(?:\\\\s*--)?|0x[0-9a-f]{6,}~i"}], "cve": "CVE-2025-2478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2478", "description": "Code Clone <=1.0.1 SQL injection via snippetId on snippet-delete admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "code-clone", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-2481-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mediaview"}, {"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2025-2481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2481", "description": "MediaView <=1.1.2 Reflected Cross-Site Scripting via id parameter on admin pages", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mediaview", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2484-01": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:video_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via video_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-02": {"ajax_action": "mvob_get_video_embed", "conditions": [{"name": "ARGS:group_id", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 unauthenticated reflected XSS via group_id in mvob_get_video_embed AJAX handler", "method": "GET", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-03": {"ajax_action": "mvob_add_videos_to_groups", "conditions": [{"name": "ARGS:add_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via add_videos in mvob_add_videos_to_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2484-04": {"ajax_action": "mvob_remove_videos_from_groups", "conditions": [{"name": "ARGS:remove_videos", "type": "detectXSS"}], "cve": "CVE-2025-2484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2484", "description": "Multi Video Box <=1.5.2 authenticated reflected XSS via remove_videos in mvob_remove_videos_from_groups AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "multi-video-box", "tags": ["xss", "reflected-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-2537-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "nggallery-manage-gallery"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form|svg|math)[\\\\s/>]|\\\\bon(?:error|load|click|focus|mouseover|mouseenter)\\\\s*=~i"}], "cve": "CVE-2025-2537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2537", "description": "NextGEN Gallery <=3.59.11 Stored DOM-Based XSS via image metadata in manage gallery page", "method": "POST", "mode": "block", "severity": 6.4, "slug": "nextgen-gallery", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.59.11"}, "RULE-CVE-2025-2540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2540-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|products?)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woo3dviewer\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|object|embed|math|video|audio|details|marquee)\\\\b|\\\\bon(?:error|load|click|focus|mouseover|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2540", "description": "Woo 3D Viewer <=1.8.6.6 Stored DOM-Based XSS via [woo3dviewer] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-3d-viewer", "tags": ["xss", "stored-xss", "shortcode", "prettyphoto", "rest-api"], "target": "plugin", "versions": "<=1.8.6.6"}, "RULE-CVE-2025-2543-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/async-upload\\\\.php|/wp-admin/upload\\\\.php)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:svg|svgz)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through async-upload.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2543-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?|)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2543", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2543", "description": "Advanced Accordion Block <=5.0.2 stored XSS via malicious SVG file upload through REST media endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-accordion-block", "tags": ["xss", "stored-xss", "svg-upload", "rest-api"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2025-2563-01": {"ajax_action": "user_registration_user_form_submit", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2025-2563", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-2576-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress media uploader (admin-ajax.php upload-attachment)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2576-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/async-upload\\\\.php(?:\\\\?|$)~"}, {"name": "FILES:async-upload", "type": "exists"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svgz?$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2576", "description": "Ayyash Studio <=1.0.3 Stored XSS via SVG file upload through WordPress async-upload.php endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ayyash-studio", "tags": ["xss", "stored-xss", "svg-upload", "authenticated"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-2579-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/async-upload.php"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:json|lottie)$~i"}], "cve": "CVE-2025-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2579", "description": "Lottie Player <=1.1.8 Stored XSS via malicious .json/.lottie file upload through async-upload.php (blocks uploads matching patch behavior of 1.2.0)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-lottie-player", "tags": ["xss", "stored-xss", "file-upload", "authenticated"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2025-2580-01": {"ajax_action": "bitforms_submit_form", "conditions": [{"name": "ARGS:attachment_name", "type": "regex", "value": "~\\\\.svg(?:$|[\\\\s\\"\'&?#])~i"}], "cve": "CVE-2025-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2580", "description": "Bit Form <= 2.18.3 Stored XSS via SVG file upload through bitforms_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "bit-form", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=2.18.3"}, "RULE-CVE-2025-2594-01": {"ajax_action": "user_registration_membership_confirm_payment", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"name": "ARGS:auto_login", "type": "regex", "value": "~^(?:true|1|yes|on)$~i"}], "cve": "CVE-2025-2594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2594", "description": "User Registration & Membership <=4.1.2 authentication bypass via membership_confirm_payment AJAX action with auto_login parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["authentication-bypass", "idor", "unauthenticated", "account-takeover"], "target": "plugin", "versions": "<=4.1.2"}, "RULE-CVE-2025-2635-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-activations"}, {"name": "ARGS:license-id", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped license-id parameter on Activations admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2635-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "digital-license-manager-licenses"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-2635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2635", "description": "Digital License Manager <=1.7.3 reflected XSS via unescaped search parameter on Licenses admin page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "digital-license-manager", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-2636-01": {"action": "init", "conditions": [{"name": "ARGS:instawp-database-manager", "type": "exists"}, {"name": "ARGS:instawp-database-manager", "type": "regex", "value": "~(?:\\\\.{2,}[\\\\\\\\/]|%2e%2e(?:%2f|%5c)|php://|data://|expect://|zip://|phar://)~i"}], "cve": "CVE-2025-2636", "mode": "block", "severity": 9.8, "slug": "instawp-connect", "target": "plugin", "versions": "<=0.1.0.85"}, "RULE-CVE-2025-26592-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26592-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-26592", "description": "lab theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lab", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2025-26763-04": {"ajax_action": "ms_import_others", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^ms_import_others$~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-26763", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-26763", "description": "MetaSlider <=3.94.0 PHP Object Injection via ms_import_others AJAX handler", "mode": "block", "severity": 9.8, "slug": "ml-slider", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.94.0"}, "RULE-CVE-2025-2685-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "tablepress"}, {"name": "ARGS:action", "type": "equals", "value": "add"}, {"name": "ARGS:table-name", "type": "detectXSS"}], "cve": "CVE-2025-2685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2685", "description": "TablePress <=3.0.4 Authenticated (Author+) Stored XSS via table-name parameter on admin form POST", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-27007-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sure-triggers/v1/automation/action(/|\\\\?|&|$)~"}, {"name": "ARGS:type_event", "type": "equals", "value": "create_user_if_not_exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-27007", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.0.82"}, "RULE-CVE-2025-27012-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:users_can_register", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with users_can_register option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-27012-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "a1post-bg-shipping-for-woocommerce"}, {"name": "ARGS:default_role", "type": "exists"}], "cve": "CVE-2025-27012", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-27012", "description": "A1POST.BG Shipping for WooCommerce <=1.5 CSRF to Privilege Escalation via settings page \\u2014 blocks POST with default_role option injection", "method": "POST", "mode": "block", "severity": 8.8, "slug": "a1post-bg-shipping-for-woocommerce", "tags": ["csrf", "privilege-escalation", "option-injection"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2025-2719-01": {"ajax_action": "swatchly_notices", "conditions": [{"name": "ARGS:noticeid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2719", "description": "Swatchly <=1.4.0 missing authorization on swatchly_notices AJAX action allows Subscriber+ to update arbitrary options to true", "method": "POST", "mode": "block", "severity": 6.5, "slug": "swatchly", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-2779-01": {"ajax_action": "htscript_notices", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on htscript_notices AJAX action allows arbitrary option update", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2779-02": {"ajax_action": "ihafs_diagnostic_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2779", "description": "Insert Headers and Footers Code - HT Script <=1.1.2 missing authorization on ihafs_diagnostic_data AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "insert-headers-and-footers-script", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-2800-01": {"ajax_action": "add_organizer", "conditions": [{"name": "ARGS:organizer_name", "type": "detectXSS"}], "cve": "CVE-2025-2800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2800", "description": "WP Event Manager <=3.1.50 unauthenticated stored XSS via organizer_name in add_organizer AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-event-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.50"}, "RULE-CVE-2025-2801-01": {"ajax_action": "abcsubmit_form_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[.+\\\\]~s"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2801", "description": "ABCSubmit <=1.2.3 unauthenticated arbitrary shortcode execution via abcsubmit_form_preview AJAX handler", "method": "POST", "mode": "block", "severity": 7.3, "slug": "abcsubmit", "tags": ["code-injection", "arbitrary-shortcode", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-2805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~[[][a-z][a-z0-9_-]{2,} [^]]*=[^]]*[]]~"}], "cve": "CVE-2025-2805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2805", "description": "ORDER POST <=2.0.2 unauthenticated arbitrary shortcode execution via comment text containing shortcode syntax", "method": "POST", "mode": "block", "severity": 7.3, "slug": "order-post", "tags": ["code-injection", "shortcode-injection", "unauthenticated", "stored-attack"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-2807-01": {"ajax_action": "mvl_setup_wizard_install_plugin", "conditions": [{"name": "ARGS:plugin", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-2807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2807", "description": "Motors - Car Dealership & Classified Listings <= 1.4.64 missing authorization on mvl_setup_wizard_install_plugin allowing Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.64"}, "RULE-CVE-2025-2816-01": {"ajax_action": "pvc_yellow_message_dontshow", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2816", "description": "Page View Count <=2.8.4 missing authorization on pvc_yellow_message_dontshow AJAX handler allows arbitrary option update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "page-views-count", "tags": ["missing-authorization", "broken-access-control", "option-update"], "target": "plugin", "versions": "<=2.8.4"}, "RULE-CVE-2025-2821-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings modification endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2821-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/search-exclude/v1/settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-2821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2821", "description": "Search Exclude <=2.4.9 missing authorization on REST API settings read endpoint", "method": "GET", "mode": "block", "severity": 5.3, "slug": "search-exclude", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-2839-01": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-02": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-03": {"ajax_action": "wpie_export_get_preview_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_get_preview_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-04": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 script tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-05": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2839-06": {"ajax_action": "wpie_export_create_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:svg|iframe|embed|object)\\\\b[^>]*>~i"}], "cve": "CVE-2025-2839", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2839", "description": "WP Import Export Lite <=3.9.27 authenticated (Contributor+) DOM-based stored XSS via wpie_export_create_data \\u2014 dangerous tag injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-import-export-lite", "tags": ["xss", "stored-xss", "dom-based", "authenticated"], "target": "plugin", "versions": "<=3.9.27"}, "RULE-CVE-2025-2889-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_type", "type": "equals", "value": "link_library_links"}, {"name": "ARGS", "type": "regex", "value": "~<[^>]*(?:on[a-zA-Z0-9_]+ *=|xmlns|style *=[ ]*[\\"\'][^\\"\']*(?:expression|url) *\\\\()|< *(?:script|iframe|object|embed|form|svg|math|base|link|meta)|javascript *:|data *: *text/html~i"}], "cve": "CVE-2025-2889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2889", "description": "Link Library <=7.7.3 Authenticated (Contributor+) Stored XSS via Link Additional Parameters on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "link-library", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.7.3"}, "RULE-CVE-2025-2893-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-2893-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutenverse/countdown"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|svg|embed|object|form|details|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|input|change|submit|animationend|pointerover|auxclick)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-2893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2893", "description": "Gutenverse <=2.2.1 Stored XSS via Countdown block attributes in classic editor post submission", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-28983-01": {"ajax_action": "CNPCF_cnpgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-02": {"ajax_action": "CNPCF_friendlyname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_friendlyname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-03": {"ajax_action": "CNPCF_cnpaccountid", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpaccountid AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-04": {"ajax_action": "CNPCF_cnpchnlgroupname", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on CNPCF_cnpchnlgroupname AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-28983-05": {"ajax_action": "getCnPUserChannelList", "conditions": [{"name": "ARGS:did", "type": "regex", "value": "~(?:or\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|union\\\\s+select|sleep\\\\s*[(]|benchmark\\\\s*[(]|waitfor\\\\s+delay|--|/[*]|[*]/|[#]|(?:^|[^a-zA-Z0-9_])(?:select|insert|update|delete|drop)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2025-28983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-28983", "description": "Click & Pledge Connect <=25.04010101 unauthenticated SQL injection via did parameter on getCnPUserChannelList AJAX action", "mode": "block", "severity": 9.8, "slug": "click-pledge-connect", "tags": ["sql-injection", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=25.04010101"}, "RULE-CVE-2025-2940-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "contains", "value": "wpf-async-request-"}, {"name": "ARGS:args[url]", "type": "exists"}], "cve": "CVE-2025-2940", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-2940", "description": "Ninja Tables <= 5.0.18 unauthenticated SSRF via WPFluent async request handler args[url] parameter", "mode": "block", "severity": 7.2, "slug": "ninja-tables", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=5.0.18"}, "RULE-CVE-2025-2941-01": {"ajax_action": "dnd_codedropz_upload_wc", "conditions": [{"name": "FILES:wc-upload-file[]", "type": "exists"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-2941-02": {"ajax_action": "dnd_codedropz_upload_delete_wc", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]\\\\.\\\\.)|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[\\\\\\\\/]))~i"}], "cve": "CVE-2025-2941", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-3058-01": {"ajax_action": "xwc_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:settings", "type": "exists"}], "cve": "CVE-2025-3058", "method": "POST", "mode": "block", "severity": 8.8, "slug": "xelion-webchat", "target": "plugin", "versions": "<=9.1.0"}, "RULE-CVE-2025-3064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on options.php", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/network/settings.php"}, {"name": "ARGS:default_role", "type": "regex", "value": "~(?i)^administrator$~"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via default_role=administrator on network settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "multisite"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3064-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "general"}, {"name": "ARGS:action", "type": "equals", "value": "update"}, {"name": "ARGS:wpfront-secondary-roles[administrator]", "type": "exists"}], "cve": "CVE-2025-3064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3064", "description": "WPFront User Role Editor <=4.2.1 CSRF to privilege escalation via secondary roles including administrator", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpfront-user-role-editor", "tags": ["csrf", "privilege-escalation", "state-change"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3075-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\\\bon(?:mouse(?:over|enter|move|out|down|up)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|animate(?:end|start|iteration)|transition(?:end|run|start)|pointer(?:over|enter|down|up|move|out)|touch(?:start|end|move))\\\\s*=~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-3075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3075", "description": "Elementor <=3.29.0 Authenticated (Contributor+) Stored XSS via widget settings in elementor_ajax save handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementor", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=3.29.0"}, "RULE-CVE-2025-30772-01": {"ajax_action": "wpcuf_import_export_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 arbitrary option update to privilege escalation via wpcuf_import_export_save AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30772-02": {"ajax_action": "wpcuf_import_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-30772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30772", "description": "WPC Smart Upsell Funnel <=3.0.4 missing authorization on wpcuf_import_export AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-smart-upsell-funnel", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2025-30773-01": {"ajax_action": "trp_save_translations_regular", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_regular strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-02": {"ajax_action": "trp_save_translations_gettext", "conditions": [{"name": "ARGS:strings", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_save_translations_gettext strings parameter", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30773-03": {"ajax_action": "trp_update_database", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2025-30773", "description": "TranslatePress <=2.9.6 PHP object injection via trp_update_database AJAX handler", "mode": "block", "severity": 7.2, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.9.6"}, "RULE-CVE-2025-30911-01": {"ajax_action": "install_requirements", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on install_requirements allows subscriber+ arbitrary plugin installation leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-plugin-install", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-30911-02": {"ajax_action": "import_rtm_template", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-30911", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-30911", "description": "RomethemeKit For Elementor <=1.5.4 missing authorization on import_rtm_template allows subscriber+ arbitrary file write leading to RCE", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["missing-authorization", "arbitrary-file-write", "remote-code-execution"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-31019-01": {"action": "init", "conditions": [{"name": "ARGS:mopppm_userid", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31019", "method": "POST", "mode": "block", "severity": 8.8, "slug": "password-policy-manager", "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-3102-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/(?:sure-triggers|suretriggers|ottokit)/v1/(?:authenticate-user|automation/action)(?:/|\\\\?|$)~i"}, {"name": "REQUEST_HEADERS:st_authorization", "type": "regex", "value": "~^(?:[\\\\s]*|Bearer[\\\\s]*)$~i"}], "cve": "CVE-2025-3102", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3102", "description": "SureTriggers <=1.0.78 unauthenticated REST API authentication bypass via empty st_authorization header", "method": "POST", "mode": "block", "severity": 9.8, "slug": "suretriggers", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.78"}, "RULE-CVE-2025-3106-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"action\\"\\\\s*:\\\\s*\\"save_builder\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"lakit-table-of-contents\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:\\"icon\\"\\\\s*:\\\\s*\\\\{[^{}\\\\r\\\\n]{0,1024}\\"value\\"\\\\s*:\\\\s*\\"[^\\"\\\\\\\\\\\\r\\\\n]{0,256}(?:\\\\\\\\\\"|\\\\\\\\u0022)[^\\"\\\\r\\\\n]{0,128}\\\\bon[a-z][a-z0-9_:-]*\\\\s*=|&(?:lt|\\\\#0*60|\\\\#x0*3c);\\\\s*(?:script(?=\\\\s|&(?:gt|\\\\#0*62|\\\\#x0*3e);)|(?:img|svg|iframe|object|embed|details|math|video|audio|body)\\\\b[^\\\\r\\\\n]{0,512}?\\\\bon[a-z][a-z0-9_:-]*\\\\s*=))~ix"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3106", "description": "LA-Studio Element Kit for Elementor <=1.4.9 authenticated stored XSS via unsanitized Table of Contents list text or icon value in Elementor save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2025-3107-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in post_content (classic editor POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (POST)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PUT)", "method": "PUT", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-3107-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmlhistory\\\\b[^\\\\]]*(?:orderby|order)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:SLEEP|BENCHMARK|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION|SELECT|AND\\\\s+\\\\d|OR\\\\s+\\\\d|CONCAT|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|;|--|/\\\\*)[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-3107", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3107", "description": "Newsletters <= 4.9.9.8 authenticated (Contributor+) SQL injection via [wpmlhistory] shortcode orderby/order attribute in REST API content (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.5, "slug": "newsletters-lite", "tags": ["sql-injection", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.9.9.8"}, "RULE-CVE-2025-31560-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "salon-customers"}, {"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02A": {"ajax_action": "salon", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-31560-02B": {"ajax_action": "salon", "conditions": [{"name": "ARGS:user_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor|shop_manager)~i"}], "cve": "CVE-2025-31560", "method": "POST", "mode": "block", "severity": 7.2, "slug": "salon-booking-system", "target": "plugin", "versions": "<=10.11"}, "RULE-CVE-2025-32118-01": {"ajax_action": "cmp_ajax_upload_font", "conditions": [{"name": "FILES:font_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-32118", "description": "CMP Coming Soon & Maintenance <=4.1.14 authenticated arbitrary file upload via cmp_ajax_upload_font", "mode": "block", "severity": 9.1, "slug": "cmp-coming-soon-maintenance", "target": "plugin", "versions": "<=4.1.14"}, "RULE-CVE-2025-32143-01": {"ajax_action": "accordions_ajax_import_json", "conditions": [{"name": "ARGS:accordions_data", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-32143", "description": "Accordion <=2.3.11 PHP object injection via accordions_data parameter in import handler", "mode": "block", "severity": 8.8, "slug": "accordions", "target": "plugin", "versions": "<=2.3.11"}, "RULE-CVE-2025-32486-01": {"ajax_action": "public_amd_ajax_handler", "conditions": [{"name": "ARGS:reset_password[new_password]", "type": "exists"}, {"name": "ARGS:reset_password[vcode]", "type": "regex", "value": "~^0[eE]\\\\d+$~"}], "cve": "CVE-2025-32486", "method": "POST", "mode": "block", "severity": 9.8, "slug": "material-dashboard", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2025-32568-01": {"ajax_action": "empik_csv_process_emp_log_classes", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_log_classes AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32568-02": {"ajax_action": "empik_csv_process_emp_prod_states", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-32568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32568", "description": "EmpikPlace for WooCommerce <=1.4.3 PHP Object Injection via empik_csv_process_emp_prod_states AJAX handler", "mode": "block", "severity": 9.8, "slug": "empik-for-woocommerce", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.4.3"}, "RULE-CVE-2025-32597-01": {"ajax_action": "cdaily", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^A-Za-z0-9_.$]~"}], "cve": "CVE-2025-32597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32597", "description": "Connect Daily Web Calendar <=1.5.4 reflected XSS via unsanitized JSONP callback parameter in cdaily AJAX handler", "mode": "block", "severity": 7.1, "slug": "connect-daily-web-calendar", "tags": ["xss", "csrf", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-32648-01": {"ajax_action": "pto_ajax_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author|contributor|admin)$~i"}], "cve": "CVE-2025-32648", "method": "POST", "mode": "block", "severity": 9.8, "slug": "projectopia-core", "target": "plugin", "versions": "<=5.1.23"}, "RULE-CVE-2025-32652-01": {"ajax_action": "solace_extra_upload_logo", "conditions": [{"name": "ARGS:logo_url", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)(?:[?#%/]|$)|\\\\.htaccess(?:[?#%/]|$)|\\\\.htpasswd(?:[?#%/]|$)~i"}], "cve": "CVE-2025-32652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32652", "description": "Solace Extra <=1.3.1 arbitrary file upload via solace_extra_upload_logo AJAX handler allowing remote PHP file write", "mode": "block", "severity": 9.9, "slug": "solace-extra", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-32682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapsvg/v[0-9]+/~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-32682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-32682", "description": "MapSVG Lite <=8.6.4 authenticated (Contributor+) arbitrary file upload via REST API allowing web shell deployment", "method": "POST", "mode": "block", "severity": 9.9, "slug": "mapsvg-lite-interactive-vector-maps", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "authenticated"], "target": "plugin", "versions": "<=8.6.4"}, "RULE-CVE-2025-3281-01": {"ajax_action": "user_registration_membership_create_stripe_subscription", "conditions": [{"name": "ARGS:member_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 IDOR in create_stripe_subscription allowing unauthenticated user deletion via member_id", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "missing-authorization", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-03": {"ajax_action": "user_registration_membership_verify_pages", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on verify_pages membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3281-04": {"ajax_action": "user_registration_membership_validate_pg", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3281", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3281", "description": "User Registration & Membership <=4.2.1 missing authorization on validate_pg membership AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-3418-01": {"ajax_action": "wpcac_edit_save", "conditions": [{"name": "ARGS:field", "type": "regex", "value": "~^(wp_capabilities|wp_user_level|role)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3418", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wpc-admin-columns", "target": "plugin", "versions": ">=2.0.6 <=2.1.0"}, "RULE-CVE-2025-3421-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "evf-entries"}, {"name": "ARGS:form_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:img|svg|iframe|object|embed|math|details|marquee|video|audio|body|input|button|select|textarea|form|isindex|meta|link|style|base|frame|frameset|applet)\\\\b[^>]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\'\\"]?javascript))~i"}], "cve": "CVE-2025-3421", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3421", "description": "Everest Forms <=3.1.1 Reflected Cross-Site Scripting via form_id parameter on admin entries page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "everest-forms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3422-01": {"ajax_action": "everest_forms_form_preview_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3422", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3422", "description": "Everest Forms <=3.1.1 authenticated arbitrary shortcode execution via form_preview_save AJAX action", "method": "POST", "mode": "block", "severity": 6.3, "slug": "everest-forms", "tags": ["missing-authorization", "arbitrary-shortcode-execution", "code-injection"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2025-3428-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (GET)", "method": "GET", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3428-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "3dprintlite_coatings"}, {"name": "ARGS:coating_text", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-3428", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3428", "description": "3DPrint Lite <=2.1.3.6 authenticated (Admin+) SQL injection via coating_text parameter on coatings admin page (POST)", "method": "POST", "mode": "block", "severity": 4.9, "slug": "3dprint-lite", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.1.3.6"}, "RULE-CVE-2025-3434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon[a-zA-Z0-9_]+\\\\s*=|<iframe\\\\b|<object\\\\b|<embed\\\\b|<svg[\\\\s/]|javascript\\\\s*:~i"}], "cve": "CVE-2025-3434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3434", "description": "SMTP for Amazon SES YaySMTP <=1.8 unauthenticated stored XSS via comment form email logging", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-3434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon[a-zA-Z0-9_]+\\\\s*=|<iframe\\\\b|<object\\\\b|<embed\\\\b|<svg[\\\\s/]|javascript\\\\s*:~i"}], "cve": "CVE-2025-3434", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3434", "description": "SMTP for Amazon SES YaySMTP <=1.8 unauthenticated stored XSS via comment author field email logging", "method": "POST", "mode": "block", "severity": 7.2, "slug": "smtp-amazon-ses", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-3435-01": {"ajax_action": "mb_board", "conditions": [{"name": "ARGS:board_header", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_header parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3435-02": {"ajax_action": "mb_board", "conditions": [{"name": "ARGS:board_footer", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3435", "description": "Mang Board WP <=1.8.6 Stored XSS via board_footer parameter in mb_board AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "mangboard", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.8.6"}, "RULE-CVE-2025-3436-01": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via orderby parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3436-02": {"ajax_action": "coreactivity_live_logs", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-3436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3436", "description": "coreActivity <=2.7 SQL injection via order parameter in Live Logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "coreactivity", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2025-3438-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/api/flutter_user/(?:register|sign_up|sign_up_2)(/|\\\\?|$)~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!(subscriber|customer|owner|driver)$).+$~"}], "cve": "CVE-2025-3438", "method": "POST", "mode": "block", "severity": 7.3, "slug": "mstore-api", "target": "plugin", "versions": "<4.17.5"}, "RULE-CVE-2025-3439-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3439-02": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-3439", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "target": "plugin", "versions": "<3.1.2"}, "RULE-CVE-2025-3455-01": {"action": "admin_post_start_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated arbitrary file upload via start_restore admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["arbitrary-file-upload", "missing-authorization", "file-upload"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-02": {"action": "admin_post_start_backup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on start_backup admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3455-03": {"action": "admin_post_cancel_actions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3455", "description": "1 Click Migration <=2.2 authenticated missing authorization on cancel_actions admin-post action", "mode": "block", "severity": 8.8, "slug": "1-click-migration", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-3457-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3457-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[oceanwp_icon"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[oceanwp_icon\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3457", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3457", "description": "Ocean Extra <=2.4.6 Stored XSS via [oceanwp_icon] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:ocean_gallery_id[/[0-9]+/]", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-3458", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3458", "description": "Ocean Extra <=2.4.6 stored XSS via unsanitized ocean_gallery_id in gallery metabox", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-3468-01": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-02": {"ajax_action": "nf_insert_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_insert_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-03": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:clean_html", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon\\\\w+\\\\s*=|<img[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via clean_html parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3468-04": {"ajax_action": "nf_update_record", "conditions": [{"name": "ARGS:form_fields", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<svg[^>]*\\\\bon~i"}], "cve": "CVE-2025-3468", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3468", "description": "NEX-Forms <= 8.9.1 Stored XSS via form_fields parameter in nf_update_record AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "nex-forms-express-wp-form-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-3471-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/sureforms/v1/global-settings(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3471", "description": "SureForms <1.4.4 incorrect authorization on global-settings REST API endpoint allows Contributor+ to update plugin settings", "method": "POST", "mode": "block", "severity": 4.9, "slug": "sureforms", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<1.4.4"}, "RULE-CVE-2025-3487-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[forminator_form[^\\\\]]*\\\\blimit\\\\s*=\\\\s*([\\"\'])[\\\\s\\\\S]*?(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}\\\\s*=|javascript\\\\s*:|&#\\\\d+;|&#x[0-9a-fA-F]+;)[\\\\s\\\\S]*?\\\\1~i"}], "cve": "CVE-2025-3487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3487", "description": "Forminator <=1.42.0 Stored XSS via limit parameter in forminator_list_pagination", "mode": "block", "severity": 5.4, "slug": "forminator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.42.0"}, "RULE-CVE-2025-3515-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "dnd_codedropz_upload"}, {"name": "FILES", "type": "exists"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:phar|pht|phtml|php[0-9]?|phps|php\\\\.[^./]+|inc)$~i"}], "cve": "CVE-2025-3515", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "target": "plugin", "versions": "<=1.3.8.9"}, "RULE-CVE-2025-3516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via post_content attribute injection (classic editor)", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3516-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']\\\\s*on(error|load|mouseover|click|focus|blur|mouseenter|submit|animationend|transitionend|pointerover|focusin)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3516", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3516", "description": "Simple Lightbox <=2.9.3 Contributor+ Stored XSS via REST API post content attribute injection", "method": "POST", "mode": "block", "severity": 5.9, "slug": "simple-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.9.3"}, "RULE-CVE-2025-3520-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on profile.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3520-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:delete-avatar", "type": "exists"}, {"name": "ARGS:image_src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2025-3520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3520", "description": "Avatar <=0.1.4 authenticated arbitrary file deletion via path traversal on user-edit.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "avatar", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=0.1.4"}, "RULE-CVE-2025-3597-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in post_content on classic editor", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "post-content"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3597-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~fancybox[^}]*\\\\{[^}]*(?:function|eval|alert|document|window|fetch|XMLHttpRequest|setTimeout|setInterval|constructor|\\\\bon[A-Z])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3597", "description": "Easy FancyBox <=2.3.14 Stored XSS via jQuery Metadata in content on REST API posts endpoint", "method": "POST", "mode": "block", "severity": 5.9, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=2.3.14"}, "RULE-CVE-2025-3614-01": {"ajax_action": "ekit_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript[ ]*:|&#[xX]?[0-9a-fA-F]+;?[a-zA-Z]*script[ ]*:|data[ ]*:[ ]*text/html|on(?:mouse(?:over|enter|move|out|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|dblclick|drag|drop|resize|scroll|unload|beforeunload|pointerover|pointerenter|animationend|transitionend)[ ]*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3614", "description": "ElementsKit Elementor Addons <=3.5.2 Stored XSS via Widget Builder URL control through ekit_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "widget-builder"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-3616-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v1/proxy-api(/|\\\\?|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-3616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3616", "description": "GreenShift Animation and Page Builder Blocks >=11.4 <=11.4.5 authenticated arbitrary file upload via REST proxy-api endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["arbitrary-file-upload", "missing-authorization", "rest-api", "file-upload"], "target": "plugin", "versions": ">=11.4 <=11.4.5"}, "RULE-CVE-2025-3649-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:&#0*58;?|&#x0*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:&#0*58;?|&#x0*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API POST)", "method": "POST", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3649-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-download\\\\s*=\\\\s*(?:[\\"\']\\\\s*)?(?:javascript|data)\\\\s*(?:&#0*58;?|&#x0*3[aA];?|:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3649", "description": "LightPress Lightbox <=2.3.3 Stored XSS via javascript:/data: URI in data-download attribute (REST API PUT)", "method": "PUT", "mode": "block", "severity": 6.8, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2025-3662-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<a\\\\b[^>]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:&lt;|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 unauthenticated stored XSS via comment submission with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3662-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<a\\\\b[^>]+(?:title|data-caption)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:&lt;|<)(?:img|svg|iframe|script|body|video|audio|details|marquee|object|embed|math|input|select|textarea|button|form|keygen|isindex)\\\\b[^\\"\']*(?:onerror|onload|onmouseover|onfocus|onblur|onclick|onmouseenter|onanimationend|ontoggle|onpointerover|oncontextmenu)\\\\s*=~i"}], "cve": "CVE-2025-3662", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3662", "description": "FancyBox for WordPress <3.3.6 Contributor+ stored XSS via post content with malicious anchor title/data-caption attributes", "method": "POST", "mode": "block", "severity": 6.1, "slug": "fancybox-for-wordpress", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<3.3.6"}, "RULE-CVE-2025-3703-01": {"ajax_action": "cjtoolbox_get_info_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) local file inclusion via cjtoolbox_get_info_view AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-02": {"ajax_action": "cjtoolbox_create", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_create AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-03": {"ajax_action": "cjtoolbox_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_delete AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-04": {"ajax_action": "cjtoolbox_set_property", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_set_property AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-05": {"ajax_action": "cjtoolbox_restore", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_restore AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-06": {"ajax_action": "cjtoolbox_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_list AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-07": {"ajax_action": "cjtoolbox_get_revision", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revision AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3703-08": {"ajax_action": "cjtoolbox_get_revisions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3703", "description": "CSS & JavaScript Toolbox <=12.0.3 authenticated (Subscriber+) missing authorization on cjtoolbox_get_revisions AJAX handler", "mode": "block", "severity": 7.5, "slug": "css-javascript-toolbox", "target": "plugin", "versions": "<=12.0.3"}, "RULE-CVE-2025-3752-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3752-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ableplayer\\\\b[^\\\\]]*\\\\bpreload\\\\s*=\\\\s*(?:\\"(?!auto\\"|metadata\\"|none\\")[^\\"]+\\"|\'(?!auto\'|metadata\'|none\')[^\']+\'|(?!auto\\\\b|metadata\\\\b|none\\\\b)\\\\S+)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3752", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3752", "description": "Able Player <=1.2.1 Stored XSS via [ableplayer] shortcode preload attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ableplayer", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2025-3761-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(profile|user-edit)\\\\.php~"}, {"name": "ARGS:mt_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3761", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3761", "description": "My Tickets <= 2.0.16 authenticated privilege escalation via mt_capabilities in profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "my-tickets", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.16"}, "RULE-CVE-2025-3775-01": {"ajax_action": "woolentor_proxy_image", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?!library\\\\.shoplentor\\\\.com(:[0-9]+)?(/|$|\\\\?))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3775", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3775", "description": "ShopLentor (WooLentor) <=3.1.2 unauthenticated SSRF via woolentor_proxy_image AJAX endpoint \\u2014 blocks requests where the url parameter targets any host other than the legitimate library.shoplentor.com", "mode": "block", "severity": 6.5, "slug": "woolentor-addons", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-3780-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wcfm-setup"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3780", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3780", "description": "WCFM Frontend Manager <=6.7.16 unauthenticated plugin settings modification via admin_init setup redirect", "mode": "block", "severity": 6.5, "slug": "wc-frontend-manager", "tags": ["missing-authorization", "unauthenticated", "settings-tampering"], "target": "plugin", "versions": "<=6.7.16"}, "RULE-CVE-2025-3781-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3781-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[raisely_donation_form\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-3781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3781", "description": "Raisely Donation Form <=1.1 Stored XSS via raisely_donation_form shortcode attributes in REST API post content", "mode": "block", "severity": 6.4, "slug": "raisely-donation-form", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-3782-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3782-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[cision-block\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*([\'\\"])(?:(?!\\\\1).)*(?:(?:on\\\\w+)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed)|javascript\\\\s*:)~is"}], "cve": "CVE-2025-3782", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3782", "description": "Cision Block <=4.3.0 Stored XSS via shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cision-block", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2025-3809-01": {"ajax_action": "log_js_errors", "conditions": [{"name": "ARGS:error", "type": "regex", "value": "~(?i)(<\\\\s*script\\\\b|on\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-3809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3809", "description": "Debug Log Manager <=2.3.4 unauthenticated stored XSS via log_js_errors AJAX error parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "debug-log-manager", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2025-3858-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3858-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[formality[^\\\\]]*align\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<\\\\s*(?:script|svg|img|iframe|embed|object|form|details)|on[a-z]+=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-3858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3858", "description": "Formality <=1.5.8 Stored XSS via [formality] shortcode align attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "formality", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2025-3860-01": {"ajax_action": "sc_ajax_handler", "conditions": [{"name": "ARGS:saleclass", "type": "exists"}, {"name": "ARGS:saleclass", "type": "regex", "value": "~[<>\\"\']~"}], "cve": "CVE-2025-3860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3860", "description": "CarDealerPress <=6.8.2505.00 Stored XSS via saleclass parameter in sc_ajax_handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cardealerpress", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=6.8.2505.00"}, "RULE-CVE-2025-3861-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/un-protect-files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API un-protect files endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/files/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API file protection status endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3861-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pda/v1/private-urls/\\\\d+(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3861", "description": "Prevent Direct Access <=2.8.8.2 incorrect authorization on REST API private URLs endpoint", "method": "GET", "mode": "block", "severity": 5.4, "slug": "prevent-direct-access", "tags": ["incorrect-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": ">=2.8.6 <=2.8.8.2"}, "RULE-CVE-2025-3862-01": {"action": "init", "conditions": [{"name": "ARGS:cg_off_id", "type": "regex", "value": "~[<>\\"\'();]~"}], "cve": "CVE-2025-3862", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3862", "description": "Contest Gallery <= 26.0.6 Stored XSS via cg_off_id parameter in shortcode rendering", "mode": "block", "severity": 5.4, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=26.0.6"}, "RULE-CVE-2025-3868-01": {"action": "admin_init", "conditions": [{"name": "ARGS:menuObject", "type": "detectXSS"}], "cve": "CVE-2025-3868", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3868", "description": "Custom Admin-Bar Favorites <=0.1 reflected XSS via menuObject parameter", "mode": "block", "severity": 6.1, "slug": "admin-bookmarks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.1"}, "RULE-CVE-2025-3876-01": {"action": "init", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "smsalert_ajax_form_validate"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3876", "method": "POST", "mode": "block", "severity": 8.8, "slug": "sms-alert", "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2025-3878-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[sa_verify\\\\s[^\\\\]]*(?:phone_selector|submit_selector|user_selector|pwd_selector|placeholder)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\'\\"]\\\\s*\\\\)|<script|javascript:|on(?:error|load|click|mouseover)\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-3878", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3878", "description": "SMS Alert Order Notifications <= 3.8.1 Stored XSS via sa_verify shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "sms-alert", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.8.1"}, "RULE-CVE-2025-3888-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/async-upload.php"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg(?:\\\\?|#|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3888", "description": "Jupiter X Core <=4.8.12 Stored XSS via SVG File inclusion (block non-admin SVG uploads to async-upload.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "jupiterx-core", "tags": ["xss", "stored-xss", "svg-upload", "file-upload"], "target": "plugin", "versions": "<=4.8.12"}, "RULE-CVE-2025-3888-02": {"ajax_action": "enable_unfiltered_files_upload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3888", "description": "Jupiter X Core <=4.8.12 missing authorization on enable_unfiltered_files_upload AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "jupiterx-core", "tags": ["missing-authorization", "xss", "svg-upload", "ajax"], "target": "plugin", "versions": "<=4.8.12"}, "RULE-CVE-2025-3889-01": {"action": "init", "conditions": [{"name": "ARGS:cquantity", "type": "exists"}, {"name": "ARGS:quantity", "type": "regex", "value": "~^ *-~"}], "cve": "CVE-2025-3889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3889", "description": "WP Simple Shopping Cart <=5.1.3 IDOR via negative quantity in cart update", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["idor", "business-logic", "unauthenticated"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-3890-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wp_cart_button|wpsc_add_to_cart_button)\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-3890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3890", "description": "WordPress Simple PayPal Shopping Cart <=5.1.3 Stored XSS via wp_cart_button shortcode in Classic Editor post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-3890-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wp_cart_button|wpsc_add_to_cart_button)\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-3890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3890", "description": "WordPress Simple PayPal Shopping Cart <=5.1.3 Stored XSS via wp_cart_button shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2025-3914-01": {"ajax_action": "aeropageMediaDownload", "conditions": [{"name": "ARGS:media", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm)|(?:\\\\.?user\\\\.ini|\\\\.htaccess|\\\\.htpasswd)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-3914", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3914", "description": "Aeropage Sync for Airtable <=3.2.0 authenticated (Subscriber+) arbitrary file upload via aeropageMediaDownload AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "aeropage-sync-for-airtable", "tags": ["arbitrary-file-upload", "missing-file-type-validation", "authenticated", "remote-code-execution"], "target": "plugin", "versions": "<=3.2.0"}, "RULE-CVE-2025-3917-01": {"action": "init", "conditions": [{"name": "ARGS:img", "type": "regex", "value": "~https?://[^\\\\s]+\\\\.(?:ph(?:p\\\\d?|tml?|t|ar|s)|cgi|asp|aspx|jsp|jspx|cfm)(?:\\\\.[a-z]{2,4})?(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-3917", "method": "POST", "mode": "block", "severity": 9.8, "slug": "baiduseo", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-3917-02": {"action": "init", "conditions": [{"name": "ARGS:img1", "type": "regex", "value": "~https?://[^\\\\s]+\\\\.(?:ph(?:p\\\\d?|tml?|t|ar|s)|cgi|asp|aspx|jsp|jspx|cfm)(?:\\\\.[a-z]{2,4})?(?:\\\\?|#|$)~i"}], "cve": "CVE-2025-3917", "method": "POST", "mode": "block", "severity": 9.8, "slug": "baiduseo", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-3921-01": {"ajax_action": "pepro_reglogin", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~i"}], "cve": "CVE-2025-3921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3921", "description": "PeproDev Ultimate Profile Solutions <=7.5.2 unauthenticated arbitrary user meta update via pepro_reglogin AJAX handler", "method": "POST", "mode": "block", "severity": 8.2, "slug": "peprodev-ups", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "privilege-escalation"], "target": "plugin", "versions": "<=7.5.2"}, "RULE-CVE-2025-39458-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39458", "description": "foton theme <= 2.5.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "foton", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2025-39458-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39458", "description": "foton theme <= 2.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "foton", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2025-39466-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39466", "description": "dor theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dor", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-39466-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39466", "description": "dor theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-39490-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-39490", "description": "backpacktraveler theme <= 2.10.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "backpacktraveler", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.10.2"}, "RULE-CVE-2025-39490-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-39490", "description": "backpacktraveler theme <= 2.10.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "backpacktraveler", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.10.2"}, "RULE-CVE-2025-3952-01": {"ajax_action": "pto_remove_logo", "conditions": [{"name": "ARGS:type", "type": "exists"}, {"type": "missing_capability", "value": "edit_cqpim_settings"}], "cve": "CVE-2025-3952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3952", "description": "Projectopia <=5.1.16 missing authorization on pto_remove_logo AJAX handler allows authenticated users (Subscriber+) to clear arbitrary WordPress options via the type parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "projectopia-core", "tags": ["missing-authorization", "broken-access-control", "arbitrary-option-update"], "target": "plugin", "versions": "<=5.1.16"}, "RULE-CVE-2025-3953-01": {"ajax_action": "wp_statistics_option_updater", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-3953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-3953", "description": "WP Statistics <=14.13.3 missing authorization on wp_statistics_option_updater AJAX handler allows authenticated users to update arbitrary plugin settings", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=14.13.3"}, "RULE-CVE-2025-39551-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/fluent-boards/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2025-39551", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39551", "description": "FluentBoards <=1.47 unauthenticated PHP object injection via REST API deserialization", "mode": "block", "severity": 9.8, "slug": "fluent-boards", "tags": ["object-injection", "deserialization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.47"}, "RULE-CVE-2025-39557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kadence-woomail-import", "type": "exists"}, {"name": "FILES:kadence-woomail-import-file:name", "type": "regex", "value": "~\\\\.(?:php[0-9s]?|phtml?|phar|shtml|cgi)(?:\\\\.|$)~i"}, {"name": "REQUEST_URI", "type": "contains", "value": "customize.php"}], "cve": "CVE-2025-39557", "description": "Blocks unrestricted file upload (CWE-434) in Kadence WooCommerce Email Designer import feature. Detects non-JSON file uploads to the customizer import endpoint by inspecting the uploaded filename for dangerous extensions (PHP, PHTML, PHAR, etc.).", "mode": "block", "severity": 9.1, "slug": "kadence-woocommerce-email-designer", "target": "plugin", "versions": "<1.5.15"}, "RULE-CVE-2025-39590-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+~"}, {"name": "ARGS:data[settings][tab_title]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-39590", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39590", "description": "Essential Addons for Elementor <=6.1.9 contributor+ stored XSS via Advanced Tabs tab_title widget setting", "mode": "block", "severity": 6.5, "slug": "essential-addons-for-elementor-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.9"}, "RULE-CVE-2025-39596-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (GET)", "method": "GET", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-39596-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:qntn_pwd", "type": "exists"}], "cve": "CVE-2025-39596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39596", "description": "Quentn WP <=1.2.8 unauthenticated privilege escalation via qntn_pwd auto-login token (POST)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quentn-wp", "tags": ["weak-authentication", "privilege-escalation", "unauthenticated", "authentication-bypass"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2025-4054-02": {"action": "init", "conditions": [{"name": "ARGS:highlight", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=|<iframe[^>]+src\\\\s*=\\\\s*[\\"\']?javascript:|<body[^>]+onload\\\\s*=|<details[^>]+ontoggle\\\\s*=|on(?:error|load|click|mouseover|focus|toggle)\\\\s*=)~i"}], "cve": "CVE-2025-4054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4054", "description": "Relevanssi <=4.24.3 unauthenticated reflected XSS via highlight query parameter", "mode": "block", "severity": 6.1, "slug": "relevanssi", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.24.3"}, "RULE-CVE-2025-4099-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<iframe|<img\\\\b[^>]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4099-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[list_children\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<iframe|<img\\\\b[^>]+\\\\bon)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4099", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4099", "description": "List Children <=2.1 Stored XSS via list_children shortcode attributes in post_content parameter", "method": "POST", "mode": "block", "severity": 5.4, "slug": "list-children", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-4104-01": {"ajax_action": "fed_login_form_post", "conditions": [{"name": "ARGS:submit", "type": "equals", "value": "register"}, {"name": "ARGS:ID", "type": "exists"}], "cve": "CVE-2025-4104", "method": "POST", "mode": "block", "severity": 9.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.6"}, "RULE-CVE-2025-4127-01": {"ajax_action": "kcSeoMainSettings_action", "conditions": [{"name": "ARGS:site_price_range", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4127", "description": "WP SEO Structured Data Schema <=2.7.11 Stored XSS via site_price_range parameter in kcSeoMainSettings_action AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-seo-structured-data-schema", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.7.11"}, "RULE-CVE-2025-4131-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode attributes in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in post_content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode event handler in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*<(script|svg|img|iframe)~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode script/tag injection in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4131-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gmap\\\\b[^\\\\]]*javascript:~i"}], "cve": "CVE-2025-4131", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4131", "description": "GmapsMania <=1.1 Stored XSS via [gmap] shortcode javascript: protocol in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gmapsmania", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-4133-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_title", "type": "detectXSS"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 stored XSS via unescaped post title in plugin dashboard views", "method": "POST", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-ship"}, {"name": "ARGS:postId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via postId parameter on ship page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByDate", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByDate on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sUserAuthId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sUserAuthId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sPostBlogId", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sPostBlogId on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4133-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blog2social-sched"}, {"name": "ARGS:b2sShowByNetwork", "type": "detectXSS"}], "cve": "CVE-2025-4133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4133", "description": "Blog2Social <=8.3.4 reflected XSS via b2sShowByNetwork on scheduled posts page", "method": "GET", "mode": "block", "severity": 5.4, "slug": "blog2social", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<8.4.0"}, "RULE-CVE-2025-4169-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ppc\\\\b[^\\\\]]*(?:moretxt|title)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=)(?:(?!\\\\1).)*\\\\1~i"}], "cve": "CVE-2025-4169", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4169", "description": "Posts per Cat <=1.4.2 authenticated (Contributor+) stored XSS via [ppc] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "posts-per-cat", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-4169-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ppc\\\\b[^\\\\]]*(?:moretxt|title)\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=|<iframe|javascript\\\\s*:|on(?:error|load|mouseover|click|focus)\\\\s*=)(?:(?!\\\\1).)*\\\\1~i"}], "cve": "CVE-2025-4169", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4169", "description": "Posts per Cat <=1.4.2 authenticated (Contributor+) stored XSS via [ppc] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "posts-per-cat", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-4171-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wfp\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4171", "description": "WZ Followed Posts <= 3.1.0 Stored XSS via [wfp] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "where-did-they-go-from-here", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-4171-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wfp\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4171", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4171", "description": "WZ Followed Posts <= 3.1.0 Stored XSS via [wfp] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "where-did-they-go-from-here", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-4188-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "abundatrade"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|svg|img|object|embed|form|details|math)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=abundatrade)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4188-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "reorder-simple-image-text-slider-setting"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|iframe|svg|img|object|embed|form|details|math)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-4188", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4188", "description": "Abundatrade Plugin <=1.8.01 CSRF to Stored XSS via admin settings page (page=reorder-simple-image-text-slider-setting)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "abundatrade-plugin", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.8.01"}, "RULE-CVE-2025-4203-01": {"action": "init", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-02": {"action": "init", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset parameter in members listing", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "pagination"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-03": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-04": {"ajax_action": "wpforo_get_member_template", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_member_template AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-05": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:row_count", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via row_count in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4203-06": {"ajax_action": "wpforo_get_overview", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4203", "description": "wpForo Forum <=2.4.8 unauthenticated SQL injection via offset in wpforo_get_overview AJAX", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2025-4206-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "import_delete"}, {"name": "ARGS:import", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_import_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4206-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "gh_tools"}, {"name": "ARGS:action", "type": "equals", "value": "export_delete"}, {"name": "ARGS:export", "type": "regex", "value": "~\\\\.\\\\.[/\\\\\\\\]~"}], "cve": "CVE-2025-4206", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4206", "description": "Groundhogg <=4.1.1.2 authenticated arbitrary file deletion via path traversal in process_export_delete", "method": "GET", "mode": "block", "severity": 7.2, "slug": "groundhogg", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=4.1.1.2"}, "RULE-CVE-2025-4208-01": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS:header_params", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in flat header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4208-02": {"ajax_action": "get_table_records", "conditions": [{"name": "ARGS", "type": "regex", "value": "~^\\\\s*(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|file_put_contents|file_get_contents|unlink|rmdir|move_uploaded_file|call_user_func|call_user_func_array|create_function|preg_replace_callback|array_map|array_filter|array_walk|usort|uasort|uksort|parse_str|wp_insert_user|wp_update_user|wp_delete_user|update_option|delete_option|add_option|wp_set_auth_cookie|wp_clear_auth_cookie|wp_mail|wp_remote_get|wp_remote_post|curl_exec|setcookie)\\\\s*$~i"}], "cve": "CVE-2025-4208", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4208", "description": "NEX-Forms <= 8.9.1 authenticated code execution via unsanitized call_user_func callback in array-encoded header_params", "method": "POST", "mode": "block", "severity": 6.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["code-injection", "callback-injection", "authenticated"], "target": "plugin", "versions": "<=8.9.1"}, "RULE-CVE-2025-4212-01": {"ajax_action": "alg_ajax_file_upload", "conditions": [{"name": "ARGS:alg_checkout_files_upload_uploader", "type": "exists"}], "cve": "CVE-2025-4212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4212", "description": "Checkout Files Upload for WooCommerce <=2.2.1 unauthenticated stored XSS via uploaded filename in alg_ajax_file_upload", "method": "POST", "mode": "block", "severity": 7.2, "slug": "checkout-files-upload-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-4223-01": {"ajax_action": "pagelayer_login_submit", "conditions": [{"name": "ARGS:login_url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|unload|mouseover|mouseout|mousedown|mouseup|mousemove|click|dblclick|focus|blur|change|submit|reset|select|keydown|keyup|keypress|input|beforeunload|resize|scroll|contextmenu|drag|drop|copy|cut|paste|abort|cancel|invalid|toggle|wheel|pointerdown|pointerup|pointermove|pointerover|pointerout|pointercancel)\\\\s*=|javascript\\\\s*:|data:[a-zA-Z+][a-zA-Z0-9+./-]*(?:;[^,]*)?,|vbscript\\\\s*:|%3Cscript|%253Cscript|javascript%3A|%6A%61%76%61%73%63%72%69%70%74)~i"}], "cve": "CVE-2025-4223", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4223", "description": "Pagelayer <=2.0.0 reflected XSS via login_url parameter in pagelayer_login_submit AJAX handler", "mode": "block", "severity": 4.7, "slug": "pagelayer", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-4315-01": {"ajax_action": "cwp_user_data", "conditions": [{"name": "ARGS:meta_key", "type": "regex", "value": "~^wp_(?:capabilities|user_level)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via arbitrary user meta update on cwp_user_data AJAX action (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_capabilities", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4315-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/cubewp/v1/~"}, {"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4315", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4315", "description": "CubeWP Framework <=1.1.23 authenticated privilege escalation via REST API cwp_save_user_fields updating wp_user_level", "method": "POST", "mode": "block", "severity": 8.8, "slug": "cubewp-framework", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.23"}, "RULE-CVE-2025-4334-01": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~^wpr\\\\[[^\\\\]]*\\\\]\\\\[(?:[a-z0-9_]*_)?capabilities\\\\]|^wpr\\\\[[^\\\\]]*\\\\]\\\\[wp_user_level\\\\]~i"}], "cve": "CVE-2025-4334", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4334", "description": "Simple User Registration <=6.3 unauthenticated privilege escalation via arbitrary wp_capabilities meta injection in wpr_submit_form", "method": "POST", "mode": "block", "severity": 9.8, "slug": "wp-registration", "tags": ["privilege-escalation", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=6.3"}, "RULE-CVE-2025-4367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wpdm_user_dashboard"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpdm_user_dashboard\\\\b[^\\\\]]*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4367", "description": "Download Manager <=3.3.18 Authenticated (Author+) Stored XSS via wpdm_user_dashboard shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "download-manager", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.3.18"}, "RULE-CVE-2025-4369-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "companion-auto-update"}, {"name": "ARGS:update_delay_days", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2025-4369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4369", "description": "Companion Auto Update <=3.9.2 Stored XSS via update_delay_days parameter on settings page", "method": "POST", "mode": "block", "severity": 5.5, "slug": "companion-auto-update", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2025-4369-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "companion-auto-update"}, {"name": "ARGS:cau_email", "type": "detectXSS"}], "cve": "CVE-2025-4369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4369", "description": "Companion Auto Update <=3.9.2 Stored XSS via cau_email parameter on settings page", "method": "POST", "mode": "block", "severity": 5.5, "slug": "companion-auto-update", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2025-4396-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "exists"}, {"name": "ARGS:cats", "type": "detectSQLi"}], "cve": "CVE-2025-4396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4396", "description": "Relevanssi <= 4.24.4 unauthenticated SQL injection via cats search parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "relevanssi", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.24.4"}, "RULE-CVE-2025-4396-02": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "exists"}, {"name": "ARGS:tags", "type": "detectSQLi"}], "cve": "CVE-2025-4396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4396", "description": "Relevanssi <= 4.24.4 unauthenticated SQL injection via tags search parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "relevanssi", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.24.4"}, "RULE-CVE-2025-4403-01": {"ajax_action": "dnd_codedropz_upload_wc", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~(?:^|\\\\|)[^a-zA-Z0-9_|\']*(?:ph(?:p\\\\d?|ps|t(?:ml)?|ar)|shtml|cgi|asp|aspx|jsp|jspx|cfm)(?:\\\\||$)~i"}], "cve": "CVE-2025-4403", "method": "POST", "mode": "block", "severity": 9.8, "slug": "drag-and-drop-multiple-file-upload-for-woocommerce", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-4405-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[randomimage\\\\b[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:|data\\\\s*:|<script|(?:^|[\\\\s<])on[a-z0-9_:-]+\\\\s*=)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4405", "description": "Hot Random Image <=1.9.2 Stored XSS via link attribute in randomimage shortcode (classic editor post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "hot-random-image", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-4405-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~hot-random-image[^>]*[\\"\']link[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:j\\\\s*a\\\\s*v\\\\s*a\\\\s*s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t\\\\s*:|data\\\\s*:|<script|(?:^|[\\\\s<])on[a-z0-9_:-]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4405", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4405", "description": "Hot Random Image <=1.9.2 Stored XSS via link attribute in Gutenberg block (REST API post save)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "hot-random-image", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-4429-01": {"ajax_action": "gearside_search_theme_files", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|blur|submit|change|input|keydown|keyup|keypress) *=|<script[ />]|javascript *:)~i"}], "cve": "CVE-2025-4429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4429", "description": "Gearside Developer Dashboard <=1.0.72 unauthenticated reflected XSS via data parameter in gearside_search_theme_files AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "gearside-developer-dashboard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.72"}, "RULE-CVE-2025-4473-01": {"ajax_action": "fed_ajax_request", "conditions": [{"name": "ARGS:fed_action_hook", "type": "regex", "value": "~^FEDEmail@(update|update_smtp)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4473", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": ">=1.5.10 <=2.2.7"}, "RULE-CVE-2025-4474-01": {"ajax_action": "fed_admin_setting_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4474", "method": "POST", "mode": "block", "severity": 8.8, "slug": "frontend-dashboard", "target": "plugin", "versions": "<=2.2.7"}, "RULE-CVE-2025-4479-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:before_label|after_label)[^:]*:\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*?(?:<\\\\s*(?:script|iframe|svg|object|embed|math)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keyup|keydown|keypress|animationend|toggle)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4479", "description": "ElementsKit Lite <=3.5.2 Stored XSS via Image Comparison widget before/after labels through Elementor editor save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elementskit-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4523-01": {"ajax_action": "admin_donor_profile_view", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4523", "description": "IDonate <=2.1.9 missing authorization on admin_donor_profile_view AJAX handler exposes sensitive user data", "mode": "block", "severity": 6.5, "slug": "idonate", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=2.1.9"}, "RULE-CVE-2025-4579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-content-security-policy/v1/report(/|\\\\?|&|$)~"}, {"name": "ARGS:csp-report", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|iframe|object|embed|body|video|audio|form|base|style|meta|details|math)[\\\\s/>]|on(?:load|error|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4579", "description": "WP Content Security Plugin <=2.3 unauthenticated Stored XSS via blocked-uri and effective-directive in CSP report REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-content-security-policy", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-4593-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:[?#]|$)~i"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/posts(?:/[0-9]+)?/?(?:[?#]|$)|/(?:index\\\\.php)?\\\\?(?:[^#&]*&)*rest_route=/wp/v2/posts(?:/[0-9]+)?/?(?:[&#]|$))~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rp_user_data\\\\b[^\\\\]]*\\\\bfield\\\\s*=\\\\s*([\\"\']?)(?:user_email|user_login)\\\\1(?=[\\\\s/\\\\]]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4593", "description": "WP Register Profile With Shortcode <=3.6.2 sensitive information exposure via rp_user_data shortcode in REST post content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-register-profile-with-shortcode", "tags": ["sensitive-data-exposure", "shortcode", "information-disclosure"], "target": "plugin", "versions": "<=3.6.2"}, "RULE-CVE-2025-4594-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (post editor vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4594-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trn-ladder-registration-button[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4594", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4594", "description": "Tournamatch <=4.6.1 Stored XSS via trn-ladder-registration-button shortcode attribute in post content (REST API vector)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tournamatch", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.6.1"}, "RULE-CVE-2025-4597-01": {"ajax_action": "woo_slide_pro_delete_draft_preview", "conditions": [{"type": "missing_capability", "value": "delete_posts"}], "cve": "CVE-2025-4597", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4597", "description": "Woo Slider Pro <=1.12 missing authorization on woo_slide_pro_delete_draft_preview AJAX action allows Subscriber+ arbitrary post deletion", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woo-slider-pro-drag-drop-slider-builder-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "arbitrary-post-deletion"], "target": "plugin", "versions": "<=1.12"}, "RULE-CVE-2025-4602-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file filename path traversal", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4602-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "get_file"}, {"name": "ARGS:entity_type", "type": "regex", "value": "~^(?:\\\\.|\\\\.\\\\.)$|(?:\\\\.\\\\.[/\\\\\\\\])~"}], "cve": "CVE-2025-4602", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4602", "description": "Store Manager Connector <=1.2.5 unauthenticated arbitrary file read via get_file entity_type directory escape", "mode": "block", "severity": 7.5, "slug": "store-manager-connector", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-4610-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmem_user_memberships\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|details|embed|object|video|audio|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|focusin|pointerover)\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-4610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4610", "description": "WP-Members <=3.5.2 Stored XSS via [wpmem_user_memberships] shortcode attributes in Classic Editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4610-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmem_user_memberships\\\\b[^\\\\]]*(?:<\\\\s*(?:script|img|svg|iframe|details|embed|object|video|audio|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|toggle|focusin|pointerover)\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-4610", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4610", "description": "WP-Members <=3.5.2 Stored XSS via [wpmem_user_memberships] shortcode attributes in REST API post creation/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2025-4611-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-4611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[slim_seo_breadcrumbs\\\\s[^\\\\]]*(?:separator|label_home|label_search|label_404)\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/][^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-4611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4611", "description": "Slim SEO <=4.5.3 Stored XSS via slim_seo_breadcrumbs shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slim-seo", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.5.3"}, "RULE-CVE-2025-46244-01": {"ajax_action": "dsalv_save_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-02": {"ajax_action": "dsalv_add_new_variation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "method": "POST", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46244-03": {"ajax_action": "dsalv_searchalltags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-46244", "mode": "block", "severity": 9.8, "slug": "linked-variation", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-46254-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:vcv-settings", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-46254", "description": "Visual Composer Website Builder <=45.10.0 contributor+ stored XSS via vcv-settings element attributes", "method": "POST", "mode": "block", "severity": 6.5, "slug": "visualcomposer", "target": "plugin", "versions": "<=45.10.0"}, "RULE-CVE-2025-46490-01": {"ajax_action": "ccpuz_save_crossword_mce_from", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-46490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-46490", "description": "Crossword Compiler Puzzles <=5.2 subscriber+ arbitrary file upload via ccpuz_save_crossword_mce_from AJAX handler", "mode": "block", "severity": 9.9, "slug": "crossword-compiler-puzzles", "tags": ["arbitrary-file-upload", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=5.2"}, "RULE-CVE-2025-4652-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~broadstreet/Broadstreet/Vendor/broadstreet-partner/index\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:next", "type": "detectXSS"}], "cve": "CVE-2025-4652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4652", "description": "Broadstreet <= 1.51.7 Reflected XSS via unsanitized next parameter in broadstreet-partner index.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "broadstreet", "tags": ["xss", "reflected-xss", "unauthenticated", "direct-file-access"], "target": "plugin", "versions": "<=1.51.7"}, "RULE-CVE-2025-4666-01": {"ajax_action": "zpAccountsViaAJAX", "conditions": [{"name": "ARGS:nickname", "type": "detectXSS"}], "cve": "CVE-2025-4666", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4666", "description": "Zotpress <=7.3.15 Stored XSS via nickname parameter in zpAccountsViaAJAX AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "zotpress", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.3.15"}, "RULE-CVE-2025-4667-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in post_content (post.php vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4667-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ssa_(?:admin_upcoming|past|upcoming)_appointments\\\\b[^\\\\]]*(?:no_results_message|details_link_label)\\\\s*=\\\\s*\\"[^\\"]*<~i"}], "cve": "CVE-2025-4667", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4667", "description": "Simply Schedule Appointments <=1.6.8.30 Stored XSS via shortcode attributes in content (REST API vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simply-schedule-appointments", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.6.8.30"}, "RULE-CVE-2025-4669-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS", "type": "regex", "value": "~\\\\[wpbc\\\\b[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<script)~i"}], "cve": "CVE-2025-4669", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4669", "description": "WP Booking Calendar <=10.11.1 Stored XSS via wpbc shortcode attributes in post content (post.php injection)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "booking", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=10.11.1"}, "RULE-CVE-2025-4670-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4670-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[edd_receipt\\\\b[^\\\\]]*error\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*<[^>]+>[^\\\\\\"\']*[\\\\\\"\']~i"}], "cve": "CVE-2025-4670", "method": "PATCH", "mode": "block", "severity": 5.4, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<=3.3.8.1"}, "RULE-CVE-2025-4671-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode operator attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*pre\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode pre attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*post\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode post attribute", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[compare\\\\b[^\\\\]]*operator\\\\s*=\\\\s*[\\"\'][^\\"\']*<\\\\s*/?\\\\s*[a-z!][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [compare] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4671-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[user_meta\\\\b[^\\\\]]*(?:pre|post)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4671", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4671", "description": "Profile Builder <=3.13.8 Stored XSS via [user_meta] shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.13.8"}, "RULE-CVE-2025-4672-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta GET endpoint reading sensitive user meta (wp_capabilities, session_tokens)", "method": "GET", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta POST endpoint creating sensitive user meta (wp_capabilities)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta PUT endpoint updating sensitive user meta (wp_capabilities)", "method": "PUT", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4672-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/offsprout/v2/usermeta/(?:wp[a-z0-9]*_(?:capabilities|user_level)|session_tokens)/\\\\d+~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-4672", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4672", "description": "Offsprout Page Builder <=2.15.2 privilege escalation via REST usermeta DELETE endpoint removing sensitive user meta (wp_capabilities)", "method": "DELETE", "mode": "block", "severity": 8.8, "slug": "offsprout-page-builder", "tags": ["improper-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.15.2"}, "RULE-CVE-2025-4682-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/slider"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Slider block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4682-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:content", "type": "contains", "value": "essential-blocks/post-carousel"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:error|load|mouseover|focus|click|animationstart|animationend|transitionend|pointerenter)\\\\s*=|<\\\\s*script[\\\\s>]|<\\\\s*svg\\\\b[^>]*(?:on\\\\w+\\\\s*=|href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:|xlink:href\\\\s*=\\\\s*[\'\\\\\\"]?javascript:)|<\\\\s*img[^>]+onerror|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4682", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4682", "description": "Essential Blocks <=5.4.0 Stored XSS via Post Carousel block HTML attributes in wp-admin post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2025-4685-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\bon(?:error|load|mouse(?:over|out|enter)|focus|blur|click|change|submit|key(?:up|down|press))\\\\s*=~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via event handler injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4685-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "wp:gutentor"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|applet)\\\\b~i"}], "cve": "CVE-2025-4685", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4685", "description": "Gutentor <= 3.4.8 Stored XSS via dangerous tag injection in block attributes (admin post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutentor", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2025-4691-01": {"ajax_action": "view_request_details", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-02": {"ajax_action": "view_request_details_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_car booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-03": {"ajax_action": "view_request_details_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_request_details_restau booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-04": {"ajax_action": "view_hotel_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_hotel_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-05": {"ajax_action": "view_car_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_car_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-06": {"ajax_action": "view_restau_requests", "conditions": [{"name": "ARGS:stat", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 IDOR - unauthorized view_restau_requests booking data disclosure", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["idor", "missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-07": {"ajax_action": "approve_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-08": {"ajax_action": "decline_cancel_request", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-09": {"ajax_action": "approve_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-10": {"ajax_action": "decline_cancel_request_car", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_car", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-11": {"ajax_action": "approve_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on approve_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-4691-12": {"ajax_action": "decline_cancel_request_restau", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4691", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4691", "description": "eaSYNC Booking <=1.3.21 missing authorization on decline_cancel_request_restau", "mode": "block", "severity": 5.3, "slug": "easync-booking", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.3.21"}, "RULE-CVE-2025-47452-01": {"ajax_action": "wpvr_file_import", "conditions": [{"name": "FILES:wpvr_import_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-47452", "description": "WP VR <=8.5.26 authenticated arbitrary file upload via wpvr_file_import AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "wpvr", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=8.5.26"}, "RULE-CVE-2025-47461-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:sfwc_nonce_frontend_edit_subaccount_form", "type": "exists"}, {"name": "ARGS:user", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47461-02": {"ajax_action": "sfwc_frontend_edit_subaccount", "conditions": [{"name": "ARGS:ajax_user_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-47461", "method": "POST", "mode": "block", "severity": 8.8, "slug": "subaccounts-for-woocommerce", "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2025-47549-01": {"ajax_action": "beaf_options_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 authenticated arbitrary file upload via beaf_options_save AJAX handler (missing authorization)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47549-02": {"ajax_action": "beaf_options_save", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}], "cve": "CVE-2025-47549", "description": "BEAF <=4.6.10 arbitrary PHP file upload via beaf_options_save AJAX handler (dangerous file type)", "mode": "block", "severity": 9.1, "slug": "beaf-before-and-after-gallery", "target": "plugin", "versions": "<=4.6.10"}, "RULE-CVE-2025-47588-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules(?:/|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API POST /awdp/v1/rules/ in aco-woo-dynamic-pricing <= 4.5.9. Prevents PHP callable names from being stored as rule data that later reaches call_user_func sinks.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47588-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/awdp/v1/rules/\\\\d+(?:/|$|\\\\?)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[\\"\':,\\\\s])(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace_callback|call_user_func|call_user_func_array|create_function|include|require|include_once|require_once|file_get_contents|file_put_contents|fopen|phpinfo|unserialize)(?:[\\"\':,\\\\s(]|$)~i"}], "cve": "CVE-2025-47588", "description": "Block code injection via REST API PUT /awdp/v1/rules/{id} in aco-woo-dynamic-pricing <= 4.5.9. Covers the update path for the same stored-callback code injection vector.", "mode": "block", "severity": 9.1, "slug": "aco-woo-dynamic-pricing", "target": "plugin", "versions": "<=4.5.9"}, "RULE-CVE-2025-47601-01": {"ajax_action": "maxi_get_option", "conditions": [{"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47601", "method": "POST", "mode": "block", "severity": 8.8, "slug": "maxi-blocks", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2025-47636-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (classic editor)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47636-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[catlist\\\\b[^\\\\]]*template\\\\s*=\\\\s*[\'\\"]?[^\'\\"\\\\]]*(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2025-47636", "description": "List Category Posts <=0.91.0 contributor+ PHP local file inclusion via catlist shortcode template attribute (block editor / REST API)", "mode": "block", "severity": 7.5, "slug": "list-category-posts", "target": "plugin", "versions": "<=0.91.0"}, "RULE-CVE-2025-47688-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/hide-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47688-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/file-manager-advanced/v1/minimize-maximize-banner(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47688", "method": "POST", "mode": "block", "severity": 9.8, "slug": "file-manager-advanced", "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-47690-01": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-02": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-05": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-47690-06": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-47690", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-leads-builder-any-crm", "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-4783-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:elements", "type": "regex", "value": "~exad.?countdown~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:(?:<|\\\\\\\\u003[cC]|\\\\\\\\x3[cC])\\\\s*(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|isindex|form|button|textarea|select|base|link|style|applet)|\\\\bon(?:mouse(?:over|out|enter|move|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|drag|drop|pointer|touch|animate|transition|toggle|resize|scroll|wheel|(?:before)?input|play|seek|ended|abort|invalid|select|cut|copy|paste|contextmenu|reset|unload|beforeunload|pageshow|popstate|hashchange|message|storage|online|offline|(?:before)?print|readystatechange|DOMContentLoaded)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4783", "description": "Exclusive Addons for Elementor <=2.7.9.1 Stored XSS via Countdown Timer widget settings in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=2.7.9.1"}, "RULE-CVE-2025-4783-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(/|\\\\?|$)~"}, {"name": "ARGS:elements", "type": "regex", "value": "~exad.?countdown~i"}, {"name": "ARGS:elements", "type": "regex", "value": "~(?:(?:<|\\\\\\\\u003[cC]|\\\\\\\\x3[cC])\\\\s*(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|isindex|form|button|textarea|select|base|link|style|applet)|\\\\bon(?:mouse(?:over|out|enter|move|down|up)|error|load|click|focus|blur|change|submit|key(?:down|up|press)|drag|drop|pointer|touch|animate|transition|toggle|resize|scroll|wheel|(?:before)?input|play|seek|ended|abort|invalid|select|cut|copy|paste|contextmenu|reset|unload|beforeunload|pageshow|popstate|hashchange|message|storage|online|offline|(?:before)?print|readystatechange|DOMContentLoaded)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-4783", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4783", "description": "Exclusive Addons for Elementor <=2.7.9.1 Stored XSS via Countdown Timer widget settings in Elementor REST API save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.7.9.1"}, "RULE-CVE-2025-4799-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "download-manager.php"}, {"name": "ARGS:file_name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^/|^[A-Za-z]:)~"}], "cve": "CVE-2025-4799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799", "description": "WP-DownloadManager <=1.68.10 authenticated (Administrator+) arbitrary file deletion via absolute path traversal in file_name parameter on download-manager.php admin page", "mode": "block", "severity": 7.2, "slug": "wp-downloadmanager", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.68.10"}, "RULE-CVE-2025-4799-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "download-options.php"}, {"name": "ARGS:download_path", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|^(?!/var/www/html/wp-content|/home/[^/]+/[^/]+/wp-content)[/])~"}], "cve": "CVE-2025-4799", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4799", "description": "WP-DownloadManager <=1.68.10 authenticated (Administrator+) download_path manipulation enabling arbitrary file deletion chain on download-options.php admin page", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-downloadmanager", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.68.10"}, "RULE-CVE-2025-4803-01": {"action": "admin_init", "conditions": [{"name": "ARGS:posttypes", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-4803", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4803", "description": "Glossary by WPPedia <=1.3.0 authenticated (Administrator+) PHP Object Injection via posttypes parameter deserialization", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wppedia", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-48101-01": {"ajax_action": "ctct_form_designer", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via ctct_form_designer AJAX handler", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48101-02": {"ajax_action": "ctct_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via ctct_ajax AJAX handler", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48101-03": {"action": "template_redirect", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2025-48101", "description": "Constant Contact for WordPress <=4.1.1 unauthenticated PHP object injection via template_redirect form processing", "mode": "block", "severity": 8.8, "slug": "constant-contact-api", "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2025-48140-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_change\\\\s[^\\\\]]*base\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:[;`$(){}|<>]|phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert|preg_replace\\\\s*.*e)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_change shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48140-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "/(?:wp-admin/(?:post\\\\.php|post-new\\\\.php)|wp-json/|xmlrpc\\\\.php)~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[metalpriceapi_carat\\\\b[^\\\\]]*\\\\bbase\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<\\\\?(?:php|=)|\\\\b(?:phpinfo|eval|system|exec|passthru|shell_exec|popen|proc_open|assert)\\\\s*\\\\(|\\\\bpreg_replace\\\\s*\\\\([^)]*/e|`[^`]+`|\\\\$\\\\{?[_A-Za-z])[^\\"\'\\\\]]*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-48140", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-48140", "description": "MetalPriceAPI <=1.1.4 contributor+ RCE via code injection in metalpriceapi_carat shortcode base attribute", "method": "POST", "mode": "block", "severity": 9.9, "slug": "metalpriceapi", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-48142-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-03": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "POST", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-48142-04": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/bookify/v1/(?:add-staff|update-staff|delete-staff|staffs)(?:/|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-48142", "method": "PUT", "mode": "block", "slug": "bookify", "target": "plugin", "versions": "<=1.0.9"}, "RULE-CVE-2025-49076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:theplus_clients_url", "type": "exists"}, {"name": "ARGS:theplus_clients_url", "type": "regex", "value": "~^\\\\s*(javascript|data|vbscript)\\\\s*:~i"}], "cve": "CVE-2025-49076", "method": "POST", "mode": "block", "severity": 6.5, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.2.7"}, "RULE-CVE-2025-49235-01": {"ajax_action": "get_installed_template", "conditions": [{"name": "ARGS:template_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via template_id in get_installed_template AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49235-02": {"ajax_action": "template_category", "conditions": [{"name": "ARGS:category", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49235", "description": "Rometheme for Elementor <=1.6.0 stored XSS via category in template_category AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2025-49244-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - Reflected XSS via su_generator_preview AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49244-02": {"ajax_action": "su_generator_settings", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|style\\\\s*=\\\\s*[\\"\'][^\\"\']*expression\\\\s*\\\\()|<\\\\s*(?:script|iframe|object|embed|svg|math|form|base|link|meta)\\\\b~i"}], "cve": "CVE-2025-49244", "description": "Shortcodes Ultimate <= 7.3.5 - XSS/Code Execution via su_generator_settings AJAX (shortcode param)", "mode": "block", "severity": 6.5, "slug": "shortcodes-ultimate", "target": "plugin", "versions": "<=7.3.5"}, "RULE-CVE-2025-49359-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49359-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49359", "description": "shieldgroup theme <= 2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shieldgroup", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.13"}, "RULE-CVE-2025-49360-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49360-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49360", "description": "militarology theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "militarology", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49361", "description": "mamita theme <= 1.0.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mamita", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.9"}, "RULE-CVE-2025-49362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49362", "description": "gracioza theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gracioza", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-49363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49363", "description": "kings-queens theme <= 1.1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kings-queens", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.16"}, "RULE-CVE-2025-49364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49364", "description": "ludos-paradise theme <= 2.1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ludos-paradise", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1.3"}, "RULE-CVE-2025-49365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49365", "description": "jack-well theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jack-well", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-49366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49366", "description": "hanani theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hanani", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2025-49367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49367", "description": "monyxi theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "monyxi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-49368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49368", "description": "palladio theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palladio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-49369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49369", "description": "lettuce theme <= 1.1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lettuce", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.7"}, "RULE-CVE-2025-49370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49370", "description": "lymcoin theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lymcoin", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-49371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49371", "description": "strux theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "strux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-49408-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/templately/v1/settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49408", "description": "Templately <=3.2.7 sensitive data exposure via unauthenticated access to REST API settings endpoint", "mode": "block", "severity": 10.0, "slug": "templately", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2025-4943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document/save~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in Elementor REST document save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in wp-admin post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-4943-03": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:javascript|vbscript)\\\\s*:~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-4943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-4943", "description": "LA-Studio Element Kit for Elementor <=1.5.2 Stored DOM XSS via data-lakit-element-link javascript: URI in elementor_ajax save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "lastudio-element-kit", "tags": ["xss", "stored-xss", "elementor"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2025-49924-01": {"ajax_action": "wwpEditWholesaleRole", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49924", "description": "Wholesale Suite \\u2013 WooCommerce Wholesale Prices <=2.2.4.2 privilege escalation via wwpEditWholesaleRole AJAX action", "method": "POST", "mode": "block", "severity": 7.3, "slug": "woocommerce-wholesale-prices", "tags": ["privilege-escalation", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.4.2"}, "RULE-CVE-2025-49941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49941", "description": "glamchic theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "glamchic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-49942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49942", "description": "gardis theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gardis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2025-49943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-49943", "description": "femme theme <= 1.3.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "femme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-49950-01": {"ajax_action": "wc_billingo_generate_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_generate_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49950-02": {"ajax_action": "wc_billingo_storno_invoice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-49950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49950", "description": "Official Integration for Billingo <=4.2.5 missing authorization on wc_billingo_storno_invoice AJAX action allowing authenticated privilege escalation", "method": "POST", "mode": "block", "severity": 7.3, "slug": "billingo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2025-49960-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_key", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_key)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-49960-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "leadbi_update_options"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:leadbi_api_secret", "type": "regex", "value": "~<\\\\s*(?:script|svg|img|details|iframe|object|embed|body|video|audio|input|marquee|a|form|link|meta|style|base|html|button|frame|frameset|applet|xml|template)\\\\b|on(?:error|load|toggle|click|mouseover|focus|animationstart|animationend|animationiteration|mouseenter|mouseleave|pointerover|focusin|focusout|drag|dragstart|dragend|submit|change|input|keydown|keyup|keypress|paste|copy|cut|select|wheel|scroll|resize|abort|blur)\\\\s*=|javascript:|data:\\\\s*text/html|vbscript:|expression\\\\s*\\\\(~i"}], "cve": "CVE-2025-49960", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-49960", "description": "LeadBI Plugin for WordPress <=1.7 stored XSS via unsanitized plugin option update (leadbi_api_secret)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "leadbi", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2025-50003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-50003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-50003", "description": "amuli theme <= 2.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amuli", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3.0"}, "RULE-CVE-2025-5018-01": {"ajax_action": "hs_update_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_update_ai_chat_settings AJAX handler allows authenticated users to overwrite AI chat configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-02": {"ajax_action": "hive_lite_support_get_all_binbox", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hive_lite_support_get_all_binbox AJAX handler allows authenticated users to read sensitive inbox configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5018-03": {"ajax_action": "hs_get_ai_chat_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5018", "description": "Hive Support <=1.2.5 missing authorization on hs_get_ai_chat_settings AJAX handler allows authenticated users to read OpenAI API key and AI configuration", "method": "POST", "mode": "block", "severity": 7.1, "slug": "hive-support", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5035-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5035-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~title\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5035", "description": "Easy FancyBox <=2.3.15 stored XSS via unsanitized anchor title attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "easy-fancybox", "tags": ["xss", "stored-xss", "contributor-plus", "rest-api"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2025-5058-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_image"}, {"name": "ARGS:image_id", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5058-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:connector", "type": "equals", "value": "bridge"}, {"name": "ARGS:task", "type": "equals", "value": "set_file"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm)~i"}], "cve": "CVE-2025-5058", "method": "POST", "mode": "block", "severity": 9.8, "slug": "store-manager-connector", "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-5071-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/messages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5071-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp/v1/sse(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5071", "method": "GET", "mode": "block", "severity": 8.8, "slug": "ai-engine", "target": "plugin", "versions": ">=2.8.0 <=2.8.3"}, "RULE-CVE-2025-5082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~attachmentEditIframe\\\\.php~"}, {"name": "ARGS:attachment_id", "type": "detectXSS"}], "cve": "CVE-2025-5082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5082", "description": "WP Attachments <=5.0.12 reflected XSS via attachment_id parameter in attachmentEditIframe.php", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-attachments", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.0.12"}, "RULE-CVE-2025-5083-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_options"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via plugin settings (wpgov_at_options) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5083-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "wpgov_at_option_groups"}, {"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|body|marquee|input|button|select|textarea|form|meta|link|style|base)[\\\\s/>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5083", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5083", "description": "Amministrazione Trasparente <=9.0.2 authenticated stored XSS via group configuration (wpgov_at_option_groups) print_r output", "method": "POST", "mode": "block", "severity": 5.5, "slug": "amministrazione-trasparente", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=9.0.2"}, "RULE-CVE-2025-5084-01": {"ajax_action": "asr_filter_posts", "conditions": [{"name": "ARGS:argsArray[read_more_text]", "type": "regex", "value": "~<[^>]*[\\\\s/]on\\\\w+\\\\s*=|<\\\\s*(?:script|iframe|object|embed|svg|math|base|link|meta|style|form|input|select|textarea|details|body|marquee)\\\\b|javascript\\\\s*:~i"}], "cve": "CVE-2025-5084", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5084", "description": "Post Grid Master <=3.4.13 reflected XSS via argsArray[read_more_text] in asr_filter_posts AJAX handler", "mode": "block", "severity": 6.1, "slug": "ajax-filter-posts", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.4.13"}, "RULE-CVE-2025-5096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_caption]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_caption table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_title]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_title table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_footer]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_footer table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "contains", "value": "tablepress_"}, {"name": "ARGS:tablepress[options][datatables_s_content_padding]", "type": "detectXSS"}], "cve": "CVE-2025-5096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5096", "description": "TablePress <=3.1.2 DOM-based stored XSS via datatables_s_content_padding table option", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "dom-based-xss"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2025-5116-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_html(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_html REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_query(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_query REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wppic/v1/get_data(?:/|\\\\?|&|$)~"}, {"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 reflected XSS via containerid parameter on wppic/v1/get_data REST endpoint", "method": "GET", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "reflected-xss", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5116-04": {"ajax_action": "async_wppic_shortcode_content", "conditions": [{"name": "ARGS:containerid", "type": "regex", "value": "~[\\"\'<>]|on[a-zA-Z]+\\\\s*=~i"}], "cve": "CVE-2025-5116", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5116", "description": "WP Plugin Info Card <=5.3.1 stored XSS via containerid parameter in async shortcode AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-plugin-info-card", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.3.1"}, "RULE-CVE-2025-5117-01": {"action": "init", "conditions": [{"name": "ARGS:iv-submit-listing", "type": "equals", "value": "register"}, {"name": "ARGS:payment_gateway", "type": "equals", "value": "paypal"}, {"name": "ARGS:package_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5117-02": {"action": "init", "conditions": [{"name": "ARGS:post_type", "type": "equals", "value": "iv_payment"}, {"name": "ARGS:property_package_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|admin)(?:\\\\s|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5117", "method": "POST", "mode": "block", "severity": 8.8, "slug": "property", "target": "plugin", "versions": ">=1.0.5 <=1.0.6"}, "RULE-CVE-2025-5122-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5122-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/wp/v2/posts/\\\\d+(?:/|\\\\?|$)|(?:^|[?&])rest_route=/wp/v2/posts/\\\\d+(?:/|[?&]|$))~"}, {"name": "ARGS:content", "type": "regex", "value": "~map-block-leaflet[/a-z-]*[^>]*(?:javascript\\\\s*:|vbscript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2025-5122", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5122", "description": "Map Block Leaflet <=3.2.1 Stored XSS via block attributes in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "map-block-leaflet", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.2.1"}, "RULE-CVE-2025-5144-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "tribe_events"}, {"name": "ARGS:post_content", "type": "regex", "value": "~data-(?:date[a-z-]*|provide)\\\\s*=[^>]*(?:<\\\\s*script|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5144", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5144", "description": "The Events Calendar <=6.13.2 Stored XSS via data-date-* attributes in event post content (wp-admin post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-events-calendar", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=6.13.2"}, "RULE-CVE-2025-5234-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post create/update", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in REST API post update (PUT)", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5234-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenverse-news/[^}]*\\"elementId\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|>|\\\\\\\\\\\\\\\\|\\\\\\\\\\")~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5234", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5234", "description": "Gutenverse News <=1.0.4 Authenticated (Contributor+) Stored XSS via elementId in classic editor post.php", "method": "POST", "mode": "block", "severity": 5.4, "slug": "gutenverse-news", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-5237-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[brid[^\\\\]]*(?:width|height)\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|&#x?0*3c;|&#x?0*3e;|&#x?0*22;|&#x?0*27;|&#0*60;|&#0*62;|&#0*34;|&#0*39;)~i"}], "cve": "CVE-2025-5237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5237", "description": "Target Video Easy Publish <=3.8.5 Stored XSS via shortcode width/height attribute breakout in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brid-video-easy-publish", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.8.5"}, "RULE-CVE-2025-5237-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[brid[^\\\\]]*(?:width|height)\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|&#x?0*3c;|&#x?0*3e;|&#x?0*22;|&#x?0*27;|&#0*60;|&#0*62;|&#0*34;|&#0*39;)~i"}], "cve": "CVE-2025-5237", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5237", "description": "Target Video Easy Publish <=3.8.5 Stored XSS via shortcode attribute breakout through REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brid-video-easy-publish", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.8.5"}, "RULE-CVE-2025-5239-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "dfs_template"}, {"name": "ARGS:post_content", "type": "regex", "value": "~domain-for-sale-template[^}]*className[\\"\']?\\\\s*[:=]\\\\s*\\"(?:\\\\\\\\.|[^\\"\\\\\\\\])*(?:<|>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5239", "description": "Domain For Sale <=3.0.10 Authenticated (Contributor+) Stored XSS via class_name parameter in Gutenberg block post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "domain-for-sale", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.0.10"}, "RULE-CVE-2025-5240-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCita(?:MeetingScheduler|ContactForm)[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaMeetingScheduler/vCitaContactForm", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5240-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[vCitaSchedulingCalendar[^\\\\]]*type\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).)*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript:)~is"}], "cve": "CVE-2025-5240", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5240", "description": "CRM and Lead Management by vcita <=2.7.5 Stored XSS via type shortcode attribute in vCitaSchedulingCalendar", "method": "POST", "mode": "block", "severity": 6.4, "slug": "crm-customer-relationship-management-by-vcita", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-5258-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:\\\\[conf_scheduler[^\\\\]]*className\\\\s*=\\\\s*[\\"\'][^\\"\']*|conf-scheduler/display[^}]*className[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*)(?:[\\"\']\\\\s*on\\\\w+\\\\s*=|<[a-z/])~i"}], "cve": "CVE-2025-5258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5258", "description": "Conference Scheduler <=2.5.1 Stored XSS via className attribute in shortcode/block (classic editor vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "conference-scheduler", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-5259-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:minimal-share-buttons|msb_share)[^>\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:<script|on[a-z]{2,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5259", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5259", "description": "Minimal Share Buttons <=1.7.3 Stored XSS via unescaped align block attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "minimal-share-buttons", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-5259-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:minimal-share-buttons|msb_share)[^>\\\\]]{0,200}align\\\\s*\\"?\\\\s*:\\\\s*\\"[^\\"\\\\\\\\]{0,20}[^\\\\]]{0,80}(?:<script|on[a-z]{2,}\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5259", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5259", "description": "Minimal Share Buttons <=1.7.3 Stored XSS via unescaped align block attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "minimal-share-buttons", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=1.7.3"}, "RULE-CVE-2025-52745-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-52745", "description": "farmagrico theme <= 1.3.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "farmagrico", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-52745-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-52745", "description": "farmagrico theme <= 1.3.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "farmagrico", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.11"}, "RULE-CVE-2025-52758-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zippy"}, {"name": "FILES:zippy_file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$|(?:^|[\\\\/])\\\\.htpasswd$~i"}], "cve": "CVE-2025-52758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-52758", "description": "Zippy <=1.7.0 authenticated arbitrary file upload via admin page file handler", "mode": "block", "severity": 9.1, "slug": "zippy", "tags": ["arbitrary-file-upload", "authenticated"], "target": "plugin", "versions": "<=1.7.0"}, "RULE-CVE-2025-52768-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-52768", "description": "faith-hope theme <= 2.13.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "faith-hope", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.13.0"}, "RULE-CVE-2025-52768-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-52768", "description": "faith-hope theme <= 2.13.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "faith-hope", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.13.0"}, "RULE-CVE-2025-52815-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-52815", "description": "citygov theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "citygov", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-52815-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-52815", "description": "citygov theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "citygov", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-5282-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-travel-engine/v2/trips/\\\\d+/packages/\\\\d+~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-5282", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5282", "description": "WP Travel Engine <=6.5.1 unauthenticated arbitrary post deletion via REST API delete_package endpoint", "method": "DELETE", "mode": "block", "severity": 7.5, "slug": "wp-travel-engine", "tags": ["missing-authorization", "unauthenticated", "rest-api", "arbitrary-post-deletion"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-5282-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-travel-engine/v2/trips/\\\\d+/packages/\\\\d+~"}, {"name": "ARGS:_method", "type": "regex", "value": "~^DELETE$~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-5282", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5282", "description": "WP Travel Engine <=6.5.1 unauthenticated arbitrary post deletion via REST API delete_package with POST method override", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-travel-engine", "tags": ["missing-authorization", "unauthenticated", "rest-api", "arbitrary-post-deletion", "method-override"], "target": "plugin", "versions": "<=6.5.1"}, "RULE-CVE-2025-52824-01": {"ajax_action": "update_event_cost_from_package", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "update_event_cost_from_package"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-52824", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mobile-dj-manager", "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2025-52825-01": {"ajax_action": "wcp_rem_save_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wcp_rem_save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-52825", "method": "POST", "mode": "block", "severity": 8.8, "slug": "real-estate-manager", "target": "plugin", "versions": "<=7.3"}, "RULE-CVE-2025-52825-02": {"ajax_action": "wcp_rem_save_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wcp_rem_save_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-52825", "method": "GET", "mode": "block", "severity": 8.8, "slug": "real-estate-manager", "target": "plugin", "versions": "<=7.3"}, "RULE-CVE-2025-5286-01": {"ajax_action": "bt_bb_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5286", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5286", "description": "Bold Builder <=5.3.6 Stored XSS via additional_settings in bt_bb_content_slider shortcode (bt_bb_get_html AJAX)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-5286-02": {"ajax_action": "bt_bb_fe_get_html", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5286", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5286", "description": "Bold Builder <=5.3.6 Stored XSS via additional_settings in bt_bb_content_slider shortcode (bt_bb_fe_get_html AJAX)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-5286-03": {"ajax_action": "bt_bb_fe_save", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~additional_settings\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<script|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5286", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5286", "description": "Bold Builder <=5.3.6 Stored XSS via additional_settings in bt_bb_content_slider shortcode (bt_bb_fe_save AJAX)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bold-page-builder", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-5290-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~borderless.elementor.(?:progress.bar|circular.progress.bar|semi.circular.progress.bar)~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\\\\\\\"|\\")widgetType(?:\\\\\\\\\\"|\\")\\\\s*:\\\\s*(?:\\\\\\\\\\"|\\")borderless\\\\.elementor\\\\.(?:progress\\\\.bar|circular\\\\.progress\\\\.bar|semi\\\\.circular\\\\.progress\\\\.bar)(?:\\\\\\\\\\"|\\")[\\\\s\\\\S]{0,2000}?(?:\\\\\\\\\\"|\\")title(?:\\\\\\\\\\"|\\")\\\\s*:\\\\s*(?:\\\\\\\\\\"|\\")[^\\\\\\\\\\"]*(?:<\\\\s*script\\\\b|<\\\\s*img\\\\b[^>]*\\\\bonerror\\\\s*=|<\\\\s*svg\\\\b[^>]*\\\\bonload\\\\s*=|<\\\\s*iframe\\\\b|\\\\bsrc\\\\s*=\\\\s*[\'\\\\\\"]?\\\\s*javascript\\\\s*:|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseenter|change|submit|keydown|keyup|keypress|dblclick|contextmenu|wheel|pointerdown|animationend|toggle|resize)\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-5290", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5290", "description": "Borderless \\u2013 Elementor Addons and Templates <=1.7.1 Authenticated (Contributor+) Stored XSS via Elementor widget title settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "borderless", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5304-01": {"ajax_action": "wpnb_pto_new_users_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-02": {"ajax_action": "wpnb_pto_users_deletd", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5304-03": {"ajax_action": "wpnb_pto_new_email_system_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5304", "method": "POST", "mode": "block", "severity": 9.8, "slug": "project-notebooks", "target": "plugin", "versions": ">=1.0.0 <=1.1.3"}, "RULE-CVE-2025-5314-01": {"action": "init", "conditions": [{"name": "ARGS:pdf-source", "type": "regex", "value": "~(?:<script[ />]|j[^a-z]*a[^a-z]*v[^a-z]*a[^a-z]*s[^a-z]*c[^a-z]*r[^a-z]*i[^a-z]*p[^a-z]*t[^a-z]*:|on(?:load|error|mouseover|click|focus|blur)[ ]*=|<(?:img|svg|iframe|embed|object)[ /][^>]*on[a-z]+=)~i"}], "cve": "CVE-2025-5314", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5314", "description": "Dear Flipbook <=2.3.65 DOM-Based Reflected XSS via pdf-source query parameter", "mode": "block", "severity": 6.1, "slug": "3d-flipbook-dflip-lite", "tags": ["xss", "dom-based-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.65"}, "RULE-CVE-2025-53303-01": {"ajax_action": "import_content_xml", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_content_xml AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-02": {"ajax_action": "import_demo", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_demo AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-03": {"ajax_action": "import_widgets_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_widgets_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-04": {"ajax_action": "import_customizer_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_customizer_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-05": {"ajax_action": "import_page_options_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_page_options_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-06": {"ajax_action": "import_elementor_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_elementor_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-07": {"ajax_action": "import_menus_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_menus_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-08": {"ajax_action": "import_woocommerce_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_woocommerce_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-09": {"ajax_action": "import_ess_grid_json", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_ess_grid_json AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-10": {"ajax_action": "import_rev_sliders_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_rev_sliders_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-11": {"ajax_action": "import_instagram_feed_txt", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 PHP object injection via import_instagram_feed_txt AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-53303-12": {"ajax_action": "download_media_package", "conditions": [{"type": "missing_capability", "value": "import"}], "cve": "CVE-2025-53303", "description": "ThemeMove Core <=1.4.2 unauthorized access via download_media_package AJAX handler", "mode": "block", "severity": 8.8, "slug": "thememove-core", "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2025-5336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ht[_-]ctc[_-]chat\\\\b[^\\\\]]*\\\\bno_number\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:|&#x?[0-9a-f]+;)~i"}], "cve": "CVE-2025-5336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5336", "description": "Click to Chat for WhatsApp <=4.22 Stored DOM-Based XSS via shortcode no_number attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.22"}, "RULE-CVE-2025-5337-01": {"ajax_action": "ms_save_slideshow", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=)|<(?:script|img|svg|iframe|object|embed|video|audio|source|link|meta|base|form|details)\\\\b|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5337", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5337", "description": "MetaSlider <=3.98.0 Stored DOM-Based XSS via aria-label parameter in ms_save_slideshow AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ml-slider", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.98.0"}, "RULE-CVE-2025-5340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~album_buy_url[^}]{0,80}(?:<[a-z/!][^>]*>|javascript\\\\s*:|data\\\\s*:[^,]*text/html|on(?:error|load|click|mouse)\\\\s*=)~i"}], "cve": "CVE-2025-5340", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5340", "description": "Music Player for Elementor <=2.4.6 authenticated (Contributor+) Stored XSS via album_buy_url widget setting", "method": "POST", "mode": "block", "severity": 6.4, "slug": "music-player-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.4.6"}, "RULE-CVE-2025-5341-01": {"ajax_action": "forminator_save_builder", "conditions": [{"name": "ARGS:structure", "type": "regex", "value": "~(?i)(?:\\\\bon[a-zA-Z]+\\\\s*=|<(?:script|img|svg|iframe|object|embed)[\\\\s/>])~"}], "cve": "CVE-2025-5341", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5341", "description": "Forminator <=1.44.1 Authenticated (Contributor+) Stored DOM-Based XSS via rating field configuration in forminator_save_builder", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forminator", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.44.1"}, "RULE-CVE-2025-53428-01": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-02": {"ajax_action": "profile_save_field", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-03": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53428-04": {"ajax_action": "wpr_submit_form", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}], "cve": "CVE-2025-53428", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-registration", "target": "plugin", "versions": "<=6.8"}, "RULE-CVE-2025-53429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53429", "description": "exit-game theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "exit-game", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-53430-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53430-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53430", "description": "etta theme <= 1.14.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "etta", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14.0"}, "RULE-CVE-2025-53431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53431", "description": "emberlyn theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emberlyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-53432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53432", "description": "echo theme <= 1.15.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "echo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15.0"}, "RULE-CVE-2025-53433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53433", "description": "easyeat theme <= 1.9.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "easyeat", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9.0"}, "RULE-CVE-2025-53434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53434", "description": "childhope theme <= 1.1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "childhope", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.8"}, "RULE-CVE-2025-53435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53435", "description": "planmyday theme <= 1.1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "planmyday", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-53438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53438", "description": "fitline theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitline", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-53439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53439", "description": "harper theme <= 1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "harper", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13"}, "RULE-CVE-2025-53441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53441-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53441", "description": "greeny theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greeny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2025-53442-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53442-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53442", "description": "rentic theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rentic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53443-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53443-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53443", "description": "smash theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-53445-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53445-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53445", "description": "catwalk theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catwalk", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-53446-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53446-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53446", "description": "beautique theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "beautique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2025-53447-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53447-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53447", "description": "assembly theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "assembly", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53448-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53448", "description": "rally theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rally", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-53449-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53449-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53449", "description": "convex theme <= 1.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "convex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.11"}, "RULE-CVE-2025-53453-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53453-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-53453", "description": "hygia theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hygia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-53454-01": {"action": "save_post", "conditions": [{"name": "ARGS:ewd_uwpm_email_content", "type": "detectXSS"}], "cve": "CVE-2025-53454", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ultimate-wp-mail", "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2025-5391-01": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]){2,}~"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated arbitrary file deletion via path traversal in file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5391-02": {"ajax_action": "wcpo_delete_purchase_order_file", "conditions": [{"name": "ARGS:file_path", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|wp-settings\\\\.php)~i"}], "cve": "CVE-2025-5391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5391", "description": "WooCommerce Purchase Orders <=1.0.2 authenticated sensitive file deletion via file_path parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wc-purchase-orders", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-5398-01": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-02": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-03": {"ajax_action": "nf_save_form", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_save_form)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-04": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~<\\\\s*script[^>]*>~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via script tag injection in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-05": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:[{][{].*(?:constructor|prototype|__proto__|eval|Function).*[}][}]|<%[=-]?.*(?:constructor|prototype|__proto__|eval|Function).*%>)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via CSTI template expression in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "csti", "template-injection"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-5398-06": {"ajax_action": "nf_preview_update", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?:<[^>]{0,400}on(?:load|error|mouseover|click|focus|blur|mouseout|mouseenter|mouseleave|keydown|keyup|keypress|change|submit|reset|select|abort|contextmenu|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|invalid|pointerdown|pointerup|toggle)\\\\s*=|href\\\\s*=\\\\s*[\'\\"]?\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2025-5398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5398", "description": "Ninja Forms <=3.10.2.1 stored XSS via HTML event handler or javascript URI in form field settings (nf_preview_update)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "ninja-forms", "tags": ["xss", "stored-xss", "event-handler"], "target": "plugin", "versions": "<=3.10.2.1"}, "RULE-CVE-2025-54003-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54003-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-54003", "description": "depot theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "depot", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-54010-01": {"ajax_action": "fluent_snippets_import_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet import via fluent_snippets_import_json AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54010-02": {"ajax_action": "fluent_snippets_export_snippets", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54010", "description": "FluentSnippets <=10.50 CSRF on snippet export via fluent_snippets_export_snippets AJAX handler", "mode": "block", "severity": 9.6, "slug": "easy-code-manager", "target": "plugin", "versions": "<=10.50"}, "RULE-CVE-2025-54710-01": {"ajax_action": "ttp_tiktok_clear", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ttp_tiktok_clear"}, {"name": "ARGS:nonce", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54710", "mode": "block", "severity": 7.1, "slug": "b-tiktok-feed", "target": "plugin", "versions": "<=1.0.21"}, "RULE-CVE-2025-54714-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/message(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54714-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/zephyr_project_manager/v1/tasks/delete(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-54714", "method": "POST", "mode": "block", "severity": 7.1, "slug": "zephyr-project-manager", "target": "plugin", "versions": "<=3.3.201"}, "RULE-CVE-2025-54734-01": {"ajax_action": "activated_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-02": {"ajax_action": "get_popular_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-54734-03": {"ajax_action": "get_active_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-54734", "mode": "block", "severity": 5.8, "slug": "b-slider", "target": "plugin", "versions": "<=1.1.30"}, "RULE-CVE-2025-5490-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "footballpool-options"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|toggle|focus)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<svg[^>]*on|<embed[^>]*>|<object[^>]*>~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 stored XSS via admin settings page option fields", "method": "POST", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5490-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^footballpool-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script|%3[Cc]script|\\\\bon(?:error|load|click|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 reflected XSS via PHP_SELF in admin header on any footballpool admin page", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5490-03": {"ajax_action": "footballpool_calculate_scorehistory", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script|%3[Cc]script|\\\\bon(?:error|load|click|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5490", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5490", "description": "Football Pool <=2.12.4 reflected XSS via PHP_SELF in score calculation AJAX handler", "mode": "block", "severity": 4.8, "slug": "football-pool", "tags": ["xss", "reflected-xss", "php-self", "ajax"], "target": "plugin", "versions": "<=2.12.4"}, "RULE-CVE-2025-5528-01": {"action": "init", "conditions": [{"name": "ARGS:heateor_mastodon_share", "type": "exists"}, {"name": "ARGS:heateor_mastodon_share", "type": "regex", "value": "~(?:<[a-zA-Z/!]|on(?:load|error|mouseover|click|focus|blur|change|submit|resize|scroll|unload|abort|mouseout|mousedown|mouseup|keydown|keyup|keypress|toggle)[\\\\s]*=|javascript[\\\\s]*:|%(?:3[Cc])[a-zA-Z/!])~i"}], "cve": "CVE-2025-5528", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5528", "description": "Sassy Social Share <=3.3.75 Reflected XSS via heateor_mastodon_share parameter in onclick JS context", "mode": "block", "severity": 6.1, "slug": "sassy-social-share", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.75"}, "RULE-CVE-2025-5532-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "emd_mb_meta"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<(?:script|iframe|embed|object|svg|math|link|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5532-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp_autosave][content]", "type": "contains", "value": "emd_mb_meta"}, {"name": "ARGS:data[wp_autosave][content]", "type": "regex", "value": "~<(?:script|iframe|embed|object|svg|math|link|base)\\\\b[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|animationend|animationstart|transitionend|pointerover|pointerenter|touchstart|message)\\\\s*=|javascript\\\\s*:|data\\\\s*:[^,]*;base64~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5532", "description": "Campus Directory <=1.9.0 Stored XSS via emd_mb_meta shortcode in autosave content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "campus-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2025-5533-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[kbalert\\\\b~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<script|on(?:error|load|click|mouseover|focus|blur|change|input|submit|resize|mouse(?:over|out|enter|leave|move|up|down))\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5533", "description": "Knowledge Base <=2.3.0 authenticated (Contributor+) stored XSS via kbalert shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-5533-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[kbalert\\\\b~i"}, {"name": "ARGS:content", "type": "regex", "value": "~<script|on(?:error|load|click|mouseover|focus|blur|change|input|submit|resize|mouse(?:over|out|enter|leave|move|up|down))\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5533", "description": "Knowledge Base <=2.3.0 authenticated (Contributor+) stored XSS via kbalert shortcode in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.0"}, "RULE-CVE-2025-5540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[emd_mb_meta\\\\b[^\\\\]]*(?:<[a-z/][^>]*>|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|change|key(?:up|down|press))\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5540", "description": "WP Easy Events <=4.1.0 Authenticated (Contributor+) Stored XSS via emd_mb_meta shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-easy-events", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2025-5567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Stored XSS via su_lightbox shortcode src attribute in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5567-03": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[su_lightbox[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5567", "description": "Shortcodes Ultimate <=7.4.0 Reflected XSS via su_lightbox shortcode in AJAX preview", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortcodes-ultimate", "tags": ["xss", "shortcode", "ajax"], "target": "plugin", "versions": "<=7.4.0"}, "RULE-CVE-2025-5568-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_location_venue", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_location_venue field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_street", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_street field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_city", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_city field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_state", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_state field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_postcode", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_postcode field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_country", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_country field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-07": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_name_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_name_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-08": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_email_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_email_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-09": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_phone_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_phone_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-10": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_address_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_address_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-11": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_tshirt_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_tshirt_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-12": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_gender_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_gender_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-13": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_company_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_company_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-14": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_desg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_desg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-15": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_website_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_website_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-16": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:mep_veg_label", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via mep_veg_label field on mep_events CPT save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-17": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-18": {"ajax_action": "mep_faq_data_save", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-19": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_title in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-20": {"ajax_action": "mep_faq_data_update", "conditions": [{"name": "ARGS:question_answer", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via question_answer in mep_faq_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-21": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-22": {"ajax_action": "mep_timeline_data_save", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-23": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_title", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_title in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5568-24": {"ajax_action": "mep_timeline_data_update", "conditions": [{"name": "ARGS:timeline_desc", "type": "detectXSS"}], "cve": "CVE-2025-5568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5568", "description": "WpEvently <=4.4.2 stored XSS via timeline_desc in mep_timeline_data_update AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "mage-eventpress", "tags": ["xss", "stored-xss", "contributor", "ajax"], "target": "plugin", "versions": "<=4.4.2"}, "RULE-CVE-2025-5585-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (classic editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5585-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~data-url\\\\s*=\\\\s*[\\"\']\\\\s*(?:\\\\{[^}]*[\\"\']\\\\s*(?:url|href)\\\\s*[\\"\']\\\\s*:\\\\s*[\\"\']\\\\s*)?(?:(?:javascript|vbscript)\\\\s*:|data\\\\s*:(?!image/))~i"}], "cve": "CVE-2025-5585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5585", "description": "SiteOrigin Widgets Bundle <=1.68.5 Stored XSS via javascript: URI in Slider widget data-url attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "so-widgets-bundle", "tags": ["xss", "stored-xss", "rest-api", "contributor-plus"], "target": "plugin", "versions": "<=1.68.5"}, "RULE-CVE-2025-5588-01": {"action": "init", "conditions": [{"name": "ARGS:download", "type": "detectXSS"}], "cve": "CVE-2025-5588", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5588", "description": "Image Editor by Pixo <=2.3.6 Authenticated (Contributor+) Stored XSS via download parameter in [pixoeditor] shortcode", "mode": "block", "severity": 6.4, "slug": "image-editor-by-pixo", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.3.6"}, "RULE-CVE-2025-5673-01": {"action": "admin_init", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on admin page render", "method": "GET", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5673-02": {"ajax_action": "b2s_sort_data", "conditions": [{"name": "ARGS:prgSortPostType", "type": "regex", "value": "~(?:\'|--|/[*]|UNION[^a-zA-Z0-9]+(?:ALL[^a-zA-Z0-9]+)?SELECT)~i"}], "cve": "CVE-2025-5673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5673", "description": "Blog2Social <= 8.4.4 authenticated SQL injection via prgSortPostType parameter on b2s_sort_data AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "tags": ["sql-injection", "authenticated", "subscriber-plus"], "target": "plugin", "versions": "<=8.4.4"}, "RULE-CVE-2025-5678-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5678-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~kadence/countdown[^}]*redirectURL[^}]*(?:javascript\\\\s*:|data\\\\s*:)~i"}], "cve": "CVE-2025-5678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5678", "description": "Kadence Blocks <=3.5.10 Stored XSS via Countdown block redirectURL attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "kadence-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.5.10"}, "RULE-CVE-2025-5684-01": {"ajax_action": "metform_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via metform_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5684-02": {"ajax_action": "mf_admin_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|javascript\\\\s*:|on(?:error|load|toggle|click|mouseover|focus|blur|change|submit|reset|select|abort|drag|drop|input|invalid|play|seeking|stalled|wheel)\\\\s*=~i"}], "cve": "CVE-2025-5684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5684", "description": "MetForm <= 4.0.1 Authenticated (Contributor+) Stored XSS via mf_admin_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "metform", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=4.0.1"}, "RULE-CVE-2025-5692-01": {"ajax_action": "SaveCRMconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveCRMconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-02": {"ajax_action": "SaveSuiteconfig", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on SaveSuiteconfig AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-03": {"ajax_action": "saveZohoSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveZohoSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-04": {"ajax_action": "saveSFSettings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSFSettings AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-05": {"ajax_action": "adminAllActionsPRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on adminAllActionsPRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-06": {"ajax_action": "Sync_settings_PRO", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on Sync_settings_PRO AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-07": {"ajax_action": "captcha_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on captcha_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-08": {"ajax_action": "droptable_info", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on droptable_info AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-09": {"ajax_action": "TFA_auth_save", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on TFA_auth_save AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-10": {"ajax_action": "save_apikey", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_apikey AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-11": {"ajax_action": "createnew_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on createnew_form AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-12": {"ajax_action": "save_convert_lead", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_convert_lead AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-13": {"ajax_action": "save_campaign_details", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_campaign_details AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-14": {"ajax_action": "import_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on import_file AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-15": {"ajax_action": "file_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on file_import AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-16": {"ajax_action": "download_json", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on download_json AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "data-exfiltration"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-17": {"ajax_action": "wp_usersync_assignedto", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on wp_usersync_assignedto AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-18": {"ajax_action": "mappingmodulepro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on mappingmodulepro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-19": {"ajax_action": "saveSyncValue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on saveSyncValue AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-20": {"ajax_action": "send_mapping_configuration", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapping_configuration AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-21": {"ajax_action": "get_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on get_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-22": {"ajax_action": "map_thirdparty_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_thirdparty_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-23": {"ajax_action": "save_thirdparty_form_title", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_thirdparty_form_title AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-24": {"ajax_action": "send_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on send_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-25": {"ajax_action": "delete_mapped_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on delete_mapped_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-26": {"ajax_action": "zohoCRMRedirect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on zohoCRMRedirect AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-27": {"ajax_action": "save_usersync_RR_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on save_usersync_RR_option AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-28": {"ajax_action": "customfieldpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on customfieldpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-29": {"ajax_action": "change_ecom_module_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on change_ecom_module_config AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-30": {"ajax_action": "map_ecom_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_ecom_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-31": {"ajax_action": "map_sync_user_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on map_sync_user_fields AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5692-32": {"ajax_action": "selectplugpro", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5692", "description": "Lead Form Data Collection to CRM <=3.1 missing authorization on selectplugpro AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-leads-builder-any-crm", "tags": ["missing-authorization", "broken-access-control", "settings-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-5700-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[simple-logo-carousel[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<|on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5700", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5700", "description": "Simple Logo Carousel <=1.9.3 Stored XSS via shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-logo-carousel", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.3"}, "RULE-CVE-2025-5720-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:author", "type": "detectXSS"}], "cve": "CVE-2025-5720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5720", "description": "Customer Reviews for WooCommerce <=5.80.2 unauthenticated stored XSS via author parameter in AJAX review submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.80.2"}, "RULE-CVE-2025-5753-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:&#0*58;|&#x0*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|&#0*34;|&#0*39;|&quot;|&#x0*22;|&#x0*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5753-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[crevc-calculator[^\\\\]]*link\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:java\\\\s*script\\\\s*(?::|(?:&#0*58;|&#x0*3a;))|data\\\\s*:|vbscript\\\\s*:|(?:[\\\\s\\"\'`]|&#0*34;|&#0*39;|&quot;|&#x0*22;|&#x0*27;)on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-5753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5753", "description": "Valuation Calculator <=1.3.2 Stored XSS via [crevc-calculator] shortcode link attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "commercial-real-estate-valuation-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2025-5813-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-amazon-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-amazon-product/v1/keyword REST route enables arbitrary product creation", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-urls/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-urls/v1/keyword REST route enables SSRF-style URL fetching", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-5813-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wct-get-product/v1/keyword(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5813", "description": "Import Products to WC <=1.2.7 unauthenticated access to wct-get-product/v1/keyword REST route enables unauthorized product data retrieval", "method": "POST", "mode": "block", "severity": 5.3, "slug": "import-products-to-wc", "tags": ["missing-authorization", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-58207-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/fetch-bulk-alt-text(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/alt-text-generator/v1/delete-bulk-generating-status(?:/|$|\\\\?|&)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58207-03": {"ajax_action": "send_bulk_images", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-58207", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ai-image-alt-text-generator-for-wp", "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2025-58225-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-58225-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58225", "description": "paragon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "paragon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2025-5841-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode class attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5841-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bstyle\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode style attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5841-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bclass\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode class attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5841-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[onyx-poll\\\\b[^\\\\]]*\\\\bstyle\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:[\'\\"]\\\\s+on\\\\w+\\\\s*=|<script|<img\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:)~i"}], "cve": "CVE-2025-5841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5841", "description": "ACF Onyx Poll <=1.1.9 Stored XSS via shortcode style attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "acf-onyx-poll", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-5845-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~affr/reviews-grid[^}]*\\"numColumns\\"\\\\s*:\\\\s*\\"[^\\"]*[^0-9\\"][^\\"]*\\"~i"}], "cve": "CVE-2025-5845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5845", "description": "Affiliate Reviews <=1.0.6 Stored XSS via numColumns block attribute in reviews-grid block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-reviews", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-5845-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~affr/reviews-table[^}]*\\"numColumns\\"\\\\s*:\\\\s*\\"[^\\"]*[^0-9\\"][^\\"]*\\"~i"}], "cve": "CVE-2025-5845", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5845", "description": "Affiliate Reviews <=1.0.6 Stored XSS via numColumns block attribute in reviews-table block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "affiliate-reviews", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2025-58592-01": {"ajax_action": "trp_get_translations_regular", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-58592", "description": "TranslatePress <=2.10.2 unauthenticated PHP object injection via trp_get_translations_regular AJAX handler", "mode": "block", "severity": 8.1, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-58592-02": {"ajax_action": "trp_get_translations_gettext", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-58592", "description": "TranslatePress <=2.10.2 unauthenticated PHP object injection via trp_get_translations_gettext AJAX handler", "mode": "block", "severity": 8.1, "slug": "translatepress-multilingual", "target": "plugin", "versions": "<=2.10.2"}, "RULE-CVE-2025-58706-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58706", "description": "woohoo theme <= 1.25 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "woohoo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58706-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58706", "description": "woohoo theme <= 1.25 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "woohoo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58708-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58708", "description": "triple-seven theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "triple-seven", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2025-58708-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58708", "description": "triple-seven theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "triple-seven", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2025-58709-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58709", "description": "legacy theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "legacy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58709-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58709", "description": "legacy theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "legacy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58803-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58803", "description": "algenix theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "algenix", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-58803-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58803", "description": "algenix theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "algenix", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-58879-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58879", "description": "festy theme <= 1.13.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "festy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.13.0"}, "RULE-CVE-2025-58879-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58879", "description": "festy theme <= 1.13.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "festy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.13.0"}, "RULE-CVE-2025-58885-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58885", "description": "pathfinder theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pathfinder", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58885-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58885", "description": "pathfinder theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pathfinder", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58888-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58888", "description": "theflash theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "theflash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58888-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58888", "description": "theflash theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "theflash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58889-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58889", "description": "towny theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "towny", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58889-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58889", "description": "towny theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "towny", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58890-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58890", "description": "playful theme <= 1.19.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "playful", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.19.0"}, "RULE-CVE-2025-58890-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58890", "description": "playful theme <= 1.19.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "playful", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.19.0"}, "RULE-CVE-2025-58891-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58891", "description": "sanger theme <= 1.24.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "sanger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.24.0"}, "RULE-CVE-2025-58891-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58891", "description": "sanger theme <= 1.24.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "sanger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.24.0"}, "RULE-CVE-2025-58892-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58892", "description": "tourimo theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tourimo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-58892-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58892", "description": "tourimo theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tourimo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-58893-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58893", "description": "alright theme <= 1.6.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "alright", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2025-58893-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58893", "description": "alright theme <= 1.6.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "alright", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2025-58894-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58894", "description": "good-mood theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "good-mood", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58894-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58894", "description": "good-mood theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "good-mood", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58895-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58895", "description": "integro theme <= 1.8.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "integro", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58895-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58895", "description": "integro theme <= 1.8.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "integro", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58896-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58896", "description": "otaku theme <= 1.8.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "otaku", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58896-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58896", "description": "otaku theme <= 1.8.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "otaku", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.0"}, "RULE-CVE-2025-58898-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58898", "description": "healthhub theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "healthhub", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58898-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58898", "description": "healthhub theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "healthhub", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58899-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58899", "description": "frame theme <= 2.4.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "frame", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4.0"}, "RULE-CVE-2025-58899-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58899", "description": "frame theme <= 2.4.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "frame", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4.0"}, "RULE-CVE-2025-58900-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58900", "description": "unitravel theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unitravel", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2025-58900-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58900", "description": "unitravel theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unitravel", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2025-58901-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58901", "description": "takeout theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "takeout", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58901-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58901", "description": "takeout theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "takeout", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2025-58923-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58923", "description": "critique theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "critique", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58923", "description": "critique theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "critique", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58925-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58925", "description": "neptunus theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "neptunus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-58925-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58925", "description": "neptunus theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "neptunus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-58926-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58926", "description": "cerebrum theme <= 1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cerebrum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58926-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58926", "description": "cerebrum theme <= 1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cerebrum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58927-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58927", "description": "stallion theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "stallion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58927-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58927", "description": "stallion theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "stallion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58928-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58928", "description": "heart theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heart", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58928-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58928", "description": "heart theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heart", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58929", "description": "pantry theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pantry", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58929-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58929", "description": "pantry theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pantry", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58930-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58930", "description": "fitflex theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fitflex", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58930-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58930", "description": "fitflex theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fitflex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58931-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58931", "description": "palatio theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "palatio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58931-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58931", "description": "palatio theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "palatio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2025-58932-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58932", "description": "prisma theme <= 1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "prisma", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10"}, "RULE-CVE-2025-58932-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58932", "description": "prisma theme <= 1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "prisma", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10"}, "RULE-CVE-2025-58933-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58933", "description": "anubis theme <= 1.25 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "anubis", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58933-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58933", "description": "anubis theme <= 1.25 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "anubis", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.25"}, "RULE-CVE-2025-58934-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58934", "description": "thegig theme <= 1.18.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "thegig", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-58934-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58934", "description": "thegig theme <= 1.18.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "thegig", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-58935-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58935", "description": "lunna theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lunna", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58935-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58935", "description": "lunna theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lunna", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58936", "description": "catamaran theme <= 1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "catamaran", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58936-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58936", "description": "catamaran theme <= 1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "catamaran", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.15"}, "RULE-CVE-2025-58937-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58937", "description": "tacticool theme <= 1.0.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tacticool", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.13"}, "RULE-CVE-2025-58937-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58937", "description": "tacticool theme <= 1.0.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tacticool", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.13"}, "RULE-CVE-2025-58940-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58940", "description": "basil theme <= 1.3.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "basil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-58940-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58940", "description": "basil theme <= 1.3.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "basil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2025-58941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58941", "description": "fabric theme <= 1.5.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabric", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2025-58941-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58941", "description": "fabric theme <= 1.5.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabric", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2025-58942-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58942", "description": "dwell theme <= 1.7.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dwell", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2025-58942-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58942", "description": "dwell theme <= 1.7.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dwell", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2025-58943-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58943", "description": "agricola theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "agricola", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-58943-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58943", "description": "agricola theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "agricola", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-58944-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58944", "description": "manufactory theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "manufactory", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58944-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58944", "description": "manufactory theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "manufactory", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2025-58945-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58945", "description": "ecogrow theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ecogrow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-58945-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58945", "description": "ecogrow theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ecogrow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-58946-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58946", "description": "vocal theme <= 1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "vocal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58946-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58946", "description": "vocal theme <= 1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "vocal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.12"}, "RULE-CVE-2025-58947-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58947", "description": "athos theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "athos", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58947-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58947", "description": "athos theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "athos", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2025-58948-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58948", "description": "aromatica theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "aromatica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58948-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58948", "description": "aromatica theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "aromatica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-58949-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58949", "description": "spock theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "spock", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58949-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58949", "description": "spock theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "spock", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-58950-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-58950", "description": "lione theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lione", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-58950-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-58950", "description": "lione theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lione", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-5921-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "sureforms_entries"}, {"name": "ARGS:s", "type": "detectXSS"}], "cve": "CVE-2025-5921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921", "description": "SureForms <=1.7.1 reflected XSS via search parameter in admin entries list table", "method": "GET", "mode": "block", "severity": 5.8, "slug": "sureforms", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5921-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "sureforms_entries"}, {"name": "ARGS:form_id", "type": "detectXSS"}], "cve": "CVE-2025-5921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5921", "description": "SureForms <=1.7.1 reflected XSS via form_id parameter in admin entries list table filter", "method": "GET", "mode": "block", "severity": 5.8, "slug": "sureforms", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-5923-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5923-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~game-review-block/game-table[^}]*\\"className\\"\\\\s*:\\\\s*\\"(?:\\\\\\\\\\"|[^\\"])*[\'<>()=]~i"}], "cve": "CVE-2025-5923", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5923", "description": "Game Review Block <=4.8.1 Stored XSS via className block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "game-review-block", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=4.8.1"}, "RULE-CVE-2025-5929-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:the-countdown[\\\\s\\\\S]{0,500}clientId\\\\s*\\"?\\\\s*:\\\\s*\\\\\\"[^\\\\\\"]{0,200}(?:</script|[;=()\\\\x27<>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-5929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5929", "description": "The Countdown <=2.0.1 Stored XSS via clientId block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "the-countdown", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-5950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on REST API post update", "method": "PUT", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5950-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~indieblocks/facepile-content\\\\s[^>]*\\"type\\"\\\\s*:\\\\s*\\\\[\\\\s*\\"(?!(?:bookmark|like|repost)\\"\\\\s*[\\\\],])~i"}], "cve": "CVE-2025-5950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5950", "description": "IndieBlocks <=0.13.2 Stored XSS via Facepile Content block kind parameter on classic editor post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "indieblocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.13.2"}, "RULE-CVE-2025-5953-01": {"ajax_action": "hrm_insert_employee", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2025-5953", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5953", "description": "WP Human Resource Management <=2.2.17 missing authorization on hrm_insert_employee allows authenticated privilege escalation via role parameter", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hrm", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=2.2.17"}, "RULE-CVE-2025-5957-01": {"ajax_action": "guest_support_handler", "conditions": [{"name": "ARGS:request", "type": "equals", "value": "delete_tickets"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5957", "description": "Guest Support <=1.2.2 missing authorization on mass ticket deletion via guest_support_handler AJAX endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "guest-support", "tags": ["missing-authorization", "unauthenticated", "data-loss"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2025-5961-01": {"ajax_action": "wpvivid_upload_import_files", "conditions": [{"name": "ARGS:name", "type": "regex", "value": "~\\\\.(?:php\\\\d*|phtml|phar|shtml|cgi|asp|aspx|jsp|jspx)(?:\\\\x00|%00|$)~i"}], "cve": "CVE-2025-5961", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wpvivid-backuprestore", "target": "plugin", "versions": "<=0.9.116"}, "RULE-CVE-2025-5983-01": {"action": "admin_init", "conditions": [{"name": "ARGS:mtm_meta[type]", "type": "equals", "value": "http-equiv"}, {"name": "ARGS:mtm_meta[value]", "type": "equals", "value": "refresh"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-5983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-5983", "description": "Meta Tag Manager <3.3 Contributor+ open redirect via http-equiv refresh meta tag injection on post save", "method": "POST", "mode": "block", "severity": 6.5, "slug": "meta-tag-manager", "tags": ["open-redirect", "missing-authorization", "meta-refresh"], "target": "plugin", "versions": "<3.3"}, "RULE-CVE-2025-60041-01": {"ajax_action": "secas_navigate_to_page", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-60041", "mode": "block", "severity": 8.8, "slug": "emails-catch-all", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2025-60042-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60042-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60042", "description": "chinchilla theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chinchilla", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2025-60043-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60043-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60043", "description": "wanderic theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60044-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60044-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60044", "description": "fribbo theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fribbo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2025-60046-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60046-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60046", "description": "heartstar theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "heartstar", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60047-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60047-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60047", "description": "ipharm theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ipharm", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60048-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60048-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60048", "description": "tripster theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tripster", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60049-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60049-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60049", "description": "soleil theme <= 1.17 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.17"}, "RULE-CVE-2025-60050-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60050-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60050", "description": "panda theme <= 1.21 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "panda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.21"}, "RULE-CVE-2025-60051-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60051-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60051", "description": "rareradio theme <= 1.0.15.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rareradio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15.1"}, "RULE-CVE-2025-60052-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60052-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60052", "description": "wd theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wd", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2025-60053-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60053-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60053", "description": "maxcube theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "maxcube", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2025-60054-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60054-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60054", "description": "onleash theme <= 1.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "onleash", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.2"}, "RULE-CVE-2025-60055-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60055-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60055", "description": "fabrica theme <= 1.8.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fabrica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8.1"}, "RULE-CVE-2025-60056-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60056-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60056", "description": "winger theme <= 1.0.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "winger", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.16"}, "RULE-CVE-2025-60057-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60057-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60057", "description": "dj-rainflow theme <= 1.3.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dj-rainflow", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.13"}, "RULE-CVE-2025-60058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60058", "description": "detailx theme <= 1.10.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "detailx", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.10.0"}, "RULE-CVE-2025-60060-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60060-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60060", "description": "pubzinne theme <= 1.0.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pubzinne", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-60061-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60061-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60061", "description": "kicker theme <= 2.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "kicker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.2.0"}, "RULE-CVE-2025-60063-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60063-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60063", "description": "rosalinda theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosalinda", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2025-60064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60064", "description": "renewal theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "renewal", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2025-60065-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60065-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60065", "description": "pinevale theme <= 1.0.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pinevale", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.14"}, "RULE-CVE-2025-60066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60066-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60066", "description": "katelyn theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "katelyn", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-60067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60067-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-60067", "description": "giardino theme <= 1.1.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "giardino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.10"}, "RULE-CVE-2025-60195-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpf_create_account"}, {"name": "ARGS:role", "type": "regex", "value": "~^\\\\s*(?:administrator|editor|author)\\\\s*$~i"}], "cve": "CVE-2025-60195", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-60195", "description": "Atarim Visual Collaboration <=4.2.1 unauthenticated privilege escalation via wpf_create_account AJAX action with attacker-supplied role parameter", "method": "POST", "mode": "block", "severity": 9.8, "slug": "atarim-visual-collaboration", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-60245-01": {"action": "init", "conditions": [{"name": "ARGS:submit_account", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}], "cve": "CVE-2025-60245", "description": "WP User Manager <=2.9.12 authenticated PHP object injection via account form deserialization", "mode": "block", "severity": 9.8, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.12"}, "RULE-CVE-2025-6025-01": {"ajax_action": "apply_tip", "conditions": [{"name": "ARGS:tip", "type": "regex", "value": "~^\\\\s*-~"}], "cve": "CVE-2025-6025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6025", "description": "Order Tip for WooCommerce <=1.5.4 unauthenticated negative tip manipulation via apply_tip AJAX action", "method": "POST", "mode": "block", "severity": 7.5, "slug": "order-tip-woo", "tags": ["improper-input-validation", "business-logic", "unauthenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2025-6068-01": {"ajax_action": "foogallery_attachment_modal_save", "conditions": [{"name": "ARGS:foogallery", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>[^<]*[^<\\\\s]|\\\\bon(?:error|load|mouseover|focus|click|mouseenter)\\\\s*=\\\\s*[\\"\']|(?:[=\\"\'(\\\\s]|^)\\\\s*javascript\\\\s*:\\\\s*(?:void|alert|confirm|prompt|eval|document|window|fetch|location|[(\\\\[\'\\"]|//)~i"}], "cve": "CVE-2025-6068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6068", "description": "FooGallery <=2.4.31 Stored XSS via attachment modal save caption fields", "method": "POST", "mode": "block", "severity": 5.4, "slug": "foogallery", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.4.31"}, "RULE-CVE-2025-6085-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2025-6085", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6085", "description": "Make (Integromat) Connector <=1.5.10 arbitrary file upload of executable files via REST media endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "integromat-connector", "tags": ["arbitrary-file-upload", "remote-code-execution", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.5.10"}, "RULE-CVE-2025-6184-01": {"action": "init", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-6184", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6184", "description": "Tutor LMS Pro <=3.7.0 authenticated SQL injection via order parameter in assignment listing", "method": "GET", "mode": "block", "severity": 8.8, "slug": "tutor", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.7.0"}, "RULE-CVE-2025-6190-01": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_capabilities", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_capabilities meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-6190-02": {"ajax_action": "rp_user_profile", "conditions": [{"name": "ARGS:wp_user_level", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6190", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6190", "description": "Realty Portal Agent <=0.3.9 missing authorization on rp_user_profile AJAX handler allows privilege escalation via wp_user_level meta key", "method": "POST", "mode": "block", "severity": 8.8, "slug": "realty-portal-agent", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=0.3.9"}, "RULE-CVE-2025-62007-01": {"ajax_action": "bplvf_save_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_save_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-02": {"ajax_action": "bplvf_delete_user_feedback", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_delete_user_feedback"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-03": {"ajax_action": "bplvf_toggle_resolved", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_toggle_resolved"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-62007-04": {"ajax_action": "bplvf_get_global", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "bplvf_get_global"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62007", "method": "POST", "mode": "block", "severity": 8.8, "slug": "voice-feedback", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-6201-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[conversion-pixel[^\\\\]]*(?:<[a-z/!]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6201", "description": "Pixel Manager for WooCommerce <=1.49.0 Stored XSS via conversion-pixel shortcode attributes in classic editor (REST API JSON body vector not interceptable due to engine limitation)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woocommerce-google-adwords-conversion-tracking-tag", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.49.0"}, "RULE-CVE-2025-62022-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/buddypress/v1/signups/activate(/|\\\\?|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62022-02": {"action": "init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/buddypress/v1/signups/activate(/|$)~"}, {"name": "ARGS:activation_key", "type": "regex", "value": "~^0*[0-9]{1,20}$~"}], "cve": "CVE-2025-62022", "method": "POST", "mode": "block", "severity": 7.5, "slug": "buddypress", "target": "plugin", "versions": "<=14.3.4"}, "RULE-CVE-2025-62065-01": {"ajax_action": "rtm_handle_upload_template", "conditions": [{"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2025-62065", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62065", "description": "RomethemeKit <=1.6.5 authenticated arbitrary file upload via rtm_handle_upload_template AJAX handler", "method": "POST", "mode": "block", "severity": 9.9, "slug": "rometheme-for-elementor", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2025-6207-01": {"ajax_action": "wpie_tempalte_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6207", "description": "WP Import Export Lite <=3.9.28 authenticated arbitrary file upload via wpie_tempalte_import AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-import-export-lite", "tags": ["arbitrary-file-upload", "dangerous-file-type", "authenticated"], "target": "plugin", "versions": "<=3.9.28"}, "RULE-CVE-2025-6212-01": {"ajax_action": "uacf7dp_get_table_data", "conditions": [{"name": "ARGS:form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_get_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6212-02": {"ajax_action": "uacf7dp_view_table_data", "conditions": [{"name": "ARGS:cf7_form_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6212", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6212", "description": "Ultimate Addons for Contact Form 7 <=3.5.19 unauthenticated stored XSS via Database module uacf7dp_view_table_data AJAX endpoint \\u2014 defense-in-depth blocking unauthenticated data retrieval", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-addons-for-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=3.5.19"}, "RULE-CVE-2025-6213-01": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "preload_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on preload_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6213-02": {"action": "admin_init", "conditions": [{"name": "ARGS:nppp_action", "type": "equals", "value": "purge_single"}], "cve": "CVE-2025-6213", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6213", "description": "FastCGI Cache Purge and Preload for Nginx <=2.1.2 authenticated RCE via command injection in HTTP Referer header on purge_single action", "method": "GET", "mode": "block", "severity": 7.2, "slug": "fastcgi-cache-purge-and-preload-nginx", "tags": ["command-injection", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2025-6220-01": {"ajax_action": "uacf7_options_save", "conditions": [{"name": "FILES:file", "type": "exists"}], "cve": "CVE-2025-6220", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6220", "description": "Ultimate Addons for Contact Form 7 <=3.5.12 arbitrary file upload via save_options allowing PHP webshell upload to itinerary-fonts directory", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-addons-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=3.5.12"}, "RULE-CVE-2025-6221-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:embed-bokun/(?:product|product-list)[^>]*\\\\{[^}]*\\"align\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<(?:script|img|iframe|svg|embed|object)\\\\b|\\\\\\\\u003[cC](?:script|img|iframe|svg|embed|object)\\\\b|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|\\\\\\\\[\\"\\\\\\\\]|&(?:quot|apos|#0*34|#0*39);|\\\\\\\\u00(?:22|27))~i"}], "cve": "CVE-2025-6221", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6221", "description": "Embed Bokun <=0.23 Stored XSS via align parameter in Gutenberg block attributes within post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "embed-bokun", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=0.23"}, "RULE-CVE-2025-6236-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:paypal", "type": "detectXSS"}], "cve": "CVE-2025-6236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6236", "description": "Hostel <=1.1.5.8 stored XSS via PayPal email setting on admin options page", "method": "POST", "mode": "block", "severity": 4.8, "slug": "hostel", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1.5.8"}, "RULE-CVE-2025-6236-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:pdt_token", "type": "detectXSS"}], "cve": "CVE-2025-6236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6236", "description": "Hostel <=1.1.5.8 stored XSS via PayPal PDT token setting on admin options page", "method": "POST", "mode": "block", "severity": 4.8, "slug": "hostel", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1.5.8"}, "RULE-CVE-2025-6238-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/mcp/oauth/authorize(?:/|\\\\?|$)|^/\\\\?(?:[^#]*&)?rest_route=/mcp/oauth/authorize(?:[/?&]|$))~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^(?:https?:)?//(?!vulnerable-site\\\\.test(?:/|$))~i"}], "cve": "CVE-2025-6238", "method": "GET", "mode": "block", "severity": 8.0, "slug": "ai-engine", "target": "plugin", "versions": "2.8.4"}, "RULE-CVE-2025-6238-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/mcp/oauth/token(?:/|\\\\?|$)|^/\\\\?(?:[^#]*&)?rest_route=/mcp/oauth/token(?:[/?&]|$))~i"}, {"name": "ARGS:redirect_uri", "type": "regex", "value": "~^(?:https?:)?//(?!vulnerable-site\\\\.test(?:/|$))~i"}], "cve": "CVE-2025-6238", "method": "POST", "mode": "block", "severity": 8.0, "slug": "ai-engine", "target": "plugin", "versions": "2.8.4"}, "RULE-CVE-2025-6251-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:elementor_ajax|save_builder)$~"}, {"name": "ARGS:actions", "type": "regex", "value": "~field_id[\\"\']?\\\\s*[:,]\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-6251", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6251", "description": "Royal Elementor Addons <=1.7.1036 Stored XSS via Form Builder field_id in Elementor editor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor", "authenticated"], "target": "plugin", "versions": "<=1.7.1036"}, "RULE-CVE-2025-6251-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS", "type": "regex", "value": "~field_id[\\"\']?\\\\s*[:,]\\\\s*[\\"\'][^\\"\']*(?:<[a-z/]|\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2025-6251", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6251", "description": "Royal Elementor Addons <=1.7.1036 Stored XSS via Form Builder field_id in classic post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "tags": ["xss", "stored-xss", "elementor", "authenticated"], "target": "plugin", "versions": "<=1.7.1036"}, "RULE-CVE-2025-6253-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/uielem/v1/prepare_template(?:/|\\\\?|&|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log|(?:\\\\.\\\\.[\\\\\\\\/]){2,})~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6253", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6253", "description": "UiCore Elements <=1.3.0 unauthenticated arbitrary file read via prepare_template REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "uicore-elements", "tags": ["missing-authorization", "arbitrary-file-read", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-6255-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~dapfforwc[/\\\\\\\\]dynamic-ajax-filter[^}]*className[^}]*(?:<|>|on\\\\w+\\\\s*=|javascript:|\\\\\\\\&quot;|\\\\\\\\u003[ceCE])~i"}], "cve": "CVE-2025-6255", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6255", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via className parameter in Gutenberg block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-6255-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~dapfforwc[/\\\\\\\\]dynamic-ajax-filter[^}]*className[^}]*(?:<|>|on\\\\w+\\\\s*=|javascript:|\\\\\\\\&quot;|\\\\\\\\u003[ceCE])~i"}], "cve": "CVE-2025-6255", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6255", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via className parameter in Gutenberg block (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-6256-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~thumbnailHoverEffect[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=|style\\\\s*=)|<\\\\s*(?:script|img|svg|iframe|object|embed|video|audio|math|details|marquee))~i"}], "cve": "CVE-2025-6256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6256", "description": "Flex Guten <=1.2.5 stored XSS via thumbnailHoverEffect block attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flex-guten", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-6256-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~thumbnailHoverEffect[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=|style\\\\s*=)|<\\\\s*(?:script|img|svg|iframe|object|embed|video|audio|math|details|marquee))~i"}], "cve": "CVE-2025-6256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6256", "description": "Flex Guten <=1.2.5 stored XSS via thumbnailHoverEffect block attribute in REST API post update", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "flex-guten", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-6256-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~thumbnailHoverEffect[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:[\\"\']\\\\s*(?:on\\\\w+\\\\s*=|style\\\\s*=)|<\\\\s*(?:script|img|svg|iframe|object|embed|video|audio|math|details|marquee))~i"}], "cve": "CVE-2025-6256", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6256", "description": "Flex Guten <=1.2.5 stored XSS via thumbnailHoverEffect block attribute in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flex-guten", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2025-6257-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:currency|currency_legal)\\\\b[^\\\\]]*(?:<[a-zA-Z/!][^>]*>|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-6257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6257", "description": "Euro FxRef Currency Converter <=2.0.2 Stored XSS via [currency] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "euro-fxref-currency-converter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-6257-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:currency|currency_legal)\\\\b[^\\\\]]*(?:<[a-zA-Z/!][^>]*>|on\\\\w+\\\\s*=|javascript:)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-6257", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6257", "description": "Euro FxRef Currency Converter <=2.0.2 Stored XSS via [currency] shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "euro-fxref-currency-converter", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-6261-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "fleetwire_list"}, {"name": "ARGS:post_content", "type": "regex", "value": "~fleetwire_list[^\\\\]]*(?:<[a-z/!]|(?:&#0*60;|&#x0*3c;|&lt;)[a-z/!]|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseleave|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6261", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6261", "description": "Fleetwire Fleet Management Plugin <=1.0.19 Authenticated (Contributor+) Stored XSS via fleetwire_list shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fleetwire-fleet-management", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-6261-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "fleetwire_list"}, {"name": "ARGS:content", "type": "regex", "value": "~fleetwire_list[^\\\\]]*(?:<[a-z/!]|(?:&#0*60;|&#x0*3c;|&lt;)[a-z/!]|\\\\bon(?:error|load|click|mouseover|focus|mouseenter|mouseleave|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6261", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6261", "description": "Fleetwire Fleet Management Plugin <=1.0.19 Authenticated (Contributor+) Stored XSS via fleetwire_list shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fleetwire-fleet-management", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-6262-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[muse-ai\\\\s[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6262", "description": "Muse.ai Video Embedding <=0.4.1 Stored XSS via muse-ai shortcode event handler injection in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "muse-ai", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-6262-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[muse-ai\\\\s[^\\\\]]*<script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6262", "description": "Muse.ai Video Embedding <=0.4.1 Stored XSS via script tag injection in muse-ai shortcode in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "muse-ai", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-6262-03": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[muse-ai\\\\s[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6262", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6262", "description": "Muse.ai Video Embedding <=0.4.1 Stored XSS via javascript: URI in muse-ai shortcode in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "muse-ai", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2025-62889-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kingaddons/v1/ajaxselect2/[a-zA-Z0-9_]+/?~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62889", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62889", "description": "King Addons for Elementor <=51.1.37 missing authorization on ajaxselect2 REST endpoint", "mode": "block", "severity": 8.8, "slug": "king-addons", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=51.1.37"}, "RULE-CVE-2025-62902-01": {"ajax_action": "shortcode_Api_Add", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "shortcode_Api_Add"}, {"name": "ARGS:getlead", "type": "exists"}], "cve": "CVE-2025-62902", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-popup-builder", "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2025-62906-01": {"ajax_action": "delete_all_log_link", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_all_log_link"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62906", "method": "POST", "mode": "block", "severity": 9.8, "slug": "referral-link-tracker", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-62915-01": {"ajax_action": "clicksend_send_sms", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "clicksend_send_sms"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62915", "method": "POST", "mode": "block", "severity": 8.1, "slug": "clicksend-contactform7", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-62915-02": {"ajax_action": "delete_message", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_message"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62915", "method": "POST", "mode": "block", "severity": 8.1, "slug": "clicksend-contactform7", "target": "plugin", "versions": "<=1.4.0"}, "RULE-CVE-2025-62918-01": {"ajax_action": "idf_stock_item_click", "conditions": [{"name": "ARGS:idf_stock_item_click", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-62918", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ignitiondeck", "target": "plugin", "versions": "<=2.0.13"}, "RULE-CVE-2025-62919-01": {"ajax_action": "setup_widgets", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "setup_widgets"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62919", "method": "POST", "mode": "block", "severity": 9.1, "slug": "ts-demo-importer", "target": "plugin", "versions": "<=0.1.3"}, "RULE-CVE-2025-62924-01": {"ajax_action": "post_grid_layout_content_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "post_grid_layout_content_ajax"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62924", "method": "POST", "mode": "block", "severity": 8.8, "slug": "post-grid", "target": "plugin", "versions": "<=2.3.17"}, "RULE-CVE-2025-62925-01": {"ajax_action": "save_analytics_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62925", "method": "POST", "mode": "block", "severity": 8.1, "slug": "enhanced-e-commerce-for-woocommerce-store", "target": "plugin", "versions": "<=7.2.13"}, "RULE-CVE-2025-62925-02": {"ajax_action": "get_analytics_web_properties", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62925", "method": "POST", "mode": "block", "severity": 8.1, "slug": "enhanced-e-commerce-for-woocommerce-store", "target": "plugin", "versions": "<=7.2.13"}, "RULE-CVE-2025-62925-03": {"ajax_action": "get_analytics_account_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62925", "method": "POST", "mode": "block", "severity": 8.1, "slug": "enhanced-e-commerce-for-woocommerce-store", "target": "plugin", "versions": "<=7.2.13"}, "RULE-CVE-2025-62928-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/seo-meta/v1/update/\\\\d+|/(?:index\\\\.php)?\\\\?(?:[^#]*&)?rest_route=/seo-meta/v1/update/\\\\d+)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62928", "method": "POST", "mode": "block", "severity": 8.1, "slug": "seo-meta-description-updater", "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2025-62931-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(^/wp-json/microsoft/v1/redeemCode(/|\\\\?|$))|(^/\\\\?rest_route=/microsoft/v1/redeemCode(/|&|$))~"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-62931", "method": "POST", "mode": "block", "severity": 8.8, "slug": "microsoft-start", "target": "plugin", "versions": "<=2.8.7"}, "RULE-CVE-2025-62932-01": {"ajax_action": "riovizual_divi_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62932", "method": "POST", "mode": "block", "severity": 8.8, "slug": "riovizual", "target": "plugin", "versions": "<=3.0.0"}, "RULE-CVE-2025-62935-01": {"ajax_action": "woc_add_schedule", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "woc_add_schedule"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62935", "method": "POST", "mode": "block", "slug": "woc-open-close", "target": "plugin", "versions": "<=4.9.8"}, "RULE-CVE-2025-62938-01": {"ajax_action": "validate_reoon_api", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "validate_reoon_api"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62938", "method": "POST", "mode": "block", "severity": 8.1, "slug": "reoon-email-verifier", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-62938-02": {"ajax_action": "validate_reoon_email", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "validate_reoon_email"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62938", "method": "POST", "mode": "block", "severity": 8.1, "slug": "reoon-email-verifier", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-62938-03": {"ajax_action": "reoon_remove_api_key", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "reoon_remove_api_key"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62938", "method": "POST", "mode": "block", "severity": 8.1, "slug": "reoon-email-verifier", "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-62952-01": {"ajax_action": "wpbo_search_response_catlist", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpbo_search_response_catlist"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62952", "method": "POST", "mode": "block", "severity": 8.8, "slug": "chatbot", "target": "plugin", "versions": "<=7.7.3"}, "RULE-CVE-2025-62954-01": {"ajax_action": "rop_notice_dismissed", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "rop_notice_dismissed"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62954", "method": "POST", "mode": "block", "severity": 8.8, "slug": "tweet-old-post", "target": "plugin", "versions": "<=9.3.3"}, "RULE-CVE-2025-62965-01": {"ajax_action": "ame_ajax_save_linkcategories", "conditions": [{"name": "ARGS:ame_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62965", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-62965", "description": "Admin Management Xtended <=2.5.1 missing authorization on ame_ajax_save_linkcategories AJAX action", "method": "POST", "mode": "block", "severity": 7.2, "slug": "admin-management-xtended", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2025-62967-01": {"ajax_action": "directorypress_save_category_fields_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:term_id", "type": "exists"}], "cve": "CVE-2025-62967", "method": "POST", "mode": "block", "severity": 6.5, "slug": "directorypress", "target": "plugin", "versions": "<=3.6.25"}, "RULE-CVE-2025-62980-01": {"ajax_action": "pfmsz_emptyOptions_AjaxConf", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmsz_emptyOptions_AjaxConf"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-62980-02": {"ajax_action": "pfmdz_writetocssfile_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmdz_writetocssfile_ajax"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-62980-03": {"ajax_action": "pfmdz_nightMode_ajax", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmdz_nightMode_ajax"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-62980-04": {"ajax_action": "pfmdz_addgoog_fonts", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "pfmdz_addgoog_fonts"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-62980", "method": "POST", "mode": "block", "severity": 8.8, "slug": "persian-admin-fonts", "target": "plugin", "versions": "<=4.1.03"}, "RULE-CVE-2025-63077-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ha_library_new_post"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-63077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-63077", "description": "Happy Addons for Elementor <=3.20.3 missing authorization on ha_library_new_post admin action allows contributor+ users to create arbitrary Theme Builder templates", "mode": "block", "severity": 4.3, "slug": "happy-elementor-addons", "tags": ["missing-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=3.20.3"}, "RULE-CVE-2025-6326-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-6326", "description": "inset theme <= 1.18.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "inset", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-6326-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-6326", "description": "inset theme <= 1.18.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "inset", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.18.0"}, "RULE-CVE-2025-6327-01": {"ajax_action": "king_addons_upload_file", "conditions": [{"name": "ARGS:uploaded_file", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]*|tml?|t|ar)|cgi|fcgi|shtml|asp|aspx|jsp|jspx|sh|bash)($|[?#])~i"}], "cve": "CVE-2025-6327", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6327", "description": "King Addons <=51.1.36 unauthenticated arbitrary file upload via king_addons_upload_file", "method": "POST", "mode": "block", "severity": 10.0, "slug": "king-addons", "tags": ["arbitrary-file-upload", "unauthenticated", "remote-code-execution"], "target": "plugin", "versions": "<=51.1.36"}, "RULE-CVE-2025-6350-01": {"ajax_action": "wpvr_save", "conditions": [{"name": "ARGS:panodata", "type": "regex", "value": "~<(?:script|iframe|embed|object|applet|form|svg|math)[\\\\s/>]|\\\\bon(?:error|load|click|mouse(?:over|out|enter|move)|focus|blur|change|submit|key(?:up|down|press))\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-6350", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6350", "description": "WP VR <=8.5.32 Stored XSS via hotspot-hover in panodata JSON on wpvr_save AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wpvr", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=8.5.32"}, "RULE-CVE-2025-6380-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/onlyoffice/oo\\\\.callback(?:/|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6380", "method": "POST", "mode": "block", "severity": 9.8, "slug": "onlyoffice", "target": "plugin", "versions": ">=1.1.0 <=2.2.0"}, "RULE-CVE-2025-6382-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[taeggie-feed[^\\\\]]*name\\\\s*=\\\\s*[\\"\']?[^\\\\]]*(?:<[a-z/!]|on(?:load|error|click|mouse[a-zA-Z0-9_]+|focus|blur)\\\\s*=|javascript:|[\\"\']\\\\s*[);])[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-6382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6382", "description": "Taeggie Feed <=0.1.10 Stored XSS via taeggie-feed shortcode name attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "taeggie-feed", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.1.10"}, "RULE-CVE-2025-6462-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[SQLREPORT\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6462", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6462", "description": "EZ SQL Reports <= 5.25.11 Stored XSS via SQLREPORT shortcode name attribute in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elisqlreports", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.25.11"}, "RULE-CVE-2025-6462-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[SQLREPORT\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6462", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6462", "description": "EZ SQL Reports <= 5.25.11 Stored XSS via SQLREPORT shortcode name attribute in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "elisqlreports", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.25.11"}, "RULE-CVE-2025-6464-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^forminator_submit_form_~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-6464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6464", "description": "Forminator <=1.44.2 unauthenticated PHP Object Injection via form submission PHAR upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "forminator", "tags": ["object-injection", "phar-deserialization", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.44.2"}, "RULE-CVE-2025-6464-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2025-6464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6464", "description": "Forminator <=1.44.2 unauthenticated PHP Object Injection via multiple file upload PHAR", "method": "POST", "mode": "block", "severity": 8.8, "slug": "forminator", "tags": ["object-injection", "phar-deserialization", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.44.2"}, "RULE-CVE-2025-6540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[web[_-]cam\\\\b[^\\\\]]*\\\\bslug\\\\s*=\\\\s*(?:\\"[^\\"\\\\r\\\\n]*[<>\'\\\\\\\\][^\\"\\\\r\\\\n]*\\"|\'[^\'\\\\r\\\\n]*[<>\\"\\\\\\\\][^\'\\\\r\\\\n]*\')~i"}], "cve": "CVE-2025-6540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6540", "description": "Web Cam <=3.0 Stored XSS via slug shortcode attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "web-cam", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2025-6540-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[web[_-]cam\\\\b[^\\\\]]*\\\\bslug\\\\s*=\\\\s*(?:\\"[^\\"\\\\r\\\\n]*[<>\'\\\\\\\\][^\\"\\\\r\\\\n]*\\"|\'[^\'\\\\r\\\\n]*[<>\\"\\\\\\\\][^\'\\\\r\\\\n]*\')~i"}], "cve": "CVE-2025-6540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6540", "description": "Web Cam <=3.0 Stored XSS via slug shortcode attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "web-cam", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2025-6540-03": {"action": "init", "conditions": [{"name": "ARGS:image", "type": "exists"}, {"name": "ARGS:slug", "type": "regex", "value": "~[<>\\"\'\\\\\\\\]~"}], "cve": "CVE-2025-6540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6540", "description": "Web Cam <=3.0 Stored XSS via slug parameter in frontend form submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "web-cam", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2025-6586-01": {"action": "admin_init", "conditions": [{"name": "ARGS:dpwap_locInstall", "type": "exists"}, {"name": "FILES:dpwap_locFiles", "type": "exists"}], "cve": "CVE-2025-6586", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6586", "description": "Download Plugin <=2.2.8 authenticated (Administrator+) arbitrary file upload via dpwap_plugin_locInstall", "method": "POST", "mode": "block", "severity": 7.2, "slug": "download-plugin", "tags": ["arbitrary-file-upload", "file-upload", "remote-code-execution"], "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2025-66054-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/lp/v1/load_content_via_ajax|[?&]rest_route=/lp/v1/load_content_via_ajax)~"}, {"name": "ARGS:callback", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-66054", "mode": "block", "severity": 7.5, "slug": "learnpress", "target": "plugin", "versions": "<=4.2.9.4"}, "RULE-CVE-2025-66070-01": {"ajax_action": "wpforo_tag_search", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on\\\\w+\\\\s*=|<svg[^>]+on\\\\w+\\\\s*=|<iframe[\\\\s/>])~i"}], "cve": "CVE-2025-66070", "description": "wpForo Forum <=2.4.10 unauthenticated reflected XSS and information disclosure via wpforo_tag_search AJAX handler", "mode": "block", "severity": 7.5, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2025-66074-01": {"ajax_action": "ironikus_manage_extensions", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-66074", "description": "Unrestricted Upload of File with Dangerous Type in WP Webhooks <= 3.3.8 via nopriv ironikus_manage_extensions", "mode": "block", "severity": 9.0, "slug": "wp-webhooks", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2025-66078-01": {"ajax_action": "mphb_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-66078", "description": "Hotel Booking Lite <=5.2.3 authenticated remote code execution via mphb_install_plugin AJAX handler missing install_plugins capability check", "mode": "block", "severity": 9.1, "slug": "motopress-hotel-booking-lite", "target": "plugin", "versions": "<=5.2.3"}, "RULE-CVE-2025-66533-01": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-title", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-66533-02": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-current-url", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-66533-03": {"ajax_action": "give_process_donation", "conditions": [{"name": "ARGS:give-form-hash", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-66533-04": {"ajax_action": "give_load_receipt", "conditions": [{"name": "ARGS:shortcode_tag", "type": "regex", "value": "~\\\\[(?:\\\\/)?give_[a-zA-Z0-9_\\\\-]+(?:\\\\s+[^\\\\]]+)?\\\\]~"}], "cve": "CVE-2025-66533", "method": "POST", "mode": "block", "severity": 7.8, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-6673-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "contains", "value": "nsc_eprm_menu_link"}, {"name": "ARGS:content", "type": "regex", "value": "~nsc_eprm_menu_link[^\\\\]]*restaurant_menu_type\\\\s*=\\\\s*([\\"\']).*?\\\\1[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<|>)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6673", "description": "Easy Restaurant Menu Manager <=2.0.1 Stored XSS via nsc_eprm_menu_link shortcode restaurant_menu_type attribute (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-pdf-restaurant-menu-upload", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-6673-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "nsc_eprm_menu_link"}, {"name": "ARGS:content", "type": "regex", "value": "~nsc_eprm_menu_link[^\\\\]]*restaurant_menu_type\\\\s*=\\\\s*([\\"\']).*?\\\\1[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<|>)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6673", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6673", "description": "Easy Restaurant Menu Manager <=2.0.1 Stored XSS via nsc_eprm_menu_link shortcode restaurant_menu_type attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-pdf-restaurant-menu-upload", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-6715-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:layout", "type": "regex", "value": "~(?:\\\\.[\\\\.][\\\\\\\\/]|\\\\.[\\\\.]%2[fF]|\\\\.[\\\\.]%5[cC]|php://|data://|expect://|zip://|phar://)~i"}], "cve": "CVE-2025-6715", "mode": "block", "severity": 9.8, "slug": "latepoint", "target": "plugin", "versions": "<5.1.94"}, "RULE-CVE-2025-6716-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script|<iframe|<svg|<img|<video|<audio|<body|<embed|<object|<marquee|<form|<input|<button|<textarea|<select|<details|<math)(?:\\\\s|/|>)|(?:on(?:error|load|click|mouseover|focus|blur|change|submit|reset|select|abort|unload|resize|scroll|keydown|keyup|keypress)\\\\s*=)|javascript\\\\s*:\\\\s*(?:alert|confirm|prompt|eval|fetch|document|window|location|void|this|atob|setTimeout|setInterval|Function|[\\\\x60\'\\"(])~i"}], "cve": "CVE-2025-6716", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6716", "description": "Contest Gallery <=26.0.8 Authenticated (Author+) Stored XSS via upload title parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "contest-gallery", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=26.0.8"}, "RULE-CVE-2025-6717-01": {"ajax_action": "b1_view_detail_log", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-6717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6717", "description": "B1.lt for WooCommerce <=2.2.56 authenticated SQL injection via id parameter in b1_view_detail_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "b1-accounting", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.2.56"}, "RULE-CVE-2025-6717-02": {"ajax_action": "b1_view_detail_validation_log", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2025-6717", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6717", "description": "B1.lt for WooCommerce <=2.2.56 authenticated SQL injection via id parameter in b1_view_detail_validation_log AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "b1-accounting", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.2.56"}, "RULE-CVE-2025-6740-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/\\\\d+/feedback(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<iframe|<object|<embed|javascript\\\\s*:|\\\\bon(?:error|load|click|focus|mouseover)\\\\s*=)~i"}], "cve": "CVE-2025-6740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6740", "description": "Contact Form 7 Database Addon <=1.3.1 unauthenticated stored XSS via CF7 form submission fields", "method": "POST", "mode": "block", "severity": 6.1, "slug": "contact-form-cfdb7", "tags": ["xss", "stored-xss", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-6740-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cfdb7-list~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script|<img\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<svg\\\\b[^>]+\\\\bon\\\\w+\\\\s*=|<iframe|<object|<embed|javascript\\\\s*:|\\\\bon(?:error|load|click|focus|mouseover)\\\\s*=|\'\\\\s*(?:on\\\\w+|style|class)\\\\s*=)~i"}], "cve": "CVE-2025-6740", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6740", "description": "Contact Form 7 Database Addon <=1.3.1 reflected XSS via single-quote attribute breakout on admin list page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "contact-form-cfdb7", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-67467-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]give-paypal-account-connected=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67467", "method": "GET", "mode": "block", "severity": 4.5, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-67467-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]give-paypal-status-refresh=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67467", "method": "GET", "mode": "block", "severity": 4.5, "slug": "give", "target": "plugin", "versions": "<=4.13.1"}, "RULE-CVE-2025-67515-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67515", "description": "wilmer theme <= 3.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wilmer", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.5"}, "RULE-CVE-2025-67515-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67515", "description": "wilmer theme <= 3.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wilmer", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.5"}, "RULE-CVE-2025-6754-01": {"ajax_action": "seo_metrics_handle_connect_button_click", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "seo_metrics_handle_connect_button_click"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6754", "method": "POST", "mode": "block", "severity": 8.8, "slug": "seo-metrics-helper", "target": "plugin", "versions": "1.0.5 - 1.0.15"}, "RULE-CVE-2025-6754-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-content/plugins/seo-metrics-helper/endpoint\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6754", "method": "GET", "mode": "block", "severity": 8.8, "slug": "seo-metrics-helper", "target": "plugin", "versions": "1.0.5 - 1.0.15"}, "RULE-CVE-2025-67563-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "gmail_oauth_redirect"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67563", "method": "GET", "mode": "block", "severity": 5.3, "slug": "post-smtp", "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2025-6757-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[rpwe\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|change|submit|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6757", "description": "Recent Posts Widget Extended <=2.0.2 Stored XSS via rpwe shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recent-posts-widget-extended", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-6757-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[rpwe\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|change|submit|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6757", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6757", "description": "Recent Posts Widget Extended <=2.0.2 Stored XSS via rpwe shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "recent-posts-widget-extended", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2025-67574-01": {"action": "admin_init", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "recreate_db"}], "cve": "CVE-2025-67574", "mode": "block", "severity": 5.3, "slug": "booking-calendar", "target": "plugin", "versions": "<=3.2.30"}, "RULE-CVE-2025-67588-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "POST", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-67588-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "PUT", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-67588-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "PATCH", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-67588-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?:/wp-json/wp/v2/e-floating-buttons(?:/|\\\\?|$)|/\\\\?(?:[^#]*&)?rest_route=/wp/v2/e-floating-buttons(?:/|$|&))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-67588", "method": "DELETE", "mode": "block", "severity": 4.3, "slug": "elementor", "target": "plugin", "versions": "<=3.33.0"}, "RULE-CVE-2025-6787-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[smartdocs_search[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6787", "description": "Smart Docs <=1.1.0 Stored XSS via smartdocs_search shortcode attributes in post content (post editor)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "smart-docs", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-6787-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[smartdocs_search[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6787", "description": "Smart Docs <=1.1.0 Stored XSS via smartdocs_search shortcode attributes in post content (post_content param)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "smart-docs", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-6787-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[smartdocs_search[^\\\\]]*(?:<[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6787", "description": "Smart Docs <=1.1.0 Stored XSS via smartdocs_search shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 5.4, "slug": "smart-docs", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-6792-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/guppylite/v2/channel-authorize(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-6792", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6792", "description": "WP Guppy Lite <=1.1.4 unauthenticated information disclosure via channel-authorize REST endpoint", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpguppy-lite", "tags": ["missing-authentication", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2025-67934-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67934", "description": "wellspring theme <= 2.8 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wellspring", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.8"}, "RULE-CVE-2025-67934-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67934", "description": "wellspring theme <= 2.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wellspring", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.8"}, "RULE-CVE-2025-67935-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67935", "description": "optimizewp theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "optimizewp", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-67935-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67935", "description": "optimizewp theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "optimizewp", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2025-67936-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67936", "description": "curly theme <= 3.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "curly", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2025-67936-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67936", "description": "curly theme <= 3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "curly", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2025-67937-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67937", "description": "hendon theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hendon", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-67937-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67937", "description": "hendon theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hendon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2025-67938-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67938", "description": "biagiotti theme <= 3.5.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "biagiotti", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.5.2"}, "RULE-CVE-2025-67938-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67938", "description": "biagiotti theme <= 3.5.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "biagiotti", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.5.2"}, "RULE-CVE-2025-67940-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-67940", "description": "powerlift theme <= 3.2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "powerlift", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=3.2.1"}, "RULE-CVE-2025-67940-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-67940", "description": "powerlift theme <= 3.2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "powerlift", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.2.1"}, "RULE-CVE-2025-67983-01": {"ajax_action": "timezoneByCountry", "conditions": [{"name": "ARGS:code", "type": "regex", "value": "~(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|%3C[a-zA-Z%]|&#x?[0-9a-f]+;?)~i"}], "cve": "CVE-2025-67983", "description": "WP Visitor Statistics (wp-stats-manager) <=8.3 reflected XSS via \'code\' parameter in timezoneByCountry AJAX handler (echoed unsanitized at wsm_init.php:1100).", "mode": "block", "severity": 6.5, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.3"}, "RULE-CVE-2025-68027-01": {"ajax_action": "tfhb_registration", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|contributor)~i"}], "cve": "CVE-2025-68027", "method": "POST", "mode": "block", "severity": 7.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68027-02": {"ajax_action": "tfhb_registration", "conditions": [{"name": "ARGS:user_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor)~i"}], "cve": "CVE-2025-68027", "method": "POST", "mode": "block", "severity": 7.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68027-03": {"ajax_action": "tfhb_registration", "conditions": [{"name": "ARGS:tfhb_role", "type": "regex", "value": "~(?:administrator|editor|author|contributor)~i"}], "cve": "CVE-2025-68027", "method": "POST", "mode": "block", "severity": 7.3, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68044-01": {"ajax_action": "rtb_cancel_reservations", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-68044", "description": "Five Star Restaurant Reservations <=2.7.4 unauthenticated IDOR allows arbitrary reservation cancellation via rtb_cancel_reservations", "mode": "block", "severity": 8.6, "slug": "restaurant-reservations", "target": "plugin", "versions": "<=2.7.4"}, "RULE-CVE-2025-68044-02": {"ajax_action": "rtb_find_reservations", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-68044", "description": "Five Star Restaurant Reservations <=2.7.4 unauthenticated IDOR allows arbitrary reservation data disclosure via rtb_find_reservations", "mode": "block", "severity": 8.6, "slug": "restaurant-reservations", "target": "plugin", "versions": "<=2.7.4"}, "RULE-CVE-2025-68055-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-json/hydra-booking/v[0-9]+/booking/lists(?:/|\\\\?|$)~i"}, {"name": "ARGS:filter_data", "type": "regex", "value": "~(?i)(?:union\\\\s+(?:all\\\\s+)?select|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|(?:[\'\\"\\\\s])or\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|drop\\\\s+table|information_schema|load_file\\\\s*\\\\(|into\\\\s+(?:out|dump)file|;\\\\s*(?:drop|insert|update|delete)\\\\b)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-68055", "method": "POST", "mode": "block", "severity": 8.5, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-68055-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-json/hydra-booking/v[0-9]+/booking/filter(?:/|\\\\?|$)~i"}, {"name": "ARGS:filter_data", "type": "regex", "value": "~(?i)(?:union\\\\s+(?:all\\\\s+)?select|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|(?:[\'\\"\\\\s])or\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|drop\\\\s+table|information_schema|load_file\\\\s*\\\\(|into\\\\s+(?:out|dump)file|;\\\\s*(?:drop|insert|update|delete)\\\\b)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-68055", "method": "GET", "mode": "block", "severity": 8.5, "slug": "hydra-booking", "target": "plugin", "versions": "<=1.1.32"}, "RULE-CVE-2025-6813-01": {"action": "init", "conditions": [{"name": "ARGS:_aap_action", "type": "regex", "value": "~(?i)^auto_login$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6813", "method": "POST", "mode": "block", "severity": 8.8, "slug": "aapanel-wp-toolkit", "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-6813-02": {"action": "init", "conditions": [{"name": "ARGS:_aap_action", "type": "regex", "value": "~(?i)^security_key_info$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6813", "method": "POST", "mode": "block", "severity": 8.8, "slug": "aapanel-wp-toolkit", "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-6815-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:service[name]", "type": "detectXSS"}], "cve": "CVE-2025-6815", "method": "POST", "mode": "block", "severity": 5.5, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-6831-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in classic editor post_content param", "method": "POST", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6831-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6831-03-PATCH": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in REST API post content (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6831-03-PUT": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[urcr_restrict\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-6831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6831", "description": "User Registration <=4.2.4 Stored XSS via urcr_restrict shortcode in REST API post content (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "user-registration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.4"}, "RULE-CVE-2025-6851-01": {"ajax_action": "blnotifier_blinks", "conditions": [{"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh)://|^https?://(?:localhost(?=[:/]|$)|\\\\[?::1\\\\]?|0\\\\.|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|metadata\\\\.google\\\\.internal(?=[:/]|$)))~i"}], "cve": "CVE-2025-6851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6851", "description": "Broken Link Notifier <=1.3.0 unauthenticated SSRF via blnotifier_blinks AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-notifier", "tags": ["ssrf", "unauthenticated", "cwe-918"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-6851-02": {"ajax_action": "blnotifier_rescan", "conditions": [{"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh)://|^https?://(?:localhost(?=[:/]|$)|\\\\[?::1\\\\]?|0\\\\.|127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|metadata\\\\.google\\\\.internal(?=[:/]|$)))~i"}], "cve": "CVE-2025-6851", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6851", "description": "Broken Link Notifier <=1.3.0 unauthenticated SSRF via blnotifier_rescan AJAX action", "method": "POST", "mode": "block", "severity": 6.5, "slug": "broken-link-notifier", "tags": ["ssrf", "unauthenticated", "cwe-918"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2025-6895-01": {"action": "init", "conditions": [{"name": "ARGS:mls_temp_user_token", "type": "exists"}], "cve": "CVE-2025-6895", "method": "GET", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <=2.1.1"}, "RULE-CVE-2025-6895-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "delete_link"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6895", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <2.1.1"}, "RULE-CVE-2025-6895-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "disable_link"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6895", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <2.1.1"}, "RULE-CVE-2025-6895-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "enable_link"}, {"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6895", "mode": "block", "severity": 9.8, "slug": "melapress-login-security", "target": "plugin", "versions": ">=2.1.0 <2.1.1"}, "RULE-CVE-2025-68974-01": {"ajax_action": "mo_openid_app_instructions", "conditions": [{"name": "ARGS:app_name", "type": "regex", "value": "~(?:\\\\.\\\\.[/\\\\\\\\]|(?:php|phar|data|expect|zip)://)~i"}], "cve": "CVE-2025-68974", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-68974", "description": "WordPress Social Login and Register <=7.7.0 authenticated local file inclusion via app_name in mo_openid_app_instructions AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "miniorange-login-openid", "tags": ["local-file-inclusion", "path-traversal", "php-stream-wrapper", "authenticated"], "target": "plugin", "versions": "<=7.7.0"}, "RULE-CVE-2025-69034-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69034", "description": "lekker theme <= 1.8 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "lekker", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-69034-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69034", "description": "lekker theme <= 1.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "lekker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.8"}, "RULE-CVE-2025-69058-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69058", "description": "partymaker theme <= 1.1.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "partymaker", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.15"}, "RULE-CVE-2025-69058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69058", "description": "partymaker theme <= 1.1.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "partymaker", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.15"}, "RULE-CVE-2025-69059-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69059", "description": "diveit theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "diveit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69059-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69059", "description": "diveit theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "diveit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69060-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69060", "description": "ureach theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ureach", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69060-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69060", "description": "ureach theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ureach", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69061-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69061", "description": "moveme theme <= 1.2.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "moveme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.15"}, "RULE-CVE-2025-69061-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69061", "description": "moveme theme <= 1.2.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "moveme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.15"}, "RULE-CVE-2025-69062-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69062", "description": "weedles theme <= 1.1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "weedles", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2025-69062-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69062", "description": "weedles theme <= 1.1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "weedles", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2025-69064-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69064", "description": "petsland theme <= 1.2.8 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "petsland", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.8"}, "RULE-CVE-2025-69064-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69064", "description": "petsland theme <= 1.2.8 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "petsland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.8"}, "RULE-CVE-2025-69065-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69065", "description": "snowmountain theme <= 1.4.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "snowmountain", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69065-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69065", "description": "snowmountain theme <= 1.4.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "snowmountain", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.3"}, "RULE-CVE-2025-69066-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69066", "description": "indoor-plants theme <= 1.2.7 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "indoor-plants", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.7"}, "RULE-CVE-2025-69066-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69066", "description": "indoor-plants theme <= 1.2.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "indoor-plants", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.7"}, "RULE-CVE-2025-69067-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69067", "description": "tails theme <= 1.4.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tails", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.12"}, "RULE-CVE-2025-69067-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69067", "description": "tails theme <= 1.4.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tails", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.12"}, "RULE-CVE-2025-69068-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69068", "description": "muji theme <= 1.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "muji", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2025-69068-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69068", "description": "muji theme <= 1.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "muji", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2025-69070-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69070", "description": "tornados theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tornados", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2025-69070-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69070", "description": "tornados theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tornados", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2025-69071-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69071", "description": "tantum theme <= 1.1.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tantum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-69071-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69071", "description": "tantum theme <= 1.1.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tantum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.13"}, "RULE-CVE-2025-69072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69072", "description": "prider theme <= 1.1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "prider", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.3.1"}, "RULE-CVE-2025-69072-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69072", "description": "prider theme <= 1.1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "prider", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.3.1"}, "RULE-CVE-2025-69073-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69073", "description": "piqes theme <= 1.0.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "piqes", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-69073-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69073", "description": "piqes theme <= 1.0.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "piqes", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.11"}, "RULE-CVE-2025-69074-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69074", "description": "pearsonspecter theme <= 1.11.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pearsonspecter", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.11.3"}, "RULE-CVE-2025-69074-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69074", "description": "pearsonspecter theme <= 1.11.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pearsonspecter", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.11.3"}, "RULE-CVE-2025-69075-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69075", "description": "yolox theme <= 1.0.15 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "yolox", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-69075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69075", "description": "yolox theme <= 1.0.15 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "yolox", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.15"}, "RULE-CVE-2025-69076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69076", "description": "modernhousewife theme <= 1.0.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "modernhousewife", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-69076-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69076", "description": "modernhousewife theme <= 1.0.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "modernhousewife", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.12"}, "RULE-CVE-2025-69077-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69077", "description": "hobo theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hobo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-69077-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69077", "description": "hobo theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hobo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2025-69078-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69078", "description": "malta theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "malta", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69078-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69078", "description": "malta theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "malta", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2025-69408-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69408", "description": "healthfirst theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "healthfirst", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2025-69408-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69408", "description": "healthfirst theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "healthfirst", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2025-69409-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2025-69409", "description": "pj theme <= 3.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pj", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=3.0.0"}, "RULE-CVE-2025-69409-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2025-69409", "description": "pj theme <= 3.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pj", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.0.0"}, "RULE-CVE-2025-6941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\s[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|\\\\\'[^\\\\\']*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|[^\\\\]]*?(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f]))~i"}], "cve": "CVE-2025-6941", "method": "POST", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-6941-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-json/wp/v[12]/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\s[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|\\\\\'[^\\\\\']*(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f])|[^\\\\]]*?(?:<[a-z]|on\\\\w+\\\\s*=|javascript\\\\s*:|&#|\\\\\\\\x[0-9a-f]))~i"}], "cve": "CVE-2025-6941", "method": "POST", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-6970-01": {"ajax_action": "search_events", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_events AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-02": {"ajax_action": "search_events_grouped", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_events_grouped AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-03": {"ajax_action": "search_locations", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_locations AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-04": {"ajax_action": "search_tags", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_tags AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-05": {"ajax_action": "search_cats", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in search_cats AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6970-06": {"ajax_action": "WP_FullCalendar", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|SLEEP\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|BENCHMARK\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|(?:[\\"\'`]\\\\s*(?:OR|AND)\\\\s+[\\"\'`0-9])|ORDER\\\\s+BY\\\\s+(?:IF|CASE|SLEEP|BENCHMARK)\\\\s*(?:\\\\*\\\\/)?\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2025-6970", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6970", "description": "Events Manager <=7.0.3 unauthenticated SQL injection via orderby parameter in WP_FullCalendar AJAX handler", "mode": "block", "severity": 7.5, "slug": "events-manager", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6976-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(events_list|events_calendar|locations_list|events_list_grouped)\\\\b[^\\\\]]*(?:no_results_msg)\\\\s*=[^\\\\]]*<~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6976", "description": "Events Manager <=7.0.3 Stored XSS via shortcode attributes (format_header, format_footer, no_results_msg, format) in post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "events-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6976-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(events_list|events_calendar|locations_list|events_list_grouped)\\\\b[^\\\\]]*(?:no_results_msg)\\\\s*=[^\\\\]]*<~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6976", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6976", "description": "Events Manager <=7.0.3 Stored XSS via shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 5.4, "slug": "events-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.0.3"}, "RULE-CVE-2025-6987-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[advanced_iframe\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousemove|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|/script|img\\\\b[^>]+onerror|svg\\\\b[^>]+onload|iframe\\\\b[^>]+srcdoc))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6987", "description": "Advanced iFrame <=2025.5 authenticated (Contributor+) Stored XSS via advanced_iframe shortcode in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2025.5"}, "RULE-CVE-2025-6987-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[advanced_iframe\\\\b[^\\\\]]*(?:on(?:load|error|click|mouseover|focus|blur|mouseout|mousemove|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:script|/script|img\\\\b[^>]+onerror|svg\\\\b[^>]+onload|iframe\\\\b[^>]+srcdoc))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-6987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6987", "description": "Advanced iFrame <=2025.5 authenticated (Contributor+) Stored XSS via advanced_iframe shortcode in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2025.5"}, "RULE-CVE-2025-6993-01": {"ajax_action": "ewd_uwpm_get_email_log_details", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-6993", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ultimate-wp-mail", "target": "plugin", "versions": ">=1.0.17 <=1.3.6"}, "RULE-CVE-2025-7035-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode event handler injection in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7035-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode javascript URI injection in post_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7035-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode event handler injection in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7035-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mla_(tag_cloud|term_list)\\\\b[^\\\\]]*javascript\\\\s*:~i"}], "cve": "CVE-2025-7035", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7035", "description": "Media Library Assistant <=3.26 stored XSS via mla_tag_cloud/mla_term_list shortcode javascript URI injection in REST API post content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "media-library-assistant", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.26"}, "RULE-CVE-2025-7038-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:route_name", "type": "regex", "value": "~^steps__load_step$~i"}, {"name": "ARGS:customer[email]", "type": "regex", "value": "~.+~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7038", "method": "POST", "mode": "block", "severity": 8.2, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-7040-01": {"action": "admin_post_nopriv_set_organization_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "set_organization_settings"}], "cve": "CVE-2025-7040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7040", "method": "POST", "mode": "block", "severity": 8.2, "slug": "cloud-sso-single-sign-on", "tags": ["cwe-862", "missing-authorization", "csrf", "sso"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-7040-02": {"action": "admin_post_set_organization_settings", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "set_organization_settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7040", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7040", "method": "POST", "mode": "block", "severity": 8.2, "slug": "cloud-sso-single-sign-on", "tags": ["cwe-862", "missing-authorization", "csrf", "sso"], "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-7045-01": {"action": "init", "conditions": [{"name": "ARGS:csso_action", "type": "equals", "value": "delete_config"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7045", "method": "POST", "mode": "block", "severity": 6.5, "slug": "cloud-sso-single-sign-on", "target": "plugin", "versions": "<=1.0.19"}, "RULE-CVE-2025-7052-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:route_name", "type": "equals", "value": "customer_cabinet__change_password"}], "cve": "CVE-2025-7052", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "target": "plugin", "versions": "<=5.1.94"}, "RULE-CVE-2025-7354-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[su_(?:button|expand|members|post|user)\\\\s[^\\\\]]*(?:<\\\\s*(?:script|svg|img|iframe|object|embed|video|audio|body|input|details|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|submit|change|input|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-7354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7354", "description": "Shortcodes Ultimate <=7.4.2 Stored XSS via malicious shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=7.4.2"}, "RULE-CVE-2025-7354-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[su_(?:button|expand|members|post|user)\\\\s[^\\\\]]*(?:<\\\\s*(?:script|svg|img|iframe|object|embed|video|audio|body|input|details|marquee)\\\\b|\\\\bon(?:error|load|click|mouseover|focus|blur|mouseout|mouseenter|mouseleave|submit|change|input|keydown|keyup|keypress)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-7354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7354", "description": "Shortcodes Ultimate <=7.4.2 Stored XSS via malicious shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "shortcodes-ultimate", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=7.4.2"}, "RULE-CVE-2025-7367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpmtst_update_custom_fields"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|<iframe[^>]*>|<svg[^>]*>|<embed[^>]*>|<object[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|beforeprint)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-7367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7367", "description": "Strong Testimonials <=3.2.11 Stored XSS via custom field values on admin-post.php wpmtst_update_custom_fields action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2025-7367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpm-testimonial"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|<iframe[^>]*>|<svg[^>]*>|<embed[^>]*>|<object[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|toggle|animationend|beforeprint)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-7367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7367", "description": "Strong Testimonials <=3.2.11 Stored XSS via custom field values on post.php wpm-testimonial post type save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=3.2.11"}, "RULE-CVE-2025-7369-01": {"ajax_action": "su_generator_preview", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~(?:javascript\\\\s*:|on(?:abort|blur|change|click|dblclick|error|focus|input|keydown|keypress|keyup|load|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|pointerdown|pointerenter|pointerleave|pointermove|pointerout|pointerover|pointerup|reset|resize|scroll|select|submit|touchcancel|touchend|touchmove|touchstart|unload|wheel|animationend|animationiteration|animationstart|transitionend|transitionrun|transitionstart|toggle|contextmenu|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|focusin|focusout|gotpointercapture|lostpointercapture|paste|copy|cut|beforeunload|hashchange|message|offline|online|pagehide|pageshow|popstate|storage|afterprint|beforeprint)\\\\s*=|<(?:iframe|embed|object|form|svg|math)[\\\\s/>])~i"}], "cve": "CVE-2025-7369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7369", "description": "Shortcodes Ultimate <=7.4.2 CSRF to arbitrary shortcode execution via su_generator_preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "shortcodes-ultimate", "tags": ["csrf", "xss", "shortcode-execution"], "target": "plugin", "versions": "<=7.4.2"}, "RULE-CVE-2025-7400-01": {"action": "save_post", "conditions": [{"name": "ARGS:fifu_image_alt", "type": "regex", "value": "~<[a-z/!?]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-7400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7400", "description": "Featured Image from URL <=5.2.7 Stored XSS via fifu_image_alt parameter on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "featured-image-from-url", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-7400-02": {"action": "save_post", "conditions": [{"name": "ARGS:fifu_image_url", "type": "regex", "value": "~(?:javascript\\\\s*:|<[a-z/!?])~i"}], "cve": "CVE-2025-7400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7400", "description": "Featured Image from URL <=5.2.7 Stored XSS via fifu_image_url parameter on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "featured-image-from-url", "tags": ["xss", "stored-xss", "contributor-plus"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-7431-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kb_slug", "type": "regex", "value": "~[<>\\"\']|on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7431", "description": "Knowledge Base <=2.3.1 Authenticated (Administrator+) Stored XSS via kb_slug setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "settings-abuse"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-7431-02": {"action": "admin_init", "conditions": [{"name": "ARGS:category_slug", "type": "regex", "value": "~[<>\\"\']|on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7431", "description": "Knowledge Base <=2.3.1 Authenticated (Administrator+) Stored XSS via category_slug setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "settings-abuse"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-7431-03": {"action": "admin_init", "conditions": [{"name": "ARGS:tag_slug", "type": "regex", "value": "~[<>\\"\']|on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7431", "description": "Knowledge Base <=2.3.1 Authenticated (Administrator+) Stored XSS via tag_slug setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "knowledgebase", "tags": ["xss", "stored-xss", "settings-abuse"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2025-7495-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpmem_(?:login|reg)_link\\\\s+(?=[^\\\\]]*\\\\b(?!(?:id|class|href)\\\\b)[a-z][a-z0-9_-]*\\\\s*=)~i"}], "cve": "CVE-2025-7495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7495", "description": "WP-Members <=3.5.4.1 Stored XSS via wpmem_login_link/wpmem_reg_link shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.5.4.1"}, "RULE-CVE-2025-7495-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpmem_(?:login|reg)_link\\\\s+(?=[^\\\\]]*\\\\b(?!(?:id|class|href)\\\\b)[a-z][a-z0-9_-]*\\\\s*=)~i"}], "cve": "CVE-2025-7495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7495", "description": "WP-Members <=3.5.4.1 Stored XSS via wpmem_login_link/wpmem_reg_link shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-members", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.5.4.1"}, "RULE-CVE-2025-7498-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~exad.countdown~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|form|input|button|select|textarea|base|meta|link)(?:\\\\s|/|>)|\\\\bon(?:error|load|click|mouse(?:over|out|enter|leave|move|down|up)|focus|blur|change|submit|reset|key(?:down|up|press)|touch(?:start|end|move)|pointer(?:down|up|over|out|enter|leave|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7498", "description": "Exclusive Addons for Elementor <=2.7.9.4 Stored XSS via Countdown widget labels on post save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.7.9.4"}, "RULE-CVE-2025-7498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "contains", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~exad.countdown~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|details|math|video|audio|body|marquee|form|input|button|select|textarea|base|meta|link)(?:\\\\s|/|>)|\\\\bon(?:error|load|click|mouse(?:over|out)|focus|blur|change|submit|key(?:down|up|press))\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7498", "description": "Exclusive Addons for Elementor <=2.7.9.4 Stored XSS via Countdown widget labels on Elementor AJAX save", "method": "POST", "mode": "block", "severity": 5.4, "slug": "exclusive-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "ajax"], "target": "plugin", "versions": "<=2.7.9.4"}, "RULE-CVE-2025-7500-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<script[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon\\\\w+\\\\s*=|\\\\bjavascript\\\\s*:|<(?:iframe|embed|object|svg|math)[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:iframe|embed|object|svg|math)\\\\b)~i"}], "cve": "CVE-2025-7500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7500", "description": "Ocean Social Sharing <=2.2.1 Stored XSS via post_title in wp-admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-social-sharing", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-7500-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:<script[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*script\\\\b|\\\\bon\\\\w+\\\\s*=|\\\\bjavascript\\\\s*:|<(?:iframe|embed|object|svg|math)[^>]*>|(?:&lt;|&#0*60;|&#x0*3c;)\\\\s*(?:iframe|embed|object|svg|math)\\\\b)~i"}], "cve": "CVE-2025-7500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7500", "description": "Ocean Social Sharing <=2.2.1 Stored XSS via title in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-social-sharing", "tags": ["xss", "stored-xss", "rest-api", "contributor"], "target": "plugin", "versions": "<=2.2.1"}, "RULE-CVE-2025-7634-01": {"ajax_action": "wte_filter_trips_html", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:\\\\.\\\\.%2[fF])|(?:%2[eE]%2[eE][\\\\\\\\/])|[a-z]+://)~i"}], "cve": "CVE-2025-7634", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7634", "description": "WP Travel Engine <=6.6.7 unauthenticated Local File Inclusion via mode parameter in FilterTripsHtml AJAX controller", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "remote-code-execution"], "target": "plugin", "versions": "<=6.6.7"}, "RULE-CVE-2025-7634-02": {"ajax_action": "wte_load_trips_html", "conditions": [{"name": "ARGS:mode", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|(?:\\\\.\\\\.%2[fF])|(?:%2[eE]%2[eE][\\\\\\\\/])|[a-z]+://)~i"}], "cve": "CVE-2025-7634", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7634", "description": "WP Travel Engine <=6.6.7 unauthenticated Local File Inclusion via mode parameter in LoadTripsHtml AJAX controller", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "remote-code-execution"], "target": "plugin", "versions": "<=6.6.7"}, "RULE-CVE-2025-7638-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^forminator-(?:entries|report)$~"}, {"name": "ARGS:order_by", "type": "exists"}, {"name": "ARGS:order_by", "type": "regex", "value": "~^(?!entries\\\\.(?:date_created|entry_id)$).+~i"}], "cve": "CVE-2025-7638", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7638", "description": "Forminator Forms <=1.45.0 authenticated (Administrator+) SQL injection via order_by parameter in entries listing", "method": "GET", "mode": "block", "severity": 4.9, "slug": "forminator", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.45.0"}, "RULE-CVE-2025-7638-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^forminator-(?:entries|report)$~"}, {"name": "ARGS:order", "type": "exists"}, {"name": "ARGS:order", "type": "regex", "value": "~^(?!(?:DESC|ASC)$).+~i"}], "cve": "CVE-2025-7638", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7638", "description": "Forminator Forms <=1.45.0 authenticated (Administrator+) SQL injection via order parameter in entries listing", "method": "GET", "mode": "block", "severity": 4.9, "slug": "forminator", "tags": ["sql-injection", "authenticated", "order-by-injection"], "target": "plugin", "versions": "<=1.45.0"}, "RULE-CVE-2025-7650-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF])~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode path traversal in post_content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7650-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:php://|data://|expect://|phar://|/etc/|/var/|/tmp/|/proc/)~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode PHP wrapper or absolute path in post_content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7650-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.\\\\.%2[fF])~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode path traversal in REST API content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "path-traversal", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7650-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bizcalv[^\\\\]]*(?:php://|data://|expect://|phar://|/etc/|/var/|/tmp/|/proc/)~i"}], "cve": "CVE-2025-7650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650", "description": "BizCalendar Web <=1.1.0.53 authenticated (Contributor+) Local File Inclusion via bizcalv shortcode PHP wrapper or absolute path in REST API content", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bizcalendar-web", "tags": ["local-file-inclusion", "php-wrapper", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.1.0.53"}, "RULE-CVE-2025-7654-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wf_get_cookie\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7654", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7654", "description": "FunnelKit Funnel Builder <=3.11.0.1 sensitive information exposure via wf_get_cookie shortcode in post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "funnel-builder", "tags": ["sensitive-info-exposure", "shortcode", "cookie-disclosure", "stored-content"], "target": "plugin", "versions": "<=3.11.0.1"}, "RULE-CVE-2025-7654-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wf_get_cookie\\\\b~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-7654", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7654", "description": "FunnelKit Funnel Builder <=3.11.0.1 sensitive information exposure via wf_get_cookie shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "funnel-builder", "tags": ["sensitive-info-exposure", "shortcode", "cookie-disclosure", "rest-api"], "target": "plugin", "versions": "<=3.11.0.1"}, "RULE-CVE-2025-7661-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[martinus\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|</?script|\\\\\\\\x[0-9a-fA-F]|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7661", "description": "Partnersk\\u00fd syst\\u00e9m Martinus <=1.7.1 Stored XSS via [martinus] shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "martinus-partnersky-system", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-7661-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[martinus\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|</?script|\\\\\\\\x[0-9a-fA-F]|&#(?:x[0-9a-fA-F]+|\\\\d+);)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7661", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7661", "description": "Partnersk\\u00fd syst\\u00e9m Martinus <=1.7.1 Stored XSS via [martinus] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "martinus-partnersky-system", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.7.1"}, "RULE-CVE-2025-7665-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-admin/)?(?:admin-post\\\\.php|admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:default_user_role", "type": "equals", "value": "administrator"}], "cve": "CVE-2025-7665", "method": "POST", "mode": "block", "severity": 8.1, "slug": "miniorange-firebase-sms-otp-verification", "target": "plugin", "versions": ">=3.1.0 <=3.6.2"}, "RULE-CVE-2025-7670-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/js-archive-list/v1/archive(?:/|[?&]|$)~"}, {"name": "ARGS:include", "type": "detectSQLi"}], "cve": "CVE-2025-7670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7670", "description": "JS Archive List <=6.1.5 unauthenticated SQL injection via include parameter on REST archives endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-7670-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/js-archive-list/v1/archive(?:/|[?&]|$)~"}, {"name": "ARGS:exclude", "type": "detectSQLi"}], "cve": "CVE-2025-7670", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7670", "description": "JS Archive List <=6.1.5 unauthenticated SQL injection via exclude parameter on REST archives endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.1.5"}, "RULE-CVE-2025-7689-01": {"ajax_action": "tfhb_reset_password", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:action", "type": "equals", "value": "tfhb_reset_password"}], "cve": "CVE-2025-7689", "method": "POST", "mode": "block", "severity": 8.8, "slug": "hydra-booking", "target": "plugin", "versions": ">=1.1.0 <=1.1.18"}, "RULE-CVE-2025-7695-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/icds/v1/reset_password_link(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-7695", "method": "GET", "mode": "block", "severity": 8.8, "slug": "integration-cds", "target": "plugin", "versions": ">=2.77 <=2.81"}, "RULE-CVE-2025-7695-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/icds/v1/reset_password(?:/|\\\\?|&|$)~i"}, {"type": "missing_capability", "value": "edit_users"}], "cve": "CVE-2025-7695", "method": "POST", "mode": "block", "severity": 8.8, "slug": "integration-cds", "target": "plugin", "versions": ">=2.77 <=2.81"}, "RULE-CVE-2025-7696-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2025-7696", "method": "POST", "mode": "block", "severity": 9.8, "slug": "integration-for-contact-form-7-and-pipedrive", "target": "plugin", "versions": "<=1.2.3"}, "RULE-CVE-2025-7711-01": {"ajax_action": "rtcl_post_new_listing", "conditions": [{"name": "ARGS:description", "type": "regex", "value": "~\\\\[\\\\s*[A-Za-z_][A-Za-z0-9_-]{2,}[\\\\s\\\\]/]~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-7711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7711", "description": "Classified Listing <=5.0.3 authenticated (Subscriber+) arbitrary shortcode execution via listing description on rtcl_post_new_listing", "method": "POST", "mode": "block", "severity": 5.4, "slug": "classified-listing", "tags": ["code-injection", "shortcode-execution", "authenticated"], "target": "plugin", "versions": "<=5.0.3"}, "RULE-CVE-2025-7711-02": {"ajax_action": "rtcl_update_listing", "conditions": [{"name": "ARGS:description", "type": "regex", "value": "~\\\\[\\\\s*[A-Za-z_][A-Za-z0-9_-]{2,}[\\\\s\\\\]/]~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-7711", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7711", "description": "Classified Listing <=5.0.3 authenticated (Subscriber+) arbitrary shortcode execution via listing description on rtcl_update_listing", "method": "POST", "mode": "block", "severity": 5.4, "slug": "classified-listing", "tags": ["code-injection", "shortcode-execution", "authenticated"], "target": "plugin", "versions": "<=5.0.3"}, "RULE-CVE-2025-7722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/bwapi/[0-9]+/site/usermeta/wp_([0-9]+_)?(capabilities|user_level)(?:/)?(?:[?].*)?$~i"}], "cve": "CVE-2025-7722", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7722", "description": "Social Streams <=1.0.1 privilege escalation via update_user_meta() in bwapi usermeta endpoint allows Subscriber+ to set wp_capabilities", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-streams", "tags": ["privilege-escalation", "update-user-meta", "social-streams"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-7727-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:gutenverse/animated-text[^}]*[\\"\']htmlTag[\\"\']\\\\s*:\\\\s*[\\"\']script[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7727", "description": "Gutenverse <=3.1.0 Stored XSS via Animated Text block htmlTag attribute injection through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-7727-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:gutenverse/fun-?fact[^>]*>.*?\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-7727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7727", "description": "Gutenverse <=3.1.0 Stored XSS via Fun Fact block event handler injection through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2025-7780-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleTranscribeAudio(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:(?!https?://)\\\\S+://|/|\\\\.{1,2}/|[A-Za-z]:\\\\\\\\)~i"}], "cve": "CVE-2025-7780", "description": "AI Engine <= 2.9.4 \\u2013 Arbitrary file read via non-HTTP scheme in simpleTranscribeAudio url param (file_get_contents sink)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ai-engine", "target": "plugin", "versions": "<=2.9.4"}, "RULE-CVE-2025-7808-01": {"action": "init", "conditions": [{"name": "ARGS:product", "type": "detectXSS"}], "cve": "CVE-2025-7808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7808", "description": "WP Shopify <1.5.4 Reflected XSS via product query parameter in [wp-shopify-continue-shopping] shortcode", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-shopify", "tags": ["xss", "reflected-xss", "shortcode", "unauthenticated"], "target": "plugin", "versions": "<1.5.4"}, "RULE-CVE-2025-7813-01": {"action": "init", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^(?:file|gopher|dict|ftp|ldap|tftp|expect|php|data|glob|phar|ssh2|ogg|zlib|rar|compress\\\\.zlib)\\\\s*:~i"}], "cve": "CVE-2025-7813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7813", "description": "Eventin <=4.0.37.1 unauthenticated SSRF via proxy_image dangerous URI schemes in url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "tags": ["ssrf", "unauthenticated", "scheme-abuse"], "target": "plugin", "versions": "<=4.0.37.1"}, "RULE-CVE-2025-7813-02": {"action": "init", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~^https?://(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|localhost|\\\\[?::1\\\\]?|0x[0-9a-f]+|0[0-7]+\\\\.)~i"}], "cve": "CVE-2025-7813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7813", "description": "Eventin <=4.0.37.1 unauthenticated SSRF via proxy_image internal IP targets in url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-event-solution", "tags": ["ssrf", "unauthenticated", "internal-network"], "target": "plugin", "versions": "<=4.0.37.1"}, "RULE-CVE-2025-7847-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai(?:-ui)?/v1/(?:files/upload|simpleFileUpload)(/|\\\\?|$)~i"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:php[0-8]?|phps|pht|phtml|phar|cgi|pl|sh|htaccess)$~i"}], "cve": "CVE-2025-7847", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-7847", "description": "AI Engine >=2.9.3 <=2.9.4 authenticated arbitrary file upload via simpleFileUpload REST endpoint", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["arbitrary-file-upload", "rest-api", "authenticated"], "target": "plugin", "versions": ">=2.9.3 <=2.9.4"}, "RULE-CVE-2025-8059-01": {"ajax_action": "rgfr_registration", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:^|,)\\\\s*administrator\\\\s*(?:,|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8059", "method": "POST", "mode": "block", "severity": 9.8, "slug": "b-blocks", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2025-8072-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~placeholder_img\\\\s*=\\\\s*([\\"\'])(?:(?!\\\\1).){0,300}?(?:<script|\\\\bon(?:error|load|mouseover|click|focus|mouseenter)\\\\s*=|javascript\\\\s*:)~is"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8072", "description": "Target Video Easy Publish <=3.8.8 Stored XSS via placeholder_img shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "brid-video-easy-publish", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.8.8"}, "RULE-CVE-2025-8073-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[plugincy_filters_single\\\\b[^\\\\]]*name\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-8073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8073", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via plugincy_filters_single shortcode name attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-8073-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[plugincy_filters_single\\\\b[^\\\\]]*name\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2025-8073", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8073", "description": "Dynamic AJAX Product Filters for WooCommerce <=1.3.7 Stored XSS via plugincy_filters_single shortcode name attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-ajax-product-filters-for-woocommerce", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2025-8081-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~tmp_name[\\"\']?\\\\s*[:=]\\\\s*[\\"\']?(?:\\\\.\\\\.[\\\\\\\\/]|/(?:etc|proc|var|usr|home|root)/|[a-zA-Z]:\\\\\\\\|wp-config\\\\.php|%00|\\\\\\\\x00|\\\\\\\\u002e)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8081", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elementor", "target": "plugin", "versions": "<=3.30.2"}, "RULE-CVE-2025-8081-02": {"ajax_action": "elementor_library_direct_actions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8081", "method": "POST", "mode": "block", "severity": 4.9, "slug": "elementor", "target": "plugin", "versions": "<=3.30.2"}, "RULE-CVE-2025-8084-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/helpers/create-images(/|\\\\?|$)~i"}, {"name": "ARGS:url", "type": "exists"}, {"name": "ARGS:url", "type": "regex", "value": "~https?://(?:127\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|10\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.\\\\d+\\\\.\\\\d+|192\\\\.168\\\\.\\\\d+\\\\.\\\\d+|169\\\\.254\\\\.\\\\d+\\\\.\\\\d+|0+177\\\\.|0x7f|0x0*a\\\\.|0x0*ac\\\\.(?:1[0-9a-f]|2[0-9a-f]|3[01])|0x0*c0\\\\.a8|localhost|\\\\[?::1\\\\]?|metadata\\\\.google\\\\.internal)~i"}], "cve": "CVE-2025-8084", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-8084-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/helpers/create-images(/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-8084", "method": "POST", "mode": "block", "severity": 6.8, "slug": "ai-engine", "target": "plugin", "versions": "<=3.1.8"}, "RULE-CVE-2025-8089-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - Classic Editor event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8089-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*(?:<script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - Classic Editor script/javascript injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8089-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - REST API event handler injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8089-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[advanced[_-]iframe[^\\\\]]*additional\\\\s*=[^\\\\]]*(?:<script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8089", "description": "Advanced iFrame <=2025.6 Stored XSS via shortcode \'additional\' attribute - REST API script/javascript injection", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-iframe", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2025.6"}, "RULE-CVE-2025-8100-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "contains", "value": "marker_content"}, {"name": "ARGS:actions", "type": "regex", "value": "~marker_content[^}]*(?:<\\\\s*script|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:iframe|embed|object|svg)[^>]*\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8100", "description": "Element Pack Elementor Addons <=8.1.5 Stored XSS via Open Street Map widget marker_content", "method": "POST", "mode": "block", "severity": 5.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=8.1.5"}, "RULE-CVE-2025-8102-01": {"action": "admin_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:edd-action", "type": "regex", "value": "~^tools_tab_debug_log$~"}], "cve": "CVE-2025-8102", "mode": "block", "severity": 6.5, "slug": "easy-digital-downloads", "target": "plugin", "versions": "<4.0"}, "RULE-CVE-2025-8149-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"athemes-addons-countdown\\"~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~\\"widgetType\\"\\\\s*:\\\\s*\\"athemes-addons-countdown\\"(?s:.{0,2000})(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-8149", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8149", "description": "aThemes Addons for Elementor <=1.1.2 Stored XSS via Countdown widget attributes through Elementor save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "athemes-addons-for-elementor-lite", "tags": ["xss", "stored-xss", "elementor-widget", "authenticated"], "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-8268-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/mwai-ui/v1/files/list|[?&]rest_route=/mwai-ui/v1/files/list)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8268", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ai-engine", "target": "plugin", "versions": "<=2.9.5"}, "RULE-CVE-2025-8268-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-json/mwai-ui/v1/files/delete|[?&]rest_route=/mwai-ui/v1/files/delete)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8268", "method": "POST", "mode": "block", "severity": 6.5, "slug": "ai-engine", "target": "plugin", "versions": "<=2.9.5"}, "RULE-CVE-2025-8294-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[download_counter_url\\\\s[^\\\\]]*name\\\\s*=\\\\s*(?:\'[^\']*(?:<[^>]+>|on[a-zA-Z]+=)[^\']*\'|\\"[^\\"]*(?:<[^>]+>|on[a-zA-Z]+=)[^\\"]*\\"|[^\\\\]\\\\s\'\\"]*(?:<[^>]+>|on[a-zA-Z]+=)[^\\\\]\\\\s]*)~i"}], "cve": "CVE-2025-8294", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8294", "description": "Download Counter <=1.3 Authenticated (Contributor+) Stored XSS via download_counter_url shortcode name attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "download-counter", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.3"}, "RULE-CVE-2025-8295-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[emd_form\\\\b[^\\\\]]*noaccess_msg\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}], "cve": "CVE-2025-8295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8295", "description": "Employee Directory <=4.5.1 Authenticated (Contributor+) Stored XSS via noaccess_msg shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-directory", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-8295-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[emd_form\\\\b[^\\\\]]*noaccess_msg\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]*(?:script|on\\\\w+\\\\s*=|javascript:)~i"}], "cve": "CVE-2025-8295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8295", "description": "Employee Directory <=4.5.1 Authenticated (Contributor+) Stored XSS via noaccess_msg shortcode attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-directory", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.5.1"}, "RULE-CVE-2025-8316-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[certificawp\\\\s[^\\\\]]*evento\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+>[^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-8316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8316", "description": "Certifica WP <=3.1 Stored XSS via evento shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "certifica-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-8316-02": {"action": "init", "conditions": [{"name": "ARGS:certificawp", "type": "regex", "value": "~(?:<[^>]*(?:script|img|svg|iframe|object|embed|link|style|body|marquee|video|audio|details|math|base|form|input|button|select|textarea|keygen|isindex)[^>]*>|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text\\\\/html)~i"}], "cve": "CVE-2025-8316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8316", "description": "Certifica WP <=3.1 Reflected XSS via certificawp GET parameter", "method": "GET", "mode": "block", "severity": 6.4, "slug": "certifica-wp", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2025-8342-01": {"ajax_action": "lwp_ajax_register", "conditions": [{"name": "ARGS:phone_number", "type": "exists"}], "cve": "CVE-2025-8342", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8342", "description": "Login With Phone Number <=1.8.47 unauthenticated authentication bypass via lwp_ajax_register OTP verification logic flaw", "method": "POST", "mode": "block", "severity": 8.1, "slug": "login-with-phone-number", "tags": ["authentication-bypass", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.8.47"}, "RULE-CVE-2025-8398-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:url|link)\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2025-8398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8398", "description": "azurecurve BBCode <=2.0.4 Stored XSS via [url] shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "azurecurve-bbcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-8398-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:url|link)\\\\s*=\\\\s*[\\"\']?\\\\s*(?:javascript|vbscript|data)\\\\s*:~i"}], "cve": "CVE-2025-8398", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8398", "description": "azurecurve BBCode <=2.0.4 Stored XSS via [url] shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "azurecurve-bbcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.4"}, "RULE-CVE-2025-8416-01": {"ajax_action": "wpf_dynamic_action", "conditions": [{"name": "ARGS:filtersDataBackend", "type": "exists"}, {"name": "ARGS:filtersDataBackend", "type": "regex", "value": "~(?:UNION +(?:ALL +)?SELECT|SELECT +.+? +FROM|INSERT +INTO|UPDATE +[^ ]+ +SET|DELETE +FROM|DROP +(?:TABLE|DATABASE|INDEX)|INTO +(?:OUT|DUMP)FILE|(?:--|/[*]) *(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP)|(?:SLEEP|BENCHMARK|LOAD_FILE|EXTRACTVALUE|UPDATEXML) *[(]|(?:OR|AND) +[0-9]+ *= *[0-9]+|; *(?:DROP|DELETE|INSERT|UPDATE|SELECT))~i"}], "cve": "CVE-2025-8416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8416", "description": "Product Filter by WBW <=2.9.7 unauthenticated SQL injection via filtersDataBackend", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woo-product-filter", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.9.7"}, "RULE-CVE-2025-8420-01": {"ajax_action": "emd_form_builder_lite_pagenum", "conditions": [{"name": "ARGS:form", "type": "regex", "value": "~(?i)\\\\b(?:phpinfo|system|exec|shell_exec|passthru|assert|eval|base64_decode|unlink|file_get_contents|file_put_contents|fopen|fwrite|popen|proc_open|pcntl_exec|dl|mail|header|setcookie|ini_set|ini_restore|putenv|apache_setenv|phpversion|php_uname|php_sapi_name|getmypid|getmyuid|get_current_user|posix_getuid|posix_getpwuid|posix_kill|disk_free_space|disk_total_space|readfile|highlight_file|show_source|wp_die|wp_logout|wp_cache_flush|wp_set_auth_cookie|wp_clear_auth_cookie|delete_option|update_option)\\\\b~"}], "cve": "CVE-2025-8420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8420", "description": "Campus Directory <=1.9.2 unauthenticated limited RCE via dynamic function call in emd_form_builder_lite_pagenum AJAX handler (form parameter)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "campus-directory", "tags": ["remote-code-execution", "eval-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-8420-02": {"ajax_action": "emd_form_builder_lite_pagenum", "conditions": [{"name": "ARGS:app", "type": "regex", "value": "~(?i)\\\\b(?:phpinfo|system|exec|shell_exec|passthru|assert|eval|base64_decode|unlink|file_get_contents|file_put_contents|fopen|fwrite|popen|proc_open|pcntl_exec|dl|mail|header|setcookie|ini_set|ini_restore|putenv|apache_setenv|phpversion|php_uname|php_sapi_name|getmypid|getmyuid|get_current_user|posix_getuid|posix_getpwuid|posix_kill|disk_free_space|disk_total_space|readfile|highlight_file|show_source|wp_die|wp_logout|wp_cache_flush|wp_set_auth_cookie|wp_clear_auth_cookie|delete_option|update_option)\\\\b~"}], "cve": "CVE-2025-8420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8420", "description": "Campus Directory <=1.9.2 unauthenticated limited RCE via dynamic function call in emd_form_builder_lite_pagenum AJAX handler (app parameter)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "campus-directory", "tags": ["remote-code-execution", "eval-injection", "unauthenticated", "function-injection"], "target": "plugin", "versions": "<=1.9.2"}, "RULE-CVE-2025-8425-01": {"ajax_action": "ajax_import_strings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8425", "mode": "block", "severity": 8.8, "slug": "my-wp-translate", "target": "plugin", "versions": "<=1.1.0"}, "RULE-CVE-2025-8483-01": {"ajax_action": "ajax_validation", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[\\\\s*[a-zA-Z_][a-zA-Z0-9_-]*(?:\\\\s[^\\\\]]*)?\\\\]~"}], "cve": "CVE-2025-8483", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8483", "description": "Discussion Board <= 2.5.5 arbitrary shortcode execution via ajax_validation AJAX handler", "method": "POST", "mode": "block", "severity": 6.3, "slug": "wp-discussion-board", "tags": ["code-injection", "shortcode-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.5.5"}, "RULE-CVE-2025-8484-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/|^)wp-content/(?:code-quality-logs/[^/]*[.](log|ini)|_php_errors(?:[.]count)?[.]log|_php_code_control[.]ini)(?:[?#]|$)~i"}], "cve": "CVE-2025-8484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8484", "description": "Code Quality Control Tool <= 2.1 unauthenticated sensitive information exposure via publicly accessible log files", "method": "GET", "mode": "block", "severity": 5.3, "slug": "code-quality-control-tool", "tags": ["information-exposure", "unauthenticated", "log-file-disclosure"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-8484-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/|^)wp-content/code-quality-logs/?(?:[?#]|$)~i"}], "cve": "CVE-2025-8484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8484", "description": "Code Quality Control Tool <= 2.1 unauthenticated directory listing of log directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "code-quality-control-tool", "tags": ["information-exposure", "unauthenticated", "directory-listing"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2025-8489-01": {"ajax_action": "king_addons_register", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "king_addons_register"}, {"name": "ARGS:user_role", "type": "regex", "value": "~^(administrator|editor|author|contributor|shop_manager)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8489", "method": "POST", "mode": "block", "severity": 9.8, "slug": "king-addons", "target": "plugin", "versions": ">=24.12.92 <=51.1.14"}, "RULE-CVE-2025-8559-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:all-in-one-music-player/music-player-selector\\\\b[\\\\s\\\\S]*?\\"theme\\"\\\\s*:\\\\s*\\"[^\\"]*\\\\.\\\\.[/\\\\\\\\]~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-8559", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8559", "description": "All in One Music Player <=1.3.1 authenticated (Contributor+) path traversal via theme block attribute in post_content", "method": "POST", "mode": "block", "severity": 6.5, "slug": "all-in-one-music-player", "tags": ["path-traversal", "local-file-inclusion", "authenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2025-8562-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:lens", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{2,}[\\\\\\\\/]+|%2e%2e(?:%2f|%5c)|%252e%252e)~i"}], "cve": "CVE-2025-8562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8562", "description": "Custom Query Shortcode <=0.4.0 authenticated path traversal via lens parameter", "mode": "block", "severity": 6.5, "slug": "custom-query-shortcode", "tags": ["path-traversal", "local-file-inclusion", "shortcode"], "target": "plugin", "versions": "<=0.4.0"}, "RULE-CVE-2025-8562-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:twig_template", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|\\\\.{2,}[\\\\\\\\/]+|%2e%2e(?:%2f|%5c)|%252e%252e)~i"}], "cve": "CVE-2025-8562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8562", "description": "Custom Query Shortcode <=0.4.0 authenticated path traversal via twig_template parameter", "mode": "block", "severity": 6.5, "slug": "custom-query-shortcode", "tags": ["path-traversal", "local-file-inclusion", "shortcode"], "target": "plugin", "versions": "<=0.4.0"}, "RULE-CVE-2025-8565-01": {"ajax_action": "gdpr_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2025-8565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8565", "description": "WP Legal Pages <=3.4.3 missing authorization on gdpr_install_plugin AJAX handler allows arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wplegalpages", "tags": ["missing-authorization", "arbitrary-plugin-install", "broken-access-control"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2025-8566-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~gutenbee/countup[^}]*(?:prefix|suffix)[^}]*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<[^>]+on(?:error|load|click|mouseover|focus)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8566", "description": "GutenBee <=2.18.0 Stored XSS via CountUp block prefix/suffix attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenbee", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2025-8566-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~gutenbee/google-maps[^}]*(?:<script|<img[^>]+onerror|<svg[^>]+onload|<[^>]+on(?:error|load|click|mouseover|focus)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8566", "description": "GutenBee <=2.18.0 Stored XSS via Google Maps block marker popup attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenbee", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.18.0"}, "RULE-CVE-2025-8588-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~advgb-map-content[^>]*data-(?:title|desc)[^>]*(?:<(?:script|iframe|svg|img|details|object)[^>]*(?:src\\\\s*=\\\\s*(?:javascript|data):|on[a-zA-Z]+=|[/\\\\s>])|on[a-zA-Z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8588", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8588", "description": "PublishPress Blocks <=3.3.4 Stored XSS via Map block Marker Title/Description in classic admin post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advanced-gutenberg", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=3.3.4"}, "RULE-CVE-2025-8604-01": {"ajax_action": "save_table", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur|change|submit|reset|abort|mousedown|mouseup|keydown|keypress|keyup)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s/][^>]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8604", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8604", "description": "WP Table Builder <=2.0.12 authenticated (Contributor+) stored XSS via save_table AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-table-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.12"}, "RULE-CVE-2025-8605-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:gutenify/countup(?:-v2)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script[\\\\s>]|(?:iframe|embed|object|svg|img|a)\\\\b[^>]*(?:on[a-z]+=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8605", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8605", "description": "Gutenify <=1.5.9 Authenticated (Contributor+) Stored XSS via Count Up block attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenify", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2025-8605-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:gutenify/countup(?:-v2)?~"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*(?:script[\\\\s>]|(?:iframe|embed|object|svg|img|a)\\\\b[^>]*(?:on[a-z]+=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8605", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8605", "description": "Gutenify <=1.5.9 Authenticated (Contributor+) Stored XSS via Count Up block attributes in classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenify", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2025-8618-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[woosq(?:_btn)?\\\\b[^\\\\]]*(?:<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:)|<script|<iframe|<svg|<embed|<object)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8618", "description": "WPC Smart Quick View for WooCommerce <=4.2.1 Stored XSS via woosq_btn/woosq shortcode attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-smart-quick-view", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-8618-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[woosq(?:_btn)?\\\\b[^\\\\]]*(?:<[^>]*(?:on\\\\w+\\\\s*=|javascript\\\\s*:)|<script|<iframe|<svg|<embed|<object)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8618", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8618", "description": "WPC Smart Quick View for WooCommerce <=4.2.1 Stored XSS via woosq_btn/woosq shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "woo-smart-quick-view", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-8625-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/copypress/v1/image(/|\\\\?|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|t|tml)|phtml)$~i"}], "cve": "CVE-2025-8625", "method": "POST", "mode": "block", "severity": 9.8, "slug": "copypress-rest-api", "target": "plugin", "versions": ">=1.1 <=1.2"}, "RULE-CVE-2025-8625-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/copypress/v1/image(/|\\\\?|$)~"}, {"name": "ARGS:image_url", "type": "regex", "value": "~\\\\.ph(?:p[0-9]?|t|tml)(?:$|[?#])~i"}], "cve": "CVE-2025-8625", "method": "POST", "mode": "block", "severity": 9.8, "slug": "copypress-rest-api", "target": "plugin", "versions": ">=1.1 <=1.2"}, "RULE-CVE-2025-8676-01": {"ajax_action": "get_active_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-8676", "mode": "block", "severity": 4.3, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-8676-02": {"ajax_action": "get_popular_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2025-8676", "mode": "block", "severity": 4.3, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-8678-01": {"action": "admin_init", "conditions": [{"name": "ARGS:crontrol_action", "type": "equals", "value": "new_url_cron"}, {"name": "ARGS:crontrol_url", "type": "regex", "value": "~(?:^(?!https?://).|://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?(?=[:/\\\\]]|$)|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0x[0-9a-f]+|0[0-3][0-7]{2}\\\\.|metadata\\\\.google\\\\.internal|\\\\d{8,10}(?:[:/]|$)))~i"}], "cve": "CVE-2025-8678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8678", "description": "WP Crontrol 1.17.0-1.19.1 authenticated administrator blind SSRF via new URL cron event creation", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wp-crontrol", "tags": ["ssrf", "authenticated", "cwe-918"], "target": "plugin", "versions": ">=1.17.0 <=1.19.1"}, "RULE-CVE-2025-8678-02": {"action": "admin_init", "conditions": [{"name": "ARGS:crontrol_action", "type": "equals", "value": "edit_url_cron"}, {"name": "ARGS:crontrol_url", "type": "regex", "value": "~(?:^(?!https?://).|://(?:localhost|127\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?(?=[:/\\\\]]|$)|10\\\\.|172\\\\.(?:1[6-9]|2\\\\d|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0x[0-9a-f]+|0[0-3][0-7]{2}\\\\.|metadata\\\\.google\\\\.internal|\\\\d{8,10}(?:[:/]|$)))~i"}], "cve": "CVE-2025-8678", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8678", "description": "WP Crontrol 1.17.0-1.19.1 authenticated administrator blind SSRF via edit URL cron event", "method": "POST", "mode": "block", "severity": 5.9, "slug": "wp-crontrol", "tags": ["ssrf", "authenticated", "cwe-918"], "target": "plugin", "versions": ">=1.17.0 <=1.19.1"}, "RULE-CVE-2025-8680-01": {"ajax_action": "fs_api_request", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8680", "method": "POST", "mode": "block", "severity": 4.3, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2025-8689-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:actions", "type": "regex", "value": "~ep-image-comparison|ep-hotspot|ep-google-maps~i"}, {"name": "ARGS:actions", "type": "regex", "value": "~<script[\\\\s>]|javascript\\\\s*:|<[a-zA-Z][^>]*[[:space:]]+on[a-z]+=|<iframe[\\\\s>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8689", "description": "Elements Plus! <=2.16.4 Stored XSS via Image Comparison, HotSpot Plus, Google Maps widgets (Elementor AJAX save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elements-plus", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.16.4"}, "RULE-CVE-2025-8689-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v\\\\d+/document(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~ep-image-comparison|ep-hotspot|ep-google-maps~i"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]|javascript\\\\s*:|<[a-zA-Z][^>]*[[:space:]]+on[a-z]+=|<iframe[\\\\s>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8689", "description": "Elements Plus! <=2.16.4 Stored XSS via Image Comparison, HotSpot Plus, Google Maps widgets (Elementor REST save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elements-plus", "tags": ["xss", "stored-xss", "elementor-widget", "rest-api"], "target": "plugin", "versions": "<=2.16.4"}, "RULE-CVE-2025-8689-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~ep-image-comparison|ep-hotspot|ep-google-maps~i"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~<script[\\\\s>]|javascript\\\\s*:|<[a-zA-Z][^>]*[[:space:]]+on[a-z]+=|<iframe[\\\\s>]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8689", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8689", "description": "Elements Plus! <=2.16.4 Stored XSS via Image Comparison, HotSpot Plus, Google Maps widgets (classic editor save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "elements-plus", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.16.4"}, "RULE-CVE-2025-8719-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[translate_this\\\\b[^\\\\]]*base_lang\\\\s*=\\\\s*[^\\\\]]*(?:<[a-zA-Z]|on[a-zA-Z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8719", "description": "Translate This gTranslate Shortcode <=1.0 Stored XSS via base_lang shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "translate-this-google-translate-web-element-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2025-8721-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[workable_jobs\\\\b[^\\\\]]*(?:<script|<iframe|<svg|<img|<object|<embed|<link|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8721", "description": "Workable API <=1.0.4 Stored XSS via workable_jobs shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wrapper-for-workable-api", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-8721-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[workable_jobs\\\\b[^\\\\]]*(?:<script|<iframe|<svg|<img|<object|<embed|<link|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-8721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8721", "description": "Workable API <=1.0.4 Stored XSS via workable_jobs shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wrapper-for-workable-api", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2025-8722-01": {"ajax_action": "pagination_request", "conditions": [{"name": "ARGS:sid", "type": "detectXSS"}], "cve": "CVE-2025-8722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8722", "description": "Content Views <= 4.1 reflected XSS via sid parameter in pagination_request AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-views-query-and-display-post-page", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.1"}, "RULE-CVE-2025-8722-02": {"ajax_action": "preview_request", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>~i"}], "cve": "CVE-2025-8722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8722", "description": "Content Views <= 4.1 stored XSS via preview_request AJAX handler - contributor+ can inject malicious widget attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "content-views-query-and-display-post-page", "tags": ["xss", "stored-xss", "contributor"], "target": "plugin", "versions": "<=4.1"}, "RULE-CVE-2025-8723-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/settings(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~cf_image_resizing_~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-8723", "method": "POST", "mode": "block", "severity": 9.8, "slug": "cf-image-resizing", "target": "plugin", "versions": "<=1.5.6"}, "RULE-CVE-2025-8781-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookster/v1/~"}, {"name": "ARGS:raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|(?:SELECT|INSERT|UPDATE|DELETE)\\\\s.*\\\\bFROM\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2025-8781", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8781", "description": "Bookster <=2.1.1 authenticated SQL Injection via raw parameter on REST API endpoints", "mode": "block", "severity": 4.9, "slug": "bookster", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2025-8867-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-8867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8867", "description": "Graphina Elementor Charts and Graphs <=3.1.3 stored XSS via Elementor AJAX save flow", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-8867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/save~"}, {"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2025-8867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8867", "description": "Graphina Elementor Charts and Graphs <=3.1.3 stored XSS via Elementor REST save flow", "method": "POST", "mode": "block", "severity": 6.4, "slug": "graphina-elementor-charts-and-graphs", "tags": ["xss", "stored-xss", "rest-api", "elementor-widget"], "target": "plugin", "versions": "<=3.1.3"}, "RULE-CVE-2025-8896-01": {"action": "init", "conditions": [{"name": "ARGS:gdpr_communication_preferences[/[0-9]+/]", "type": "regex", "value": "~(?:<[a-z/!][^>]*>|on(?:load|error|mouseover|click|focus|blur|mouseout|mousemove|mousedown|mouseup|keydown|keyup|keypress|change|submit|reset|select|abort|dblclick|drag|dragend|dragenter|dragleave|dragover|dragstart|drop|input|contextmenu|pointerdown|pointerenter|pointerleave|pointermove|pointerout|pointerover|pointerup) *=|javascript *:)~i"}], "cve": "CVE-2025-8896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8896", "description": "Profile Builder <=3.14.3 Stored XSS via gdpr_communication_preferences[] parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "profile-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.14.3"}, "RULE-CVE-2025-8977-01": {"ajax_action": "sdm_export_logs", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2025-8977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8977", "description": "Simple Download Monitor <=3.9.33 authenticated SQL injection via order parameter in sdm_export_logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-monitor", "tags": ["sql-injection", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2025-8977-02": {"ajax_action": "sdm_export_logs", "conditions": [{"name": "ARGS:orderby", "type": "detectSQLi"}], "cve": "CVE-2025-8977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8977", "description": "Simple Download Monitor <=3.9.33 authenticated SQL injection via orderby parameter in sdm_export_logs AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-download-monitor", "tags": ["sql-injection", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=3.9.33"}, "RULE-CVE-2025-8994-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/pm/v2/projects/\\\\d+/tasks(?:[/?&]|$)~"}, {"name": "ARGS:completed_at_operator", "type": "regex", "value": "~(?i)(?:OR|AND)\\\\s+(?:SLEEP|BENCHMARK|WAITFOR|IF\\\\s*\\\\(|EXTRACTVALUE|UPDATEXML|\\\\d+\\\\s*=\\\\s*\\\\d+)~"}], "cve": "CVE-2025-8994", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-8994", "description": "WP Project Manager <=2.6.26 authenticated (Subscriber+) time-based SQL injection via completed_at_operator REST parameter", "method": "GET", "mode": "block", "severity": 6.5, "slug": "wedevs-project-manager", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.6.26"}, "RULE-CVE-2025-9044-01": {"action": "init", "conditions": [{"name": "ARGS:popup_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|javascript\\\\s*:|on(?:load|error|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-9044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9044", "description": "Mapster WP Maps <=1.20.0 reflected XSS via popup_id parameter in shortcode render", "method": "GET", "mode": "block", "severity": 6.4, "slug": "mapster-wp-maps", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2025-9044-02": {"action": "init", "conditions": [{"name": "ARGS:feature_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|javascript\\\\s*:|on(?:load|error|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-9044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9044", "description": "Mapster WP Maps <=1.20.0 reflected XSS via feature_id parameter in modal shortcode render", "method": "GET", "mode": "block", "severity": 6.4, "slug": "mapster-wp-maps", "tags": ["xss", "reflected-xss", "shortcode"], "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2025-9044-03": {"ajax_action": "acf_photo_gallery_edit_save", "conditions": [{"name": "ARGS:post", "type": "regex", "value": "~(?:<script[\\\\s/>]|javascript\\\\s*:|on(?:load|error|mouseover|click|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2025-9044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9044", "description": "Mapster WP Maps <=1.20.0 XSS via post parameter in acf_photo_gallery_edit_save AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mapster-wp-maps", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2025-9045-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eead-countdown~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:prefix_text|suffix_text)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|embed|object|form)\\\\b|<[^>]*\\\\bon\\\\w+\\\\s*=|javascript:|<details[^>]*\\\\bopen\\\\b)~i"}], "cve": "CVE-2025-9045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9045", "description": "Easy Elementor Addons <=2.2.9 Authenticated (Contributor+) Stored XSS via Countdown widget prefix_text/suffix_text", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2025-9045-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~eead-image-comparison~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:before_label|after_label)~"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|iframe|embed|object|form)\\\\b|<[^>]*\\\\bon\\\\w+\\\\s*=|javascript:|<details[^>]*\\\\bopen\\\\b)~i"}], "cve": "CVE-2025-9045", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9045", "description": "Easy Elementor Addons <=2.2.9 Authenticated (Contributor+) Stored XSS via Image Comparison widget before_label/after_label", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2025-9077-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ut_type_out_animated_heading.{0,500}?(?:<[a-zA-Z/!]|\\\\\\\\u003[cC])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9077", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9077", "description": "Ultra Addons Lite for Elementor <=1.1.9 authenticated stored XSS via Typeout Widget Animated Text field (AJAX save)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ut-elementor-addons-lite", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-9082-01": {"ajax_action": "save_builder", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "wpb-image_compare"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*script\\\\b|on(?:error|load|click|focus|mouseover)\\\\s*=|javascript\\\\s*:|\\\\\\\\u003c\\\\s*script\\\\\\\\u003e|&#0*60;\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9082", "description": "WPBITS Addons For Elementor <=1.8 Stored XSS via image compare widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpbits-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-9082-02": {"ajax_action": "save_builder", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "wpb-text_rotator"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*script\\\\b|on(?:error|load|click|focus|mouseover)\\\\s*=|javascript\\\\s*:|\\\\\\\\u003c\\\\s*script\\\\\\\\u003e|&#0*60;\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9082", "description": "WPBITS Addons For Elementor <=1.8 Stored XSS via text rotator widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpbits-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-9082-03": {"ajax_action": "save_builder", "conditions": [{"name": "ARGS:actions", "type": "contains", "value": "wpb-tooltip"}, {"name": "ARGS:actions", "type": "regex", "value": "~(?:<\\\\s*script\\\\b|on(?:error|load|click|focus|mouseover)\\\\s*=|javascript\\\\s*:|\\\\\\\\u003c\\\\s*script\\\\\\\\u003e|&#0*60;\\\\s*script)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9082", "description": "WPBITS Addons For Elementor <=1.8 Stored XSS via tooltip widget settings", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpbits-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2025-9083-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[+ ]?\\\\d+:\\\\\\\\?\\"[^\\"\\\\\\\\]+\\\\\\\\?\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-9083", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<3.11.1"}, "RULE-CVE-2025-9083-02": {"ajax_action": "nf_ajax_resume", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[+ ]?\\\\d+:\\\\\\\\?\\"[^\\"\\\\\\\\]+\\\\\\\\?\\":\\\\d+:\\\\{~"}], "cve": "CVE-2025-9083", "method": "POST", "mode": "block", "severity": 9.8, "slug": "ninja-forms", "target": "plugin", "versions": "<3.11.1"}, "RULE-CVE-2025-9115-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "etsy-shop.php"}, {"name": "ARGS", "type": "regex", "value": "~(?:<(?:script|svg|img|iframe|embed|object|video|audio|body|details|marquee|math|input|select|textarea|form|meta|link|style|base)[^a-zA-Z0-9]|on(?:load|error|focus|click|mouseover|change|blur|mouseenter|animationend|resize)[ ]*=|javascript[ ]*:)~i"}], "cve": "CVE-2025-9115", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9115", "description": "Etsy Shop <=3.0.6 Reflected XSS via unescaped $_SERVER[REQUEST_URI] on admin options page", "mode": "block", "severity": 5.6, "slug": "etsy-shop", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2025-9123-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_cbxgooglemap_heading", "type": "detectXSS"}], "cve": "CVE-2025-9123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9123", "description": "CBX Map for Google Map & OpenStreetMap <=2.0.1 authenticated (Contributor+) stored XSS via popup heading meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cbxgooglemap", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-9123-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_cbxgooglemap_address", "type": "detectXSS"}], "cve": "CVE-2025-9123", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9123", "description": "CBX Map for Google Map & OpenStreetMap <=2.0.1 authenticated (Contributor+) stored XSS via location address meta field", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cbxgooglemap", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2025-9129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[flexi-form-tag\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img[^>]+onerror|<svg[^>]+onload|<iframe)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9129", "description": "Flexi <= 4.28 Stored XSS via flexi-form-tag shortcode in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexi", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=4.28"}, "RULE-CVE-2025-9129-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[flexi-form-tag\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img[^>]+onerror|<svg[^>]+onload|<iframe)[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9129", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9129", "description": "Flexi <= 4.28 Stored XSS via flexi-form-tag shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "flexi", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=4.28"}, "RULE-CVE-2025-9130-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[unify_checkout\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|change|submit|focusin)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9130", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9130", "description": "Unify <=3.4.7 Authenticated (Contributor+) Stored XSS via unify_checkout shortcode token attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "unify", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2025-9130-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[unify_checkout\\\\b[^\\\\]]*(?:<script|\\\\bon(?:error|load|click|mouseover|focus|change|submit|focusin)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9130", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9130", "description": "Unify <=3.4.7 Authenticated (Contributor+) Stored XSS via unify_checkout shortcode token attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "unify", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.4.7"}, "RULE-CVE-2025-9172-01": {"ajax_action": "vibes_get_stats", "conditions": [{"name": "ARGS:resource", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|CREATE)\\\\s|SLEEP[\\\\s/\\\\*]*[(]|BENCHMARK[\\\\s/\\\\*]*[(]|EXTRACTVALUE[\\\\s/\\\\*]*[(]|UPDATEXML[\\\\s/\\\\*]*[(]|(?:^|[\\\\s)])(?:AND|OR)[\\\\s/\\\\*]+(?:[0-9]|SLEEP|BENCHMARK|[(]SELECT)|[\'\\"]\\\\s*(?:AND|OR|UNION|;\\\\s*SELECT)\\\\s)~i"}], "cve": "CVE-2025-9172", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9172", "description": "Vibes <=2.2.0 unauthenticated SQL injection via resource parameter in vibes_get_stats AJAX handler", "mode": "block", "severity": 7.5, "slug": "vibes", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2025-9203-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~subtitle_ssize[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via subtitle_ssize widget field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~track_title[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_title widget field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~track_artist_name[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_artist_name widget field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-04": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~subtitle_ssize[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via subtitle_ssize in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "elementor-ajax"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-05": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~track_title[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_title in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "elementor-ajax"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9203-06": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~track_artist_name[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']{0,100}(?:<[a-z/][^>]*\\\\bon[a-z]+=|<script|<iframe|<svg[\\\\s/]|<embed|<object|javascript\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2025-9203", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9203", "description": "Media Player Addons for Elementor <=1.0.5 Stored XSS via track_artist_name in Elementor AJAX save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-player-addons-for-elementor", "tags": ["xss", "stored-xss", "elementor-widget", "elementor-ajax"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2025-9204-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~xaddons_button_url[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9204", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9204", "description": "X Addons for Elementor <=1.0.16 authenticated (Contributor+) stored XSS via _elementor_data on post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "x-addons-elementor", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=1.0.16"}, "RULE-CVE-2025-9215-01": {"ajax_action": "storeengine_csv/file_download", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2025-9215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9215", "description": "StoreEngine <=1.5.0 authenticated path traversal via file_download AJAX handler (filename parameter with directory traversal sequences)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "storeengine", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-9215-02": {"ajax_action": "storeengine_csv/file_download", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2025-9215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9215", "description": "StoreEngine <=1.5.0 authenticated sensitive file read via file_download AJAX handler (filename parameter targeting known sensitive files)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "storeengine", "tags": ["path-traversal", "arbitrary-file-read", "sensitive-file-read", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-9216-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "storeengine_csv/import"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9216", "description": "StoreEngine <=1.5.0 authenticated arbitrary file upload via storeengine_csv/import AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "storeengine", "tags": ["arbitrary-file-upload", "missing-authorization", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2025-9219-01": {"ajax_action": "update_post_smtp_pro_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9219", "method": "POST", "mode": "block", "severity": 4.3, "slug": "post-smtp", "target": "plugin", "versions": "<=3.4.1"}, "RULE-CVE-2025-9243-01": {"ajax_action": "get_cc_orders", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9243", "description": "Cost Calculator Builder <=3.5.32 missing authorization on get_cc_orders AJAX handler allowing Subscriber+ order data access", "method": "POST", "mode": "block", "severity": 8.1, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=3.5.32"}, "RULE-CVE-2025-9243-02": {"ajax_action": "update_order_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9243", "description": "Cost Calculator Builder <=3.5.32 missing authorization on update_order_status AJAX handler allowing Subscriber+ order modification", "method": "POST", "mode": "block", "severity": 8.1, "slug": "cost-calculator-builder", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=3.5.32"}, "RULE-CVE-2025-9260-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/profile\\\\.php~"}, {"name": "ARGS:description", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2025-9260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9260", "description": "Fluent Forms 5.1.16-6.1.1 PHP Object Injection via serialized payload in user profile description (profile.php)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "fluentform", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": ">=5.1.16 <=6.1.1"}, "RULE-CVE-2025-9260-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/users(/|\\\\?|$)~"}, {"name": "ARGS:description", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2025-9260", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9260", "description": "Fluent Forms 5.1.16-6.1.1 PHP Object Injection via serialized payload in user profile description (REST API)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "fluentform", "tags": ["object-injection", "deserialization", "authenticated", "rest-api"], "target": "plugin", "versions": ">=5.1.16 <=6.1.1"}, "RULE-CVE-2025-9277-01": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_titles_desc", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via SEO meta fields in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-02": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_titles_title", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via SEO title field in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-03": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_fb_title", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Facebook OG title in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-04": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_fb_desc", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Facebook OG description in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-05": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_twitter_title", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Twitter title in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-06": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_social_twitter_desc", "type": "detectXSS"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via Twitter description in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-07": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_canonical_url", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:|<\\\\s*script|(?:^|[\\\\s\\"\'<>])on[a-zA-Z]+\\\\s*=)~i"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via canonical URL field in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9277-08": {"ajax_action": "siteseo_save_universal_metabox", "conditions": [{"name": "ARGS:siteseo_redirections_value", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:|<\\\\s*script|(?:^|[\\\\s\\"\'<>])on[a-zA-Z]+\\\\s*=)~i"}], "cve": "CVE-2025-9277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9277", "description": "SiteSEO <=1.2.7 Stored XSS via redirection value field in universal metabox AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "siteseo", "tags": ["xss", "stored-xss", "broken-sanitization"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2025-9286-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/appy-pie-connect-for-woocommerce/v1/reset_user_password(?:/|\\\\?|&|$)~"}], "cve": "CVE-2025-9286", "method": "POST", "mode": "block", "severity": 9.8, "slug": "appy-pie-connect-for-woocommerce", "target": "plugin", "versions": "<=1.1.2"}, "RULE-CVE-2025-9318-01": {"action": "parse_request", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quizzes/[0-9]+/results(?:/|\\\\?|&|$)~"}, {"name": "ARGS:is_linking", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]|SLEEP[\\\\s/\\\\*]*[(]|BENCHMARK[\\\\s/\\\\*]*[(]|(?:^|[\\\\s\'\\"])OR[\\\\s/\\\\*]+[0-9]|(?:^|[\\\\s\'\\"])AND[\\\\s/\\\\*]+[0-9]|SELECT[\\\\s/\\\\*]+(?:NULL|[0-9]|user_|@@|concat|group_concat|information_schema))~i"}], "cve": "CVE-2025-9318", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9318", "description": "Quiz and Survey Master (QSM) <=10.3.1 authenticated SQL injection via is_linking REST API parameter", "method": "GET", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=10.3.1"}, "RULE-CVE-2025-9322-01": {"action": "admin_init", "conditions": [{"name": "ARGS:wpfs-form-name", "type": "detectSQLi"}], "cve": "CVE-2025-9322", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9322", "description": "WP Full Stripe Free <=8.3.1 unauthenticated SQL injection via wpfs-form-name parameter in wpfs-check-coupon AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-full-stripe-free", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2025-9343-01": {"ajax_action": "eh_crm_new_ticket_post", "conditions": [{"name": "ARGS:subject", "type": "detectXSS"}], "cve": "CVE-2025-9343", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9343", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.4 unauthenticated stored XSS via ticket subject in eh_crm_new_ticket_post", "method": "POST", "mode": "block", "severity": 7.2, "slug": "elex-helpdesk-customer-support-ticket-system", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.4"}, "RULE-CVE-2025-9344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[uwp_profile(?:_header)?\\\\s+[^\\\\]]*disable_greedy\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9344", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9344", "description": "UsersWP <=1.2.42 Stored XSS via disable_greedy shortcode attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "userswp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.42"}, "RULE-CVE-2025-9344-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[uwp_profile(?:_header)?\\\\s+[^\\\\]]*disable_greedy\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|on[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9344", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9344", "description": "UsersWP <=1.2.42 Stored XSS via disable_greedy shortcode attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "userswp", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.42"}, "RULE-CVE-2025-9353-01": {"ajax_action": "tb_save_data", "conditions": [{"name": "ARGS:builder_data", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-9353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9353", "description": "Themify Builder <=7.6.9 authenticated (Contributor+) Stored XSS via builder_data parameter in tb_save_data AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.6.9"}, "RULE-CVE-2025-9353-02": {"ajax_action": "tb_render_element", "conditions": [{"name": "ARGS:batch", "type": "regex", "value": "~<\\\\s*script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2025-9353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9353", "description": "Themify Builder <=7.6.9 authenticated (Contributor+) Stored XSS via batch parameter in tb_render_element AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=7.6.9"}, "RULE-CVE-2025-9378-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "vayu-blocks/lottie"}, {"name": "ARGS:post_content", "type": "regex", "value": "~vayu-blocks/lottie[\\\\s\\\\S]{0,1000}(?:[\\"\']\\\\s*(?:on(?:mouse(?:over|enter|leave|move|out|down|up)|click|dblclick|key(?:down|up|press)|focus|blur|load|error|submit|change|input|scroll|wheel|drag|drop|touch(?:start|end|move|cancel)|pointer(?:down|up|move|enter|leave|over|out)|animation(?:start|end|iteration)|transition(?:end|run|start))\\\\s*=)|<\\\\s*script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-9378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9378", "description": "Vayu Blocks <=1.3.9 Stored XSS via unescaped Lottie block attributes in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vayu-blocks", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=1.3.9"}, "RULE-CVE-2025-9378-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "vayu-blocks/lottie"}, {"name": "ARGS:content", "type": "regex", "value": "~vayu-blocks/lottie[\\\\s\\\\S]{0,1000}(?:[\\"\']\\\\s*(?:on(?:mouse(?:over|enter|leave|move|out|down|up)|click|dblclick|key(?:down|up|press)|focus|blur|load|error|submit|change|input|scroll|wheel|drag|drop|touch(?:start|end|move|cancel)|pointer(?:down|up|move|enter|leave|over|out)|animation(?:start|end|iteration)|transition(?:end|run|start))\\\\s*=)|<\\\\s*script|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2025-9378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9378", "description": "Vayu Blocks <=1.3.9 Stored XSS via unescaped Lottie block attributes in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "vayu-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "rest-api"], "target": "plugin", "versions": "<=1.3.9"}, "RULE-CVE-2025-9436-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9436-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*><~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in REST API post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9436-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*on\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9436-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[trustindex\\\\b[^\\\\]]*[\'\\"]\\\\s*><~i"}], "cve": "CVE-2025-9436", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9436", "description": "Widgets for Google Reviews <=13.2.1 Stored XSS via trustindex shortcode in classic editor post content (tag injection)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-reviews-plugin-for-google", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=13.2.1"}, "RULE-CVE-2025-9463-01": {"ajax_action": "pp-analytics-query", "conditions": [{"name": "ARGS:order_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|IF|CASE)\\\\s*\\\\(|--\\\\s*$|/\\\\*|\\\\*/|#\\\\s)~i"}], "cve": "CVE-2025-9463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9463", "description": "PeachPay for WooCommerce <=1.117.5 authenticated SQL injection via order_by parameter in pp-analytics-query AJAX handler", "mode": "block", "severity": 6.5, "slug": "peachpay-for-woocommerce", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.117.5"}, "RULE-CVE-2025-9463-02": {"ajax_action": "pp-analytics-query", "conditions": [{"name": "ARGS:group_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|IF|CASE)\\\\s*\\\\(|--\\\\s*$|/\\\\*|\\\\*/|#\\\\s)~i"}], "cve": "CVE-2025-9463", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9463", "description": "PeachPay for WooCommerce <=1.117.5 authenticated SQL injection via group_by parameter in pp-analytics-query AJAX handler", "mode": "block", "severity": 6.5, "slug": "peachpay-for-woocommerce", "tags": ["sql-injection", "authenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.117.5"}, "RULE-CVE-2025-9485-01": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^eyJhbGciOiJub25lI~"}], "cve": "CVE-2025-9485", "method": "GET", "mode": "block", "severity": 9.8, "slug": "miniorange-login-with-eve-online-google-facebook", "target": "plugin", "versions": "<=6.26.12"}, "RULE-CVE-2025-9485-02": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^eyJhbGciOiJub25lI~"}], "cve": "CVE-2025-9485", "method": "POST", "mode": "block", "severity": 9.8, "slug": "miniorange-login-with-eve-online-google-facebook", "target": "plugin", "versions": "<=6.26.12"}, "RULE-CVE-2025-9487-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|&|$)~"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}], "cve": "CVE-2025-9487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9487", "description": "Admin and Site Enhancements <=7.9.7 authenticated stored XSS via malicious SVG upload through REST API media endpoint (ARGS:name)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "admin-site-enhancements", "tags": ["xss", "stored-xss", "svg-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.9.7"}, "RULE-CVE-2025-9487-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(/|\\\\?|&|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.svg(?:z)?$~i"}], "cve": "CVE-2025-9487", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9487", "description": "Admin and Site Enhancements <=7.9.7 authenticated stored XSS via malicious SVG upload through REST API media endpoint (FILES:file:name)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "admin-site-enhancements", "tags": ["xss", "stored-xss", "svg-upload", "rest-api", "authenticated"], "target": "plugin", "versions": "<=7.9.7"}, "RULE-CVE-2025-9488-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with HTML tags in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\][^\\\\[]*<(script|iframe|svg|img|details|object|embed|video|audio|input|form)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode enclosed content with HTML tags in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*\\\\bon\\\\w+\\\\s*=[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with event handlers in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with HTML tags in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\][^\\\\[]*<(script|iframe|svg|img|details|object|embed|video|audio|input|form)\\\\b~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode enclosed content with HTML tags in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9488-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(bloginfo|redux_bloginfo|themeinfo|redux_themeinfo|date|redux_date)\\\\s+[^\\\\]]*data\\\\s*=\\\\s*[\\"\'][^\\"\']*\\\\bon\\\\w+\\\\s*=[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9488", "description": "Redux Framework <=4.5.8 Stored XSS via shortcode data attribute with event handlers in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "redux-framework", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.5.8"}, "RULE-CVE-2025-9493-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ame-user-info [^\\\\]]*placeholder[ ]*=[ ]*(?:\\"[^\\"\\\\]]*|\'[^\'\\\\]]*)(?:<[ ]*script|javascript[ ]*:|on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|keypress)[ ]*=)~i"}], "cve": "CVE-2025-9493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9493", "description": "Admin Menu Editor <=1.14 Stored XSS via [ame-user-info] shortcode placeholder attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "admin-menu-editor", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.14"}, "RULE-CVE-2025-9493-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ame-user-info [^\\\\]]*placeholder[ ]*=[ ]*(?:\\"[^\\"\\\\]]*|\'[^\'\\\\]]*)(?:<[ ]*script|javascript[ ]*:|on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|keypress)[ ]*=)~i"}], "cve": "CVE-2025-9493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9493", "description": "Admin Menu Editor <=1.14 Stored XSS via [ame-user-info] shortcode placeholder attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "admin-menu-editor", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.14"}, "RULE-CVE-2025-9496-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[file_modified\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2025-9496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9496", "description": "Enable Media Replace <=4.1.6 Stored XSS via file_modified shortcode format attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.1.6"}, "RULE-CVE-2025-9496-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[file_modified\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2025-9496", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9496", "description": "Enable Media Replace <=4.1.6 Stored XSS via file_modified shortcode format attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.1.6"}, "RULE-CVE-2025-9499-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[oceanwp_library\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<|on[a-z]+=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9499", "description": "Ocean Extra <=2.4.9 Stored XSS via oceanwp_library shortcode id attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ocean-extra", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2025-9500-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)<(?:script|img|svg|iframe|object|embed|form|input|body|style|link|meta|base)[\\\\s/>]~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in post_content (classic editor - HTML tags)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)on(?:load|error|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in post_content (classic editor - event handlers)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)javascript\\\\s*:~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in post_content (classic editor - javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)<(?:script|img|svg|iframe|object|embed|form|input|body|style|link|meta|base)[\\\\s/>]~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in REST API content (Gutenberg - HTML tags)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)on(?:load|error|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in REST API content (Gutenberg - event handlers)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9500-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~shortcode_debug\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\s\\"\'\\\\]]*)javascript\\\\s*:~i"}], "cve": "CVE-2025-9500", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9500", "description": "TablePress <=3.2 Authenticated (Contributor+) Stored XSS via shortcode_debug attribute in REST API content (Gutenberg - javascript URI)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tablepress", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2025-9501-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?.*)?$~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<!--\\\\s*mfunc\\\\b~i"}], "cve": "CVE-2025-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9501", "description": "W3 Total Cache < 2.8.13 command injection via mfunc tags in unauthenticated comments processed by _parse_dynamic_mfunc, as described by NVD and WPScan and detailed in SiteGuarding advisories.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["rce", "command_injection", "comments", "w3-total-cache", "mfunc", "cwe-78"], "target": "plugin", "versions": "<2.8.13"}, "RULE-CVE-2025-9501-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?.*)?$~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<!--\\\\s*mclude\\\\b~i"}], "cve": "CVE-2025-9501", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9501", "description": "W3 Total Cache < 2.8.13 command injection attempts using mclude fragment tags in unauthenticated comments evaluated by _parse_dynamic_mfunc, per NVD, WPScan, and SiteGuarding analyses.", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["rce", "command_injection", "comments", "w3-total-cache", "mclude", "cwe-78"], "target": "plugin", "versions": "<2.8.13"}, "RULE-CVE-2025-9512-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~<[a-z][^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512", "description": "Schema & Structured Data for WP & AMP <=1.49 unauthenticated stored XSS via comment HTML attribute injection", "method": "POST", "mode": "block", "severity": 6.1, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "stored-xss", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=1.49"}, "RULE-CVE-2025-9512-02": {"ajax_action": "saswp_rf_template_review_edit_form", "conditions": [{"name": "ARGS:comment_id", "type": "regex", "value": "~<[^>]*>|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512", "description": "Schema & Structured Data for WP & AMP <=1.49 reflected XSS via unsanitized comment_id in review edit form AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "reflected-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.49"}, "RULE-CVE-2025-9512-03": {"ajax_action": "saswp_rf_template_review_edit_form", "conditions": [{"name": "ARGS:comment_post_id", "type": "regex", "value": "~<[^>]*>|\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2025-9512", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9512", "description": "Schema & Structured Data for WP & AMP <=1.49 reflected XSS via unsanitized comment_post_id in review edit form AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "schema-and-structured-data-for-wp", "tags": ["xss", "reflected-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.49"}, "RULE-CVE-2025-9519-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[easy_timer_(?:clock|counter|countdown|countup)[^\\\\]]*filter\\\\s*=\\\\s*[\\"\'\\\\\\\\]?\\\\s*(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|preg_replace|create_function|call_user_func|call_user_func_array|array_map|array_filter|usort|uasort|uksort)\\\\b~i"}], "cve": "CVE-2025-9519", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9519", "description": "Easy Timer <=4.2.1 authenticated (Editor+) RCE via shortcode filter attribute in post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-timer", "tags": ["code-injection", "rce", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-9519-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[easy_timer_(?:clock|counter|countdown|countup)[^\\\\]]*filter\\\\s*=\\\\s*[\\"\'\\\\\\\\]?\\\\s*(?:system|exec|shell_exec|passthru|popen|proc_open|assert|eval|preg_replace|create_function|call_user_func|call_user_func_array|array_map|array_filter|usort|uasort|uksort)\\\\b~i"}], "cve": "CVE-2025-9519", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9519", "description": "Easy Timer <=4.2.1 authenticated (Editor+) RCE via shortcode filter attribute in REST API post content", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-timer", "tags": ["code-injection", "rce", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.2.1"}, "RULE-CVE-2025-9539-01": {"ajax_action": "automatorwp_ajax_import_automation_from_url", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "automatorwp_ajax_import_automation_from_url"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9539", "method": "POST", "mode": "block", "severity": 8.0, "slug": "automatorwp", "target": "plugin", "versions": "<=5.3.6"}, "RULE-CVE-2025-9541-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\]\\\\s*\\\\(\\\\s*(?:(?:javascript|vbscript|data)\\\\s*:|[^)]*?on(?:error|load|click|focus|mouseover)\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9541", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9541", "description": "Markup Markdown <3.20.10 Authenticated (Contributor+) Stored XSS via markdown post content (post.php)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "markup-markdown", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<3.20.10"}, "RULE-CVE-2025-9541-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~(?i)\\\\]\\\\s*\\\\(\\\\s*(?:(?:javascript|vbscript|data)\\\\s*:|[^)]*?on(?:error|load|click|focus|mouseover)\\\\s*=)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9541", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9541", "description": "Markup Markdown <3.20.10 Authenticated (Contributor+) Stored XSS via markdown post content (REST API)", "method": "POST", "mode": "block", "severity": 4.7, "slug": "markup-markdown", "tags": ["xss", "stored-xss", "authenticated", "rest-api"], "target": "plugin", "versions": "<3.20.10"}, "RULE-CVE-2025-9562-01": {"action": "init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[qs_date\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\'][^\\"\']*[<>][^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-9562", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2025-9562-02": {"action": "rest_api_init", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts(/\\\\d+)?(/|\\\\?|$)~"}, {"name": "ARGS:content[raw]", "type": "regex", "value": "~\\\\[qs_date\\\\b[^\\\\]]*format\\\\s*=\\\\s*[\\"\'][^\\"\']*[<>][^\\"\']*[\\"\']~i"}], "cve": "CVE-2025-9562", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpcf7-redirect", "target": "plugin", "versions": "<=3.2.6"}, "RULE-CVE-2025-9565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "blocksy_newsletter_subscribe"}, {"name": "ARGS:post_content", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9565", "description": "Blocksy Companion <=2.1.10 Stored XSS via blocksy_newsletter_subscribe shortcode description attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-9565-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "blocksy_newsletter_subscribe"}, {"name": "ARGS:content", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|blur|submit|change|input|keydown|keyup|keypress)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9565", "description": "Blocksy Companion <=2.1.10 Stored XSS via blocksy_newsletter_subscribe shortcode description attribute via REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "blocksy-companion", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.1.10"}, "RULE-CVE-2025-9620-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_integration_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via integration code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9620-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_ga_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via GA code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9620-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_gtm_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via GTM code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9620-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-monster"}, {"name": "ARGS:seo_monster_custom_code", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus|mouseenter|blur|change|submit|keydown|keyup|keypress) *=|javascript *:|<script[^>]*>[^<])~i"}], "cve": "CVE-2025-9620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9620", "description": "Seo Monster <=3.3.3 CSRF to Stored XSS via custom code setting", "method": "POST", "mode": "block", "severity": 6.1, "slug": "seo-monster", "tags": ["csrf", "xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.3"}, "RULE-CVE-2025-9637-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quizzes(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2025-9637", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9637", "description": "Quiz and Survey Master <=10.3.1 missing authorization on REST API quiz listing endpoint", "method": "GET", "mode": "block", "severity": 6.5, "slug": "quiz-master-next", "tags": ["missing-authorization", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=10.3.1"}, "RULE-CVE-2025-9710-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php(?:\\\\?|$)~i"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<[^>]*\\\\s(?:on\\\\w+\\\\s*=|style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:expression|url)\\\\s*\\\\()|<\\\\s*(?:script|iframe|embed|object|applet|form|svg|math)\\\\b|\\\\bjavascript\\\\s*:|\\\\bvbscript\\\\s*:|\\\\bdata\\\\s*:[^,]*text/html)~i"}], "cve": "CVE-2025-9710", "method": "POST", "mode": "block", "severity": 6.3, "slug": "responsive-lightbox", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2025-9776-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/catf/v1/import-csv(/|\\\\?|&|$)~"}, {"name": "FILES:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9776", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9776", "description": "CatFolders <=2.5.2 authenticated (Author+) time-based SQL injection via CSV import REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "catfolders", "tags": ["sql-injection", "rest-api", "csv-import", "authenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2025-9807-01": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "ARGS:post_type", "type": "equals", "value": "tribe_events"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via s search parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "search-parameter"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9807-02": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:/events/|/tribe_events/)~i"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via s parameter on events archive", "method": "GET", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "search-parameter"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9807-03": {"action": "init", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^tribe_events~"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via s parameter on AJAX views fallback", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9807-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:\'|\\"|%27|%22).*(?:SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|WAITFOR[ ]+DELAY|IF[ ]*[(]|CASE[ ]+WHEN|AND[ ]+[0-9]+[ ]*=[ ]*[0-9]|OR[ ]+[0-9]+[ ]*=[ ]*[0-9]|UNION[ ]+(?:ALL[ ]+)?SELECT|;[ ]*(?:DROP|DELETE|INSERT|UPDATE)[ ]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(]|FLOOR[ ]*[(][ ]*RAND)~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/tribe/events/v1/events~"}], "cve": "CVE-2025-9807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9807", "description": "The Events Calendar <=6.15.1 unauthenticated SQL injection via search parameter on REST API", "method": "GET", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=6.15.1"}, "RULE-CVE-2025-9816-01": {"ajax_action": "wp_statistics_delete_agents", "conditions": [{"name": "ARGS:agent-name", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 unauthenticated stored XSS via User-Agent header in delete_agents AJAX callback", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-02": {"ajax_action": "wp_statistics_delete_platforms", "conditions": [{"name": "ARGS:platform-name", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 unauthenticated stored XSS via User-Agent header in delete_platforms AJAX callback", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-03": {"ajax_action": "wp_statistics_delete_ip", "conditions": [{"name": "ARGS:ip-address", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 unauthenticated stored XSS via User-Agent header in delete_ip AJAX callback", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-04": {"ajax_action": "wp_statistics_purge_data", "conditions": [{"name": "ARGS:purge-days", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 unauthenticated stored XSS via User-Agent header in purge_data AJAX callback", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9816-05": {"ajax_action": "wp_statistics_purge_visitor_hits", "conditions": [{"name": "ARGS:purge-hits", "type": "detectXSS"}], "cve": "CVE-2025-9816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9816", "description": "WP Statistics <=14.15.4 unauthenticated stored XSS via User-Agent header in purge_visitor_hits AJAX callback", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=14.15.4"}, "RULE-CVE-2025-9852-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[momoyoga-schedule\\\\b[^\\\\]]*schedule_url\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script|&#|&quot;|%22|%3c)~i"}], "cve": "CVE-2025-9852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9852", "description": "Yoga Schedule Momoyoga <=2.9.0 Stored XSS via [momoyoga-schedule] shortcode schedule_url attribute in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "momoyoga-integration", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.9.0"}, "RULE-CVE-2025-9852-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[momoyoga-schedule\\\\b[^\\\\]]*schedule_url\\\\s*=\\\\s*[\\"\'][^\\\\]]*(?:on[a-zA-Z0-9_]+\\\\s*=|javascript\\\\s*:|<script|&#|&quot;|%22|%3c)~i"}], "cve": "CVE-2025-9852", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9852", "description": "Yoga Schedule Momoyoga <=2.9.0 Stored XSS via [momoyoga-schedule] shortcode schedule_url attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "momoyoga-integration", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.9.0"}, "RULE-CVE-2025-9853-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[optio-lightbox\\\\b[^\\\\]]*(?:\'\\\\s*[);]|<script|on(?:error|load|mouseover|click|focus)\\\\s*=|\\\\\\">\\\\s*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9853", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9853", "description": "Optio Dentistry <=2.2 authenticated (Contributor+) stored XSS via optio-lightbox shortcode attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "optio-dentistry", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2025-9856-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sg_popup\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9856", "description": "Popup Builder <=4.4.1 authenticated (Contributor+) stored XSS via sg_popup shortcode event handler attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "popup-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2025-9856-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sg_popup\\\\b[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9856", "description": "Popup Builder <=4.4.1 authenticated (Contributor+) stored XSS via sg_popup shortcode javascript: URI in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "popup-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2025-9856-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sg_popup\\\\b[^\\\\]]*<script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9856", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9856", "description": "Popup Builder <=4.4.1 authenticated (Contributor+) stored XSS via sg_popup shortcode script tag injection in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "popup-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.1"}, "RULE-CVE-2025-9857-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[Heateor_Facebook_Login"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[Heateor_Facebook_Login\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2025-9857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9857", "description": "Heateor Login <=1.1.9 Stored XSS via Heateor_Facebook_Login shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "heateor-login", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2025-9858-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[abf_vehicle\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-9858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9858", "description": "Auto Bulb Finder <=2.8.0 Stored XSS via abf_vehicle shortcode attributes in Classic Editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auto-bulb-finder-for-wp-wc", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2025-9858-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[abf_vehicle\\\\b[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<svg|<iframe|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2025-9858", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9858", "description": "Auto Bulb Finder <=2.8.0 Stored XSS via abf_vehicle shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "auto-bulb-finder-for-wp-wc", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.0"}, "RULE-CVE-2025-9859-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[fintelligence-calculator\\\\b[^\\\\]]*(?:<[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9859", "description": "Fintelligence Calculator <=1.0.3 authenticated stored XSS via shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fintelligence-calculator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-9859-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fintelligence-calculator\\\\b[^\\\\]]*(?:<[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9859", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9859", "description": "Fintelligence Calculator <=1.0.3 authenticated stored XSS via shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fintelligence-calculator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2025-9860-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mixtape\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9860", "description": "Mixtape <=1.1 Stored XSS via [mixtape] shortcode attributes in post_content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mixtape", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-9860-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mixtape\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9860", "description": "Mixtape <=1.1 Stored XSS via [mixtape] shortcode attributes in content param (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mixtape", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-9860-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[mixtape\\\\s[^\\\\]]*(?:<script|on\\\\w+\\\\s*=|javascript:|<img[^>]+onerror|<svg[^>]+onload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9860", "description": "Mixtape <=1.1 Stored XSS via [mixtape] shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mixtape", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2025-9861-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[los_showposts\\\\b[^\\\\]]*(?:<[a-zA-Z/!]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-9861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9861", "description": "ThemeLoom Widgets <=1.8.5 Stored XSS via los_showposts shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeloom-widgets", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-9861-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[los_showposts\\\\b[^\\\\]]*(?:<[a-zA-Z/!]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2025-9861", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9861", "description": "ThemeLoom Widgets <=1.8.5 Stored XSS via los_showposts shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeloom-widgets", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.8.5"}, "RULE-CVE-2025-9873-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<(?:img|iframe|video|embed|source)\\\\b[^>]*\\\\s+on[a-z]+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9873", "description": "a3 Lazy Load <=2.7.5 Stored XSS via HTML event handler attribute injection in post content (Classic Editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "tags": ["xss", "stored-xss", "attribute-injection"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-9873-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:img|iframe|video|embed|source)\\\\b[^>]*\\\\s+on[a-z]+\\\\s*=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2025-9873", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9873", "description": "a3 Lazy Load <=2.7.5 Stored XSS via HTML event handler attribute injection in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "a3-lazy-load", "tags": ["xss", "stored-xss", "attribute-injection", "rest-api"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2025-9875-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ticket_spot\\\\b[^\\\\]]*(?:<script|on(?:mouse|key|focus|blur|load|error|click|dblclick|change|submit|reset|select|abort|resize|scroll|unload|before)\\\\w*\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9875", "description": "Event Tickets, RSVPs, Calendar (TicketSpot) <=1.0.2 authenticated (Contributor+) stored XSS via ticket_spot shortcode widget_id attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ticket-spot", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-9875-02": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ticket_spot\\\\b[^\\\\]]*(?:<script|on(?:mouse|key|focus|blur|load|error|click|dblclick|change|submit|reset|select|abort|resize|scroll|unload|before)\\\\w*\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9875", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9875", "description": "Event Tickets, RSVPs, Calendar (TicketSpot) <=1.0.2 authenticated (Contributor+) stored XSS via ticket_spot shortcode widget_id attribute (REST)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ticket-spot", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2025-9881-01": {"ajax_action": "ub_ajax_action_callback", "conditions": [{"name": "ARGS:linkpartner", "type": "regex", "value": "~<[a-zA-Z/!]|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur|submit|change|resize|scroll|keydown|keyup|keypress|mouseout|mousedown|mouseup|dblclick|contextmenu|paste|copy|cut|drag(?:start|end|enter|leave|over)?|drop|abort|unload|beforeunload|hashchange|message|popstate|input|animationend|transitionend)\\\\s*=~i"}], "cve": "CVE-2025-9881", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9881", "description": "Ultimate Blogroll <=2.5.2 unauthenticated stored XSS via linkpartner parameter in ub_ajax_action_callback AJAX handler", "mode": "block", "severity": 6.1, "slug": "ultimate-blogroll", "tags": ["xss", "stored-xss", "csrf", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2025-9883-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "browser-sniff"}, {"name": "ARGS:bs_submit", "type": "exists"}, {"name": "ARGS:bs_before", "type": "detectXSS"}], "cve": "CVE-2025-9883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9883", "description": "Browser Sniff <=2.3 CSRF to Stored XSS via bs_before settings parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "browser-sniff", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-9883-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "browser-sniff"}, {"name": "ARGS:bs_submit", "type": "exists"}, {"name": "ARGS:bs_after", "type": "detectXSS"}], "cve": "CVE-2025-9883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9883", "description": "Browser Sniff <=2.3 CSRF to Stored XSS via bs_after settings parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "browser-sniff", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-9883-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "browser-sniff"}, {"name": "ARGS:bs_submit", "type": "exists"}, {"name": "ARGS:bs_between", "type": "detectXSS"}], "cve": "CVE-2025-9883", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9883", "description": "Browser Sniff <=2.3 CSRF to Stored XSS via bs_between settings parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "browser-sniff", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=2.3"}, "RULE-CVE-2025-9892-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~page=restrict-user-registration~"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:usernames_error", "type": "detectXSS"}], "cve": "CVE-2025-9892", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9892", "description": "Restrict User Registration <=1.0.1 CSRF to Stored XSS via usernames_error parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "restrict-user-registration", "tags": ["csrf", "xss", "settings-update"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-9892-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~page=restrict-user-registration~"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:emails_error", "type": "detectXSS"}], "cve": "CVE-2025-9892", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9892", "description": "Restrict User Registration <=1.0.1 CSRF to Stored XSS via emails_error parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "restrict-user-registration", "tags": ["csrf", "xss", "settings-update"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-9892-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~page=restrict-user-registration~"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:services_error", "type": "detectXSS"}], "cve": "CVE-2025-9892", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9892", "description": "Restrict User Registration <=1.0.1 CSRF to Stored XSS via services_error parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "restrict-user-registration", "tags": ["csrf", "xss", "settings-update"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2025-9947-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "custom-404-pro"}, {"name": "ARGS:path", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:OR|AND)\\\\s+[0-9]|\\\\b(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\b|[\'\\")][\\\\s]*--|(?:^|[^0-9a-zA-Z_])[0-9]+\\\\s+OR\\\\s+[0-9])~i"}], "cve": "CVE-2025-9947", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9947", "description": "Custom 404 Pro <=3.12.0 authenticated SQL injection via path parameter in delete_logs admin handler", "method": "GET", "mode": "block", "severity": 4.9, "slug": "custom-404-pro", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=3.12.0"}, "RULE-CVE-2025-9950-01": {"ajax_action": "rrrlgvwr_get_file", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|^[a-zA-Z]:[\\\\\\\\/])~"}], "cve": "CVE-2025-9950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9950", "description": "Error Log Viewer by BestWebSoft <=1.1.6 authenticated directory traversal via rrrlgvwr_get_file AJAX handler", "method": "POST", "mode": "block", "severity": 4.9, "slug": "error-log-viewer", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2025-9975-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-scraper"}, {"name": "ARGS:action", "type": "equals", "value": "extract"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|169\\\\.254\\\\.169\\\\.254|metadata\\\\.google\\\\.internal|metadata\\\\.azure\\\\.com)|(?:^|//)(?:10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)|(?:^|//)0(?:x[0-9a-fA-F]+|[0-7]+)(?:\\\\.|/|$)|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2025-9975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9975", "description": "WP Scraper <=5.8.1 authenticated SSRF via action=extract url parameter targeting internal/cloud metadata endpoints", "method": "GET", "mode": "block", "severity": 6.8, "slug": "wp-scraper", "tags": ["ssrf", "server-side-request-forgery", "cloud-metadata", "authenticated"], "target": "plugin", "versions": "<=5.8.1"}, "RULE-CVE-2025-9975-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-scraper"}, {"name": "ARGS:action", "type": "equals", "value": "downloader"}, {"name": "ARGS:url", "type": "regex", "value": "~(?:(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.1|0\\\\.0\\\\.0\\\\.0|\\\\[::1\\\\]|169\\\\.254\\\\.169\\\\.254|metadata\\\\.google\\\\.internal|metadata\\\\.azure\\\\.com)|(?:^|//)(?:10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)|(?:^|//)0(?:x[0-9a-fA-F]+|[0-7]+)(?:\\\\.|/|$)|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2025-9975", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9975", "description": "WP Scraper <=5.8.1 authenticated SSRF via action=downloader url parameter targeting internal/cloud metadata endpoints", "method": "GET", "mode": "block", "severity": 6.8, "slug": "wp-scraper", "tags": ["ssrf", "server-side-request-forgery", "cloud-metadata", "authenticated"], "target": "plugin", "versions": "<=5.8.1"}, "RULE-CVE-2025-9984-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/debug-posts/[0-9]+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-9984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9984", "description": "Featured Image from URL <=5.2.7 unauthenticated access to debug-posts REST endpoint exposes private/password-protected posts", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9984-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/debug-slug/[a-zA-Z0-9_-]+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-9984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9984", "description": "Featured Image from URL <=5.2.7 unauthenticated access to debug-slug REST endpoint exposes private/password-protected posts", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9984-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-image-from-url/v2/debug-postmeta/[0-9]+(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2025-9984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9984", "description": "Featured Image from URL <=5.2.7 unauthenticated access to debug-postmeta REST endpoint exposes private/password-protected post metadata", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9985-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]wp-content[/\\\\\\\\]uploads[/\\\\\\\\]fifu-(plugin|cloud)\\\\.log([?/]|$)~i"}], "cve": "CVE-2025-9985", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9985", "description": "Featured Image from URL <=5.2.7 unauthenticated sensitive log file disclosure via direct access to fifu-plugin.log or fifu-cloud.log in uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "featured-image-from-url", "tags": ["information-disclosure", "sensitive-log-exposure", "unauthenticated"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2025-9990-01": {"action": "init", "conditions": [{"name": "ARGS:portal_type", "type": "regex", "value": "~([/\\\\\\\\]|%2[fF]|%5[cC]|\\\\.\\\\.|(\\\\.|%2[eE]){2}|%00|[a-zA-Z]+://)~"}], "cve": "CVE-2025-9990", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9990", "description": "WordPress Helpdesk Integration <=5.8.10 unauthenticated Local File Inclusion via portal_type parameter", "mode": "block", "severity": 8.1, "slug": "wp-helpdesk-integration", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=5.8.10"}, "RULE-CVE-2025-9992-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:meta[ghostkit_page_js]", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2025-9992", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2025-9992", "description": "Ghost Kit <=3.4.3 Authenticated (Contributor+) Stored XSS via ghostkit_page_js post meta field on REST API post update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ghostkit", "tags": ["xss", "stored-xss", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-0548-01": {"ajax_action": "tutor_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0548", "description": "Tutor LMS <=3.9.4 missing authorization on tutor_import_settings AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.4"}, "RULE-CVE-2026-0548-02": {"ajax_action": "load_saved_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0548", "description": "Tutor LMS <=3.9.4 missing authorization on load_saved_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.4"}, "RULE-CVE-2026-0548-03": {"ajax_action": "reset_settings_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0548", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0548", "description": "Tutor LMS <=3.9.4 missing authorization on reset_settings_data AJAX handler", "method": "POST", "mode": "block", "severity": 5.4, "slug": "tutor", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.4"}, "RULE-CVE-2026-0549-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[groups_group_info\\\\b[^\\\\]]*(?:single|plural|none)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+>[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0549", "description": "Groups <=3.10.0 Stored XSS via groups_group_info shortcode attributes (single/plural/none) in post content submitted through post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "groups", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2026-0549-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[groups_group_info\\\\b[^\\\\]]*(?:single|plural|none)\\\\s*=\\\\s*[\\"\'][^\\"\']*<[^>]+>[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0549", "description": "Groups <=3.10.0 Stored XSS via groups_group_info shortcode attributes (single/plural/none) in post content submitted through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "groups", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.10.0"}, "RULE-CVE-2026-0550-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/post\\\\.php|/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mycred_load_coupon\\\\b[^\\\\]]*\\\\b(?:label|button|placeholder)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0550", "method": "POST", "mode": "block", "severity": 6.4, "slug": "mycred", "target": "plugin", "versions": "<=2.9.7.3"}, "RULE-CVE-2026-0552-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|post)$~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:wpsc_display_product|wp_cart_display_product)\\\\b(?=[^\\\\]]*\\\\b(?:product_id|id)\\\\s*=\\\\s*[\\"\']?\\\\d+[\\"\']?)(?=[^\\\\]]*\\\\b(?:thumb|thumbnail|description|template|style|class)\\\\s*=\\\\s*[\\"\'][^\\"\\\\]]*(?:<\\\\s*(?:script|img|svg)\\\\b|on[a-z]{3,}\\\\s*=|javascript\\\\s*:))(?=[^\\\\]]*[\\"\'])[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0552", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0552", "description": "Simple Shopping Cart <=5.2.4 Contributor+ stored XSS via wpsc_display_product shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-simple-paypal-shopping-cart", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.2.4"}, "RULE-CVE-2026-0554-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics/regenerate(?:[/?]|$)~"}, {"type": "missing_capability", "value": "edit_notificationx"}], "cve": "CVE-2026-0554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0554", "description": "NotificationX <=3.1.11 missing authorization on analytics/regenerate REST endpoint allows contributor+ analytics reset", "mode": "block", "severity": 4.3, "slug": "notificationx", "tags": ["missing-authorization", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=3.1.11"}, "RULE-CVE-2026-0554-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/notificationx/v1/analytics/reset(?:[/?]|$)~"}, {"type": "missing_capability", "value": "edit_notificationx"}], "cve": "CVE-2026-0554", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0554", "description": "NotificationX <=3.1.11 missing authorization on analytics/reset REST endpoint allows contributor+ analytics reset", "mode": "block", "severity": 4.3, "slug": "notificationx", "tags": ["missing-authorization", "rest-api", "broken-access-control"], "target": "plugin", "versions": "<=3.1.11"}, "RULE-CVE-2026-0555-01": {"ajax_action": "premmerce_wizard_actions", "conditions": [{"name": "ARGS:state", "type": "detectXSS"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0555", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0555", "description": "Premmerce <=1.3.20 authenticated stored XSS via premmerce_wizard_actions state parameter (all update sub-actions)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "premmerce", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.3.20"}, "RULE-CVE-2026-0556-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[xo_event_field\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<(?:script|img|svg|iframe|object|embed))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0556", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0556", "description": "XO Event Calendar <=3.2.10 Authenticated (Contributor+) Stored XSS via xo_event_field shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "xo-event-calendar", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.2.10"}, "RULE-CVE-2026-0556-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[xo_event_field\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|javascript:|<(?:script|img|svg|iframe|object|embed))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0556", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0556", "description": "XO Event Calendar <=3.2.10 Authenticated (Contributor+) Stored XSS via xo_event_field shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "xo-event-calendar", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.2.10"}, "RULE-CVE-2026-0557-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "contains", "value": "[wpda_app"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpda_app\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b[^>]*\\\\bonerror\\\\s*=|<svg\\\\b[^>]*\\\\bonload\\\\s*=|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0557", "description": "WP Data Access <=5.5.63 Stored XSS via wpda_app shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-data-access", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=5.5.63"}, "RULE-CVE-2026-0557-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[wpda_app"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wpda_app\\\\b[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript\\\\s*:|<img\\\\b[^>]*\\\\bonerror\\\\s*=|<svg\\\\b[^>]*\\\\bonload\\\\s*=|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0557", "description": "WP Data Access <=5.5.63 Stored XSS via wpda_app shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-data-access", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.5.63"}, "RULE-CVE-2026-0559-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[stm_lms_courses_grid_display\\\\s+[^\\\\]]*(?:<script|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-0559", "method": "POST", "mode": "block", "severity": 6.4, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<=3.7.11"}, "RULE-CVE-2026-0559-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[stm_lms_courses_grid_display\\\\s+[^\\\\]]*(?:<script|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-0559", "method": "POST", "mode": "block", "severity": 6.4, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<=3.7.11"}, "RULE-CVE-2026-0559-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(?:/\\\\d+)?(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[stm_lms_courses_grid_display\\\\s+[^\\\\]]*(?:<script|(?:^|[^a-z])on\\\\w+\\\\s*=|javascript\\\\s*:|<svg|<img\\\\s[^>]*onerror|<iframe)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-0559", "method": "POST", "mode": "block", "severity": 6.4, "slug": "masterstudy-lms-learning-management-system", "target": "plugin", "versions": "<=3.7.11"}, "RULE-CVE-2026-0563-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wpgsv_map\\\\b[^\\\\]]*(?:\\\\bon\\\\w+\\\\s*=|<script|javascript\\\\s*:|data\\\\s*:[^,]*text/html)~i"}], "cve": "CVE-2026-0563", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0563", "description": "WP Google Street View <=1.1.8 Stored XSS via wpgsv_map shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-google-street-view", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-0604-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/template/directory-tree(?:/|\\\\?|&|$)~"}, {"name": "ARGS:dir_path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc(?:[\\\\\\\\/]|$)|[\\\\\\\\/]proc(?:[\\\\\\\\/]|$)|[\\\\\\\\/]var[\\\\\\\\/]log(?:[\\\\\\\\/]|$))~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0604", "method": "GET", "mode": "block", "severity": 6.5, "slug": "fastdup", "target": "plugin", "versions": "<=2.7"}, "RULE-CVE-2026-0608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:metakeyselect", "type": "equals", "value": "head-meta-data"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-0608", "method": "POST", "mode": "block", "severity": 6.4, "slug": "head-meta-data", "target": "plugin", "versions": "<=20251118"}, "RULE-CVE-2026-0608-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:metakeyinput", "type": "equals", "value": "head-meta-data"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:~i"}], "cve": "CVE-2026-0608", "method": "POST", "mode": "block", "severity": 6.4, "slug": "head-meta-data", "target": "plugin", "versions": "<=20251118"}, "RULE-CVE-2026-0609-01": {"action": "init", "conditions": [{"name": "ARGS:shortcode", "type": "regex", "value": "~\\\\[logo-slider[\\\\s\\\\]]~i"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~(?:on(?:error|load|click|mouseover)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-0609", "description": "Logo Slider WP <=4.9.0 stored XSS via shortcode image alt attribute", "mode": "block", "severity": 6.4, "slug": "logo-slider-wp", "target": "plugin", "versions": "<=4.9.0"}, "RULE-CVE-2026-0617-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "customer_cabinet__update"}, {"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|img|svg|iframe|object|embed|link|style|base|form|input|details|video|audio|meta)\\\\b|<[^>]*\\\\bon(?:error|load|click|mouseover|focus(?:in)?|blur|submit|change|input|keydown|keyup|contextmenu|dblclick|drag|drop|mousedown|mouseup|pointerdown|begin|end|toggle|animationend)\\\\s*=~i"}], "cve": "CVE-2026-0617", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0617", "description": "LatePoint <= 5.2.5 unauthenticated stored XSS via customer profile fields in the customer_cabinet__update route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "latepoint", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=5.2.5"}, "RULE-CVE-2026-0627-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:async-upload\\\\.php|media-new\\\\.php|admin-ajax\\\\.php)~"}, {"name": "ARGS:name", "type": "regex", "value": "~\\\\.svg$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0627", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0627", "description": "AMP for WP <=1.1.10 Stored XSS via SVG upload \\u2013 best-effort filename gate (blocks all SVG uploads on vulnerable versions; engine cannot inspect file content)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "accelerated-mobile-pages", "tags": ["xss", "stored-xss", "svg-upload", "file-upload", "best-effort"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2026-0635-01": {"ajax_action": "accordion_slider_save_images", "conditions": [{"name": "ARGS:gallery", "type": "exists"}, {"name": "ARGS:images", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0635", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0635", "description": "Responsive Accordion Slider <=1.2.2 missing authorization via accordion_slider_save_images allows authenticated (Contributor+) users to modify arbitrary slider post metadata", "mode": "block", "severity": 4.3, "slug": "responsive-accordion-slider", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-0656-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^Ipaymu_WC_Gateway$~"}, {"name": "ARGS:id_order", "type": "exists"}, {"name": "ARGS:status", "type": "exists"}], "cve": "CVE-2026-0656", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0656-02": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^Ipaymu_WC_Gateway$~"}, {"name": "ARGS:id_order", "type": "exists"}], "cve": "CVE-2026-0656", "method": "GET", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0656-03": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^WC_Gateway_Ipaymu$~"}, {"name": "ARGS:id_order", "type": "exists"}, {"name": "ARGS:status", "type": "exists"}], "cve": "CVE-2026-0656", "method": "POST", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0656-04": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~(?i)^WC_Gateway_Ipaymu$~"}, {"name": "ARGS:id_order", "type": "exists"}], "cve": "CVE-2026-0656", "method": "GET", "mode": "block", "severity": 8.2, "slug": "ipaymu-for-woocommerce", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-0677-01": {"ajax_action": "totalcontest", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-0677", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0677", "description": "TotalContest Lite <=2.9.1 PHP object injection via totalcontest general router AJAX handler (wp_ajax_totalcontest / wp_ajax_nopriv_totalcontest)", "mode": "block", "severity": 7.2, "slug": "totalcontest-lite", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2026-0679-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-api=WC_Gateway_Fortis_Notify(?:&|$)~i"}, {"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-0679", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0679", "description": "Fortis for WooCommerce <=1.2.0 unauthenticated order status update via inverted nonce check \\u2014 blocks POST with transaction data payload to the Fortis notify wc-api callback when user lacks manage_woocommerce", "mode": "block", "severity": 5.3, "slug": "fortis-for-woocommerce", "tags": ["missing-authorization", "authentication-bypass", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-0681-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:random_number_generator_format", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*[\\\\s/](?:on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mousemove|dblclick|contextmenu|input|invalid|reset|search|drag|drop|copy|cut|paste|beforeunload|unload|hashchange|message|scroll|wheel|animationend|animationiteration|animationstart|transitionend|pointerdown|pointerup|pointermove|afterprint|beforeprint)\\\\s*=)|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0681", "description": "Extended Random Number Generator <= 1.1 Stored XSS via plugin settings (random_number_generator_format)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "extended-random-number-generator", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-0681-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:random_number_generator_shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*[\\\\s/](?:on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mousemove|dblclick|contextmenu|input|invalid|reset|search|drag|drop|copy|cut|paste|beforeunload|unload|hashchange|message|scroll|wheel|animationend|animationiteration|animationstart|transitionend|pointerdown|pointerup|pointermove|afterprint|beforeprint)\\\\s*=)|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0681", "description": "Extended Random Number Generator <= 1.1 Stored XSS via plugin settings (random_number_generator_shortcode)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "extended-random-number-generator", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-0681-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:random_number_generator_parent_menu", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-zA-Z][^>]*[\\\\s/](?:on(?:load|error|click|mouseover|focus|blur|change|submit|keydown|keyup|mouseout|mousemove|dblclick|contextmenu|input|invalid|reset|search|drag|drop|copy|cut|paste|beforeunload|unload|hashchange|message|scroll|wheel|animationend|animationiteration|animationstart|transitionend|pointerdown|pointerup|pointermove|afterprint|beforeprint)\\\\s*=)|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0681", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0681", "description": "Extended Random Number Generator <= 1.1 Stored XSS via plugin settings (random_number_generator_parent_menu)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "extended-random-number-generator", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-0683-01": {"ajax_action": "wpsc_get_tickets", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:[\'\\")\\\\]]\\\\s*(?:OR|AND|UNION|HAVING)\\\\s)|(?:UNION[\\\\s/\\\\*]+(?:ALL\\\\s+)?SELECT)|(?:SELECT[\\\\s/\\\\*]+(?:[\\\\w*,\\\\s]+)?FROM)|(?:CONCAT\\\\s*\\\\()|(?:GROUP\\\\s+BY.+\\\\()|(?:SLEEP\\\\s*\\\\()|(?:BENCHMARK\\\\s*\\\\()|(?:(?:0x[\\\\da-f]+|X\'[\\\\da-f]+\'|B\'[01]+\'|\'[^\']*\')\\\\s*(?:OR|AND|XOR)\\\\s))~i"}], "cve": "CVE-2026-0683", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0683", "description": "SupportCandy <=3.4.4 authenticated SQL injection via Number-type custom field filter operand in wpsc_get_tickets AJAX handler", "mode": "block", "severity": 6.5, "slug": "supportcandy", "tags": ["sql-injection", "authenticated", "custom-field-filter"], "target": "plugin", "versions": "<=3.4.4"}, "RULE-CVE-2026-0684-01": {"action": "admin_init", "conditions": [{"name": "ARGS:cpis_import", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0684", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0684", "description": "CP Image Store <=1.1.9 incorrect authorization on importer allows subscriber+ to import products via flawed boolean logic", "method": "POST", "mode": "block", "severity": 4.3, "slug": "cp-image-store", "tags": ["incorrect-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0686-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/webmention/1\\\\.0/endpoint(?:[/?]|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~^(?:https?://(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0\\\\.|0x[0-9a-fA-F]|\\\\[?::(?:ffff:)?|localhost|metadata\\\\.google|169\\\\.254\\\\.|2130706433|2886729728|2851995648)|(?:file|gopher|dict)://)~i"}], "cve": "CVE-2026-0686", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0686", "description": "Webmention <=5.6.2 unauthenticated blind SSRF via source parameter on REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "webmention", "tags": ["ssrf", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2026-0688-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/webmention/1\\\\.0/tools(?:[/?&]|$)~"}, {"name": "ARGS:source", "type": "regex", "value": "~(?:^https?://(?:127\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?|localhost)(?:[:/]|$)|^(?!https?://)\\\\w+://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0688", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0688", "description": "Webmention <=5.6.2 authenticated (Subscriber+) SSRF via source parameter in Tools::read REST endpoint", "mode": "block", "severity": 6.4, "slug": "webmention", "tags": ["ssrf", "missing-authorization", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.2"}, "RULE-CVE-2026-0692-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|[?&])wc-api=bluesnap(?:$|&)~i"}, {"name": "REQUEST_HEADERS:User-Agent", "type": "equals", "value": "BlueSnap"}, {"name": "ARGS:transactionType", "type": "regex", "value": "~^(?:CHARGE|REFUND|DECLINE|RECURRING_PAYMENT_SKIPPED)$~"}, {"name": "ARGS:merchantTransactionId", "type": "exists"}, {"name": "ARGS:referenceNumber", "type": "exists"}, {"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "exists"}], "cve": "CVE-2026-0692", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0692", "description": "BlueSnap Payment Gateway for WooCommerce <=3.4.0 unauthenticated IPN webhook authorization bypass via spoofed BlueSnap headers", "method": "POST", "mode": "block", "severity": 7.5, "slug": "bluesnap-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "ip-spoofing", "unauthenticated", "webhook-bypass", "business-logic"], "target": "plugin", "versions": "<=3.4.0"}, "RULE-CVE-2026-0693-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:description", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|<[^>]+[\\\\s/]on[a-z0-9_-]+\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0693", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0693", "description": "Allow HTML in Category Descriptions <=1.2.4 authenticated stored XSS via category description in edit-tags.php", "method": "POST", "mode": "block", "severity": 4.4, "slug": "allow-html-in-category-descriptions", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=1.2.4"}, "RULE-CVE-2026-0693-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "add-tag"}, {"name": "ARGS:description", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|<[^>]+[\\\\s/]on[a-z0-9_-]+\\\\s*=|=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0693", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0693", "description": "Allow HTML in Category Descriptions <=1.2.4 authenticated stored XSS via category description in AJAX add-tag", "method": "POST", "mode": "block", "severity": 4.4, "slug": "allow-html-in-category-descriptions", "tags": ["xss", "stored-xss", "missing-capability"], "target": "plugin", "versions": "<=1.2.4"}, "RULE-CVE-2026-0694-01": {"ajax_action": "searchwiz_ajax_load_posts_json", "cve": "CVE-2026-0694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0694", "description": "SearchWiz <=1.0.0 stored XSS via unauthenticated search JSON endpoint (html_entity_decode on post title)", "mode": "block", "severity": 6.4, "slug": "searchwiz", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-0694-02": {"ajax_action": "searchwiz_ajax_load_posts", "cve": "CVE-2026-0694", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0694", "description": "SearchWiz <=1.0.0 stored XSS via unauthenticated legacy HTML search endpoint (esc_attr instead of esc_html)", "mode": "block", "severity": 6.4, "slug": "searchwiz", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-0702-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vsfw/v1/videos(/|\\\\?|&|$)~"}, {"name": "ARGS:fields", "type": "detectSQLi"}], "cve": "CVE-2026-0702", "method": "GET", "mode": "block", "severity": 7.5, "slug": "vidshop-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-0702-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/vsfw/v1/videos(/|\\\\?|&|$)~"}, {"name": "ARGS:ids", "type": "detectSQLi"}], "cve": "CVE-2026-0702", "method": "GET", "mode": "block", "severity": 7.5, "slug": "vidshop-for-woocommerce", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-0718-01": {"ajax_action": "ultp_share_count", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"name": "ARGS:share_count", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-0718", "description": "PostX <=5.0.5 unauthenticated arbitrary post meta modification via ultp_share_count AJAX handler", "mode": "block", "severity": 5.3, "slug": "ultimate-post", "target": "plugin", "versions": "<=5.0.5"}, "RULE-CVE-2026-0722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/admin-ajax.php"}, {"name": "ARGS:search[value]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|U[Nn]\\\\s*/\\\\*|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|extractvalue\\\\s*\\\\(|updatexml\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-0722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0722", "description": "Shield Security <=21.0.9 CSRF to SQL Injection via search[value] parameter in traffic table DataTables endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-simple-firewall", "tags": ["sql-injection", "csrf", "datatables"], "target": "plugin", "versions": "<=21.0.9"}, "RULE-CVE-2026-0722-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/admin-ajax.php"}, {"name": "ARGS:order[0][column]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|U[Nn]\\\\s*/\\\\*|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|extractvalue\\\\s*\\\\(|updatexml\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-0722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0722", "description": "Shield Security <=21.0.9 CSRF to SQL Injection via order[0][column] parameter in traffic table DataTables endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-simple-firewall", "tags": ["sql-injection", "csrf", "datatables"], "target": "plugin", "versions": "<=21.0.9"}, "RULE-CVE-2026-0726-01": {"ajax_action": "nxt_replace_url", "conditions": [{"name": "ARGS", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2026-0726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0726", "description": "Nexter Extension <=4.4.6 unauthenticated PHP Object Injection via nxt_replace_url AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "nexter-extension", "tags": ["object-injection", "deserialization", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-0726-02": {"ajax_action": "nxt_replace_confirm_url", "conditions": [{"name": "ARGS", "type": "regex", "value": "~O:\\\\d+:\\"~"}], "cve": "CVE-2026-0726", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0726", "description": "Nexter Extension <=4.4.6 unauthenticated PHP Object Injection via nxt_replace_confirm_url AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "nexter-extension", "tags": ["object-injection", "deserialization", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-0727-01": {"ajax_action": "wp_aas_get_attachment_edit_form", "conditions": [{"name": "ARGS:attachment_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-0727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0727", "description": "Accordion and Accordion Slider <=1.4.5 missing authorization on wp_aas_get_attachment_edit_form AJAX allowing authenticated users to read any attachment metadata", "method": "POST", "mode": "block", "severity": 5.4, "slug": "accordion-and-accordion-slider", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-0727-02": {"ajax_action": "wp_aas_save_attachment_data", "conditions": [{"name": "ARGS:attachment_id", "type": "regex", "value": "~^\\\\d+$~"}, {"name": "ARGS:form_data", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-0727", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0727", "description": "Accordion and Accordion Slider <=1.4.5 missing authorization on wp_aas_save_attachment_data AJAX allowing authenticated users to modify any attachment metadata", "method": "POST", "mode": "block", "severity": 5.4, "slug": "accordion-and-accordion-slider", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-0736-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:_inpost_head_script", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<embed[^>]*>|<object[^>]*>~i"}, {"name": "ARGS:_inpost_head_script[synth_header_script]", "type": "regex", "value": "~<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[^>]*>|<embed[^>]*>|<object[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0736", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0736", "description": "Chatbot for WordPress by Collect.chat <=2.4.8 Stored XSS via _inpost_head_script post meta field (missing unfiltered_html capability check)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "collectchat", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-0741-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/options.php"}, {"name": "ARGS:option_page", "type": "regex", "value": "~^esdc_(options_group|file_types)$~"}, {"name": "ARGS:esdc_file_types", "type": "detectXSS"}], "cve": "CVE-2026-0741", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0741", "description": "Electric Studio Download Counter <=2.4 Authenticated (Administrator+) Stored XSS via esdc_file_types settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "electric-studio-download-counter", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2026-0741-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/options.php"}, {"name": "ARGS:option_page", "type": "equals", "value": "esdc_options_group"}, {"name": "ARGS:esdc_blocked_ips", "type": "detectXSS"}], "cve": "CVE-2026-0741", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0741", "description": "Electric Studio Download Counter <=2.4 Authenticated (Administrator+) Stored XSS via esdc_blocked_ips settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "electric-studio-download-counter", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=2.4"}, "RULE-CVE-2026-0742-01": {"ajax_action": "saab_save_form_data", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0742", "description": "Smart Appointment & Booking <=1.0.7 authenticated stored XSS via saab_save_form_data AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smart-appointment-booking", "tags": ["xss", "stored-xss", "missing-authorization"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-0742-02": {"ajax_action": "saab_save_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=~i"}], "cve": "CVE-2026-0742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0742", "description": "Smart Appointment & Booking <=1.0.7 unauthenticated stored XSS via saab_save_form_submission AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "smart-appointment-booking", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-0746-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/mwai/v1/simpleTranscribeAudio(?:/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "regex", "value": "~^(?:(?:https?|ftp)://(?:127\\\\.|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(1[6-9]|2\\\\d|3[0-1])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|::1|fd[0-9a-f]{2}:)|file://|gopher://|dict://|php://|data:|zlib://|glob://|phar://|ssh2?:|s?ftp://|imap://|pop3://|smtp://|127\\\\.|localhost|0\\\\.0\\\\.0\\\\.0|10\\\\.|172\\\\.(1[6-9]|2\\\\d|3[0-1])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|::1|fd[0-9a-f]{2}:)~i"}], "cve": "CVE-2026-0746", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ai-engine", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-0751-01": {"action": "init", "conditions": [{"name": "ARGS:pricing_plan_select_text_font_family", "type": "regex", "value": "~(<[a-zA-Z]|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:|on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2026-0751", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0751", "description": "Payment Page <=1.4.6 Stored XSS via pricing_plan_select_text_font_family parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "payment-page", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2026-0753-01": {"action": "init", "conditions": [{"name": "ARGS:sscf_name", "type": "detectXSS"}], "cve": "CVE-2026-0753", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0753", "description": "Super Simple Contact Form <=1.6.2 Reflected Cross-Site Scripting via sscf_name parameter", "mode": "block", "severity": 7.2, "slug": "super-simple-contact-form", "tags": ["xss", "reflected-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2026-0806-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-clanwars-teams"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:[`\'\\";]|UNION|SELECT|SLEEP|BENCHMARK|IF\\\\s*[(]|CASE\\\\s+WHEN|EXTRACTVALUE|UPDATEXML|LOAD_FILE|INTO\\\\s+(?:OUT|DUMP)FILE|/[*]|--\\\\s)~i"}], "cve": "CVE-2026-0806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0806", "description": "WP-ClanWars <=2.0.1 authenticated SQL Injection via orderby parameter on Teams admin page", "mode": "block", "severity": 4.9, "slug": "wp-clanwars", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-0807-01": {"action": "template_redirect", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/template-proxy/|[?&](?:frontis_)?template_proxy=)~i"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0807", "description": "Frontis Blocks <=1.1.6 unauthenticated SSRF via template-proxy endpoint url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "frontis-blocks", "tags": ["ssrf", "unauthenticated", "server-side-request-forgery"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-0807-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/custom/v1/proxy-image(/|\\\\?|&|$)~"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0807", "description": "Frontis Blocks <=1.1.6 authenticated SSRF via proxy-image REST endpoint url parameter", "method": "GET", "mode": "block", "severity": 7.2, "slug": "frontis-blocks", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-0811-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^cf7-details~"}, {"name": "ARGS:del_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0811", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0811", "description": "Advanced CF7 DB <=2.0.9 CSRF allows unauthorized deletion/modification via missing nonce on vsz_cf7_save_setting_callback", "method": "POST", "mode": "block", "severity": 5.4, "slug": "advanced-cf7-db", "tags": ["csrf", "missing-authorization"], "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-0812-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "linkedin_sc"}, {"name": "ARGS:linkedin_sc_date_format", "type": "detectXSS"}], "cve": "CVE-2026-0812", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0812", "description": "LinkedIn SC <=1.1.9 authenticated (Administrator+) stored XSS via linkedin_sc_date_format settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "linkedin-sc", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0812-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "linkedin_sc"}, {"name": "ARGS:linkedin_sc_api_key", "type": "detectXSS"}], "cve": "CVE-2026-0812", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0812", "description": "LinkedIn SC <=1.1.9 authenticated (Administrator+) stored XSS via linkedin_sc_api_key settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "linkedin-sc", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0812-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "linkedin_sc"}, {"name": "ARGS:linkedin_sc_secret_key", "type": "detectXSS"}], "cve": "CVE-2026-0812", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0812", "description": "LinkedIn SC <=1.1.9 authenticated (Administrator+) stored XSS via linkedin_sc_secret_key settings field", "method": "POST", "mode": "block", "severity": 4.4, "slug": "linkedin-sc", "tags": ["xss", "stored-xss", "settings-page"], "target": "plugin", "versions": "<=1.1.9"}, "RULE-CVE-2026-0813-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "short_link_options"}, {"name": "ARGS:short_link_post_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-0813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0813", "description": "Short Link <=1.0 administrator+ stored XSS via short_link_post_title settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "short-link", "tags": ["xss", "stored", "settings-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-0813-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "short_link_options"}, {"name": "ARGS:short_link_page_title", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-0813", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0813", "description": "Short Link <=1.0 administrator+ stored XSS via short_link_page_title settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "short-link", "tags": ["xss", "stored", "settings-api"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-0815-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/edit-tags\\\\.php~"}, {"name": "ARGS:tag-image", "type": "regex", "value": "~(?:<script[\\\\s/>]|<(?:img|svg|iframe|object|embed|body|details|math)\\\\b[^>]*\\\\bon[a-z]+=|\\\\bon(?:error|load|mouseover|click|focus|blur|input|change|animationend|transitionend)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-0815", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0815", "description": "Category Image <=2.0 authenticated (Editor+) stored XSS via tag-image parameter on term edit/create", "method": "POST", "mode": "block", "severity": 4.4, "slug": "category-image", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-0816-01": {"action": "admin_init", "conditions": [{"name": "ARGS:delete_id", "type": "detectSQLi"}], "cve": "CVE-2026-0816", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0816", "description": "All Push Notification for WP <=1.5.3 authenticated SQL injection via delete_id in process_bulk_action", "mode": "block", "severity": 4.9, "slug": "all-push-notification", "tags": ["sql-injection", "authenticated", "admin-only"], "target": "plugin", "versions": "<=1.5.3"}, "RULE-CVE-2026-0825-01": {"action": "init", "conditions": [{"name": "ARGS:vx_crm_form_action", "type": "equals", "value": "download_csv"}, {"name": "ARGS:vx_crm_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0825", "description": "Database for Contact Form 7, WPforms, Elementor forms <=1.4.5 unauthenticated CSV export data exfiltration via missing authorization", "mode": "block", "severity": 5.3, "slug": "contact-form-entries", "tags": ["missing-authorization", "data-exfiltration", "unauthenticated"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-0829-01": {"ajax_action": "wpfm_send_file_in_email", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-0829", "method": "POST", "mode": "block", "severity": 5.8, "slug": "nmedia-user-file-uploader", "target": "plugin", "versions": "<23.6"}, "RULE-CVE-2026-0831-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:session_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in session_id on templately_pack_import AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:content_id", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}~"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in content_id on templately_pack_import AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:session_id", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in session_id targeting sensitive files", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:content_id", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated arbitrary .ai.json file write via path traversal in content_id targeting sensitive files", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["path-traversal", "arbitrary-file-write", "unauthenticated", "incorrect-authorization"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0831-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-ajax.php"}, {"name": "ARGS:action", "type": "regex", "value": "~^templately_pack_~"}, {"name": "ARGS:session_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-0831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0831", "description": "Templately <=3.4.8 unauthenticated access to templately_pack_* AJAX handlers missing authorization", "method": "POST", "mode": "block", "severity": 5.3, "slug": "templately", "tags": ["missing-authorization", "incorrect-authorization", "unauthenticated", "arbitrary-file-write"], "target": "plugin", "versions": "<=3.4.8"}, "RULE-CVE-2026-0832-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/connect-app(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/user-approve(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/user-deny(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/get-user-details(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/get-all-requests(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0832-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nua-request/v1/get-dashboard-data(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0832", "method": "GET", "mode": "block", "severity": 7.3, "slug": "new-user-approve", "target": "plugin", "versions": "<=3.2.2"}, "RULE-CVE-2026-0833-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via javascript: URI in post content containing team-section block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~on\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via event handler injection in post content containing team-section block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~data\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via data: URI in post content containing team-section block (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via javascript: URI in post content containing team-section block (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~on\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via event handler injection in post content containing team-section block (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0833-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "team-section"}, {"name": "ARGS:content", "type": "regex", "value": "~data\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0833", "description": "Team Section Block <=2.0.0 stored XSS via data: URI in post content containing team-section block (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "team-section", "tags": ["xss", "stored-xss", "gutenberg-block"], "target": "plugin", "versions": "<=2.0.0"}, "RULE-CVE-2026-0845-01": {"ajax_action": "wcfm_ajax_controller", "conditions": [{"name": "ARGS:controller", "type": "equals", "value": "wcfm-settings"}, {"name": "ARGS:wcfm_settings_form", "type": "regex", "value": "~wcfm_page_options(?:%5[Bb]|\\\\[)(?!(?:wc_frontend_manager_page_id|wcfm_vendor_membership_page_id|wcfm_vendor_registration_page_id|wcfm_affiliate_registration_page_id)(?:%5[Dd]|\\\\]))~"}], "cve": "CVE-2026-0845", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wc-frontend-manager", "target": "plugin", "versions": "<=6.7.24"}, "RULE-CVE-2026-0867-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php$~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ew-(author|archive|category|page|menu)\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|toggle|mouseover|focus|blur)\\\\s*=|javascript:|<iframe|<embed|<object|<svg[^>]*on[a-zA-Z0-9_]+\\\\s*=|<img[^>]*on[a-zA-Z0-9_]+\\\\s*=)~i"}], "cve": "CVE-2026-0867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0867", "description": "Essential Widgets <=3.0 Authenticated (Contributor+) Stored XSS via ew-page, ew-author, ew-archive, ew-category, ew-menu shortcodes in post content (wp-admin)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-widgets", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-0867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ew-(author|archive|category|page|menu)\\\\b[^\\\\]]*(?:<script|on(?:error|load|click|toggle|mouseover|focus|blur)\\\\s*=|javascript:|<iframe|<embed|<object|<svg[^>]*on[a-zA-Z0-9_]+\\\\s*=|<img[^>]*on[a-zA-Z0-9_]+\\\\s*=)~i"}], "cve": "CVE-2026-0867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0867", "description": "Essential Widgets <=3.0 Authenticated (Contributor+) Stored XSS via ew-page, ew-author, ew-archive, ew-category, ew-menu shortcodes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-widgets", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-0909-01": {"ajax_action": "wp_ulike_delete_history_api", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0909", "description": "WP ULike <=4.8.3.1 Insecure Direct Object Reference allowing authenticated users to delete arbitrary log entries via wp_ulike_delete_history_api AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wp-ulike", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=4.8.3.1"}, "RULE-CVE-2026-0910-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wpforo-tools"}, {"name": "ARGS:wpfu", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0910", "description": "wpForo Forum <=2.4.13 authenticated PHP Object Injection via maybe_unserialize in wpforo_display_array_data on debug tools page", "mode": "block", "severity": 8.8, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.13"}, "RULE-CVE-2026-0911-01": {"ajax_action": "hustle_module_handle_single_action", "conditions": [{"name": "FILES:import_file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0911", "method": "POST", "mode": "block", "slug": "wordpress-popup", "target": "plugin", "versions": "<=7.8.9.2"}, "RULE-CVE-2026-0912-01": {"ajax_action": "trman_save_option", "conditions": [{"name": "ARGS:option", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0912", "description": "Toret Manager <=1.2.7 missing authorization on trman_save_option allows authenticated privilege escalation", "mode": "block", "severity": 8.8, "slug": "toret-manager", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-0912-02": {"ajax_action": "trman_save_option_items", "conditions": [{"name": "ARGS:name", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0912", "description": "Toret Manager <=1.2.7 missing authorization on trman_save_option_items allows authenticated privilege escalation", "mode": "block", "severity": 8.8, "slug": "toret-manager", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-0916-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[related_posts_by_tax[ \\\\t][^\\\\]]*(?:<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 Stored XSS via related_posts_by_tax shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0916-03": {"ajax_action": "rpbt_lazy_loading", "conditions": [{"name": "ARGS:rpbt_args[title]", "type": "regex", "value": "~<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object~i"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 XSS via rpbt_lazy_loading AJAX handler rpbt_args[title]", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "ajax"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0916-04": {"ajax_action": "rpbt_lazy_loading", "conditions": [{"name": "ARGS:rpbt_args[before_title]", "type": "regex", "value": "~<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object~i"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 XSS via rpbt_lazy_loading AJAX handler rpbt_args[before_title]", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "ajax"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0916-05": {"ajax_action": "rpbt_lazy_loading", "conditions": [{"name": "ARGS:rpbt_args[after_title]", "type": "regex", "value": "~<script|on(?:load|error|click|mouseover|toggle|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<svg|<iframe|<embed|<object~i"}], "cve": "CVE-2026-0916", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0916", "description": "Related Posts by Taxonomy <=2.7.6 XSS via rpbt_lazy_loading AJAX handler rpbt_args[after_title]", "method": "POST", "mode": "block", "severity": 6.4, "slug": "related-posts-by-taxonomy", "tags": ["xss", "ajax"], "target": "plugin", "versions": "<=2.7.6"}, "RULE-CVE-2026-0920-01": {"ajax_action": "lakit_ajax", "conditions": [{"name": "ARGS:lakit_bkrole", "type": "regex", "value": "~(?:administrator|editor|author)~i"}], "cve": "CVE-2026-0920", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.5.6.3"}, "RULE-CVE-2026-0920-02": {"action": "init", "conditions": [{"name": "ARGS:lakit_bkrole", "type": "regex", "value": "~(?:administrator|editor|author)~i"}, {"name": "ARGS:email", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-0920", "method": "POST", "mode": "block", "severity": 9.8, "slug": "lastudio-element-kit", "target": "plugin", "versions": "<=1.5.6.3"}, "RULE-CVE-2026-0939-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/redeIntegration/maxipagoDebitListener(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0939", "description": "Rede Ita\\u00fa for WooCommerce <=5.1.2 unauthenticated order status manipulation via forged Maxipago debit webhook on /redeIntegration/maxipagoDebitListener", "method": "POST", "mode": "block", "severity": 5.3, "slug": "woo-rede", "tags": ["insufficient-verification", "forged-webhook", "unauthenticated", "order-manipulation"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-0939-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/woorede/s(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0939", "description": "Rede Ita\\u00fa for WooCommerce <=5.1.2 unauthenticated order status manipulation via forged 3DS success callback on /woorede/s", "method": "POST", "mode": "block", "severity": 5.3, "slug": "woo-rede", "tags": ["insufficient-verification", "forged-webhook", "unauthenticated", "order-manipulation"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-0939-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/woorede/f(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0939", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0939", "description": "Rede Ita\\u00fa for WooCommerce <=5.1.2 unauthenticated order status manipulation via forged 3DS failure callback on /woorede/f", "method": "POST", "mode": "block", "severity": 5.3, "slug": "woo-rede", "tags": ["insufficient-verification", "forged-webhook", "unauthenticated", "order-manipulation"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-0950-01": {"ajax_action": "ast_block_templates_import_wpforms", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-0950", "description": "Spectra (UAG) <= 2.19.17 broken access control on WPForms template import via ast_block_templates_import_wpforms", "method": "POST", "mode": "block", "severity": 5.3, "slug": "ultimate-addons-for-gutenberg", "tags": ["bac", "template-import"], "target": "plugin", "versions": "<=2.19.17"}, "RULE-CVE-2026-0974-01": {"ajax_action": "iconic_onboard_orderable_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-0974", "method": "POST", "mode": "block", "severity": 8.8, "slug": "orderable", "target": "plugin", "versions": "<=1.20.0"}, "RULE-CVE-2026-0996-01": {"ajax_action": "fluentform_ai_create_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-0996", "method": "POST", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.1.14"}, "RULE-CVE-2026-1000-01": {"ajax_action": "woo_mailerlite_reset_integration_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1000", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woo-mailerlite", "target": "plugin", "versions": "<3.1.4"}, "RULE-CVE-2026-1003-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/getgenie/v1/geniechat/[\\\\w-]+~"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2026-1003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1003", "description": "GetGenie <=4.3.0 missing authorization (IDOR) allows Author+ arbitrary post deletion via geniechat REST endpoint", "mode": "block", "severity": 4.3, "slug": "getgenie", "tags": ["missing-authorization", "idor", "arbitrary-post-deletion", "rest-api"], "target": "plugin", "versions": "<=4.3.0"}, "RULE-CVE-2026-1004-02": {"ajax_action": "eael_product_quickview_popup", "conditions": [{"name": "ARGS:product_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-1004", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1004", "description": "Essential Addons for Elementor <=6.5.5 unauthenticated sensitive product information exposure via eael_product_quickview_popup AJAX action (GET)", "method": "GET", "mode": "block", "severity": 5.3, "slug": "essential-addons-for-elementor-lite", "tags": ["missing-authorization", "sensitive-data-exposure", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.5.5"}, "RULE-CVE-2026-10091-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[email\\\\s[^\\\\]]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-10091", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10091", "description": "Email JavaScript Cloak <=1.03 stored XSS via [email] shortcode in post_content (classic editor)", "mode": "block", "severity": 7.2, "slug": "email-javascript-cloaker", "tags": ["xss", "stored-xss", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.03"}, "RULE-CVE-2026-10091-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[email\\\\s[^\\\\]]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|video|audio|details|math)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-10091", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10091", "description": "Email JavaScript Cloak <=1.03 stored XSS via [email] shortcode in content field (REST API wp/v2/posts)", "mode": "block", "severity": 7.2, "slug": "email-javascript-cloaker", "tags": ["xss", "stored-xss", "authenticated", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.03"}, "RULE-CVE-2026-10092-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[cincopa\\\\b[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*i(?:mg|frame)\\\\b[^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-10092", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10092", "description": "Cincopa Video and Media Plugin <=1.163 unauthenticated stored XSS via [cincopa] shortcode in post comments", "mode": "block", "severity": 7.2, "slug": "video-playlist-and-gallery-plugin", "tags": ["xss", "stored", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.163"}, "RULE-CVE-2026-1032-01": {"action": "admin_init", "conditions": [{"name": "ARGS:themify_cm", "type": "exists"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-1032", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1032", "description": "Conditional Menus <=1.2.6 Cross-Site Request Forgery via themify_cm parameter in save_options", "method": "POST", "mode": "block", "severity": 4.3, "slug": "conditional-menus", "tags": ["csrf", "missing-nonce", "options-update"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-1036-01": {"ajax_action": "GalleryBox", "conditions": [{"name": "ARGS:ajax_task", "type": "regex", "value": "~^delete_comment$~i"}, {"name": "ARGS:id_comment", "type": "exists"}], "cve": "CVE-2026-1036", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1036", "description": "Photo Gallery by 10Web <=1.8.36 missing authorization on delete_comment via GalleryBox AJAX", "mode": "block", "severity": 5.3, "slug": "photo-gallery", "tags": ["missing-authorization", "arbitrary-comment-deletion", "unauthenticated"], "target": "plugin", "versions": "<=1.8.36"}, "RULE-CVE-2026-1042-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:digit_one", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1042", "description": "WP Hello Bar <=1.02 authenticated stored XSS via digit_one settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-hello-bar", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=1.02"}, "RULE-CVE-2026-1042-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:digit_two", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1042", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1042", "description": "WP Hello Bar <=1.02 authenticated stored XSS via digit_two settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-hello-bar", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=1.02"}, "RULE-CVE-2026-1054-01": {"ajax_action": "rm_set_otp", "conditions": [{"name": "ARGS:otp_type", "type": "equals", "value": "google"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1054", "description": "RegistrationMagic <= 6.0.7.4 broken authentication in OTP verification bypassing email ownership", "method": "POST", "mode": "block", "severity": 5.3, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.7.4"}, "RULE-CVE-2026-1055-01": {"action": "admin_init", "conditions": [{"name": "ARGS:welcomeMessage", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|svg|object|embed)[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1055", "description": "TalkJS <=0.1.15 authenticated (Administrator+) stored XSS via welcomeMessage settings parameter", "method": "POST", "mode": "block", "severity": 4.4, "slug": "talkjs", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=0.1.15"}, "RULE-CVE-2026-1058-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:&lt;|&#0*60;|&#x0*3[cC];)\\\\s*(?:script|img|svg|iframe|object|embed|body|details|video|audio|math|form|input|marquee|a\\\\b)~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-1058-02": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:script|iframe|object|embed|form)[\\\\s>]~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-1058-03": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<\\\\s*(?:img|svg|body|details|video|audio|math|marquee|input|a\\\\b)[^>]*\\\\bon\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-1058", "method": "POST", "mode": "block", "severity": 7.1, "slug": "form-maker", "target": "plugin", "versions": "<=1.15.35"}, "RULE-CVE-2026-10586-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/essential-blocks/v1/save_ai_generated_image(?:[/?]|$)~"}, {"name": "ARGS:image_url", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|tftp|ssh2?)://|(?:^https?://)?(?:(?:127\\\\.)|(?:0\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|localhost(?:$|[:/])|\\\\[?::1\\\\]?(?:$|[:/])|\\\\[?::ffff:)|(?:^https?://|^)0x[0-9a-f]+(?:[:/]|$)|(?:^https?://|^)[0-9]{8,10}(?:[:/]|$))~i"}], "cve": "CVE-2026-10586", "description": "Essential Blocks <=6.1.3 authenticated (Author+) SSRF via image_url in save_ai_generated_image REST endpoint", "mode": "block", "severity": 7.2, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.1.3"}, "RULE-CVE-2026-1060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/adminify/v1/get-addons-list(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1060", "description": "WP Adminify <=4.0.7.7 unauthenticated sensitive information exposure via get-addons-list REST API", "method": "GET", "mode": "block", "severity": 5.3, "slug": "adminify", "tags": ["missing-authorization", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.0.7.7"}, "RULE-CVE-2026-1070-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=alex-user-counter~"}, {"name": "ARGS:user_count_info", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1070", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1070", "description": "User Counter <=6.0 CSRF allows attacker to manipulate plugin settings via missing nonce validation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "user-counter", "tags": ["csrf", "cross-site-request-forgery", "missing-authorization"], "target": "plugin", "versions": "<=6.0"}, "RULE-CVE-2026-1072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options(?:-general)?\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "keybaseverif"}, {"name": "ARGS:keybaseverif_text", "type": "regex", "value": "~(?:<script(?:\\\\s+[a-z][a-z0-9\\\\-]*\\\\s*=|\\\\s*>|/>)|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/][^>]*on[a-z]+=)~i"}], "cve": "CVE-2026-1072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1072", "description": "WP Keybase Verification <=1.4.5 CSRF to stored XSS via keybaseverif_text settings update", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-keybase-verification", "tags": ["csrf", "xss", "stored", "settings-update"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-10737-01": {"ajax_action": "cdm_view_file", "conditions": [{"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-10737", "description": "SP Project & Document Manager <=4.71 unauthenticated file metadata/download link exposure via cdm_view_file AJAX handler", "mode": "block", "severity": 7.5, "slug": "sp-client-document-manager", "target": "plugin", "versions": "<=4.71"}, "RULE-CVE-2026-1074-01": {"ajax_action": "app_bar_settings", "conditions": [{"name": "ARGS:app-bar-features", "type": "regex", "value": "~(?:<[^>]*(?:script|iframe|object|embed|form|input|textarea|button|details|select|video|audio|source|svg|math|base|link|meta|style|applet)|(?:^|[^a-zA-Z0-9_])on(?:load|error|mouseover|mouseout|click|dblclick|focus|blur|change|submit|keydown|keypress|keyup|cut|copy|paste|abort|resize|scroll|pointerover|animationend)[ ]*=|javascript[ ]*:|data[ ]*:[^,]*;[ ]*base64)~i"}], "cve": "CVE-2026-1074", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1074", "description": "WP App Bar <=1.5 unauthenticated stored XSS via app-bar-features parameter in app_bar_settings AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-app-bar", "tags": ["xss", "stored-xss", "unauthenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.5"}, "RULE-CVE-2026-1082-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "title-animator"}, {"name": "ARGS", "type": "regex", "value": "~(?:<(?:script|svg|iframe|embed|object|details|body)[\\\\s/>]|\\\\bon[a-z]{3,}\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1082", "description": "Title Animator <=1.0 reflected XSS via unsanitized REQUEST_URI on settings page", "mode": "block", "severity": 4.3, "slug": "title-animator", "tags": ["xss", "reflected", "csrf"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-10833-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/table-of-contents[^}]*\\"configurablePrefix\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-10833", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-10833", "description": "Essential Blocks <=6.1.4 stored XSS via configurablePrefix block attribute in Table of Contents block", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.1.4"}, "RULE-CVE-2026-1085-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~\\\\?page=seolocalrank~"}, {"name": "ARGS:signout", "type": "contains", "value": "1"}, {"name": "capability", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1085", "description": "SEO Local Rank <=2.2.9 CSRF allows attackers to disconnect admin accounts via signout parameter", "mode": "block", "severity": 4.3, "slug": "seo-local-rank", "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-1095-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/post.php"}, {"name": "ARGS:post_content", "type": "contains", "value": "canto_testimonials"}, {"name": "ARGS:post_content", "type": "regex", "value": "~canto_testimonials[^]]*fx *=[^]]*(<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1095", "description": "Canto Testimonials <=1.0 Stored XSS via shortcode fx attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "canto-testimonials", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[google_map_view\\\\b[^\\\\]]*\\\\b(?:latitude|longitudinal)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on[a-z]+=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1096", "description": "Best-WP Google Map <=2.1 stored XSS via latitude/longitudinal shortcode attributes in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "best-wp-google-map", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.1"}, "RULE-CVE-2026-1097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-admin/post\\\\.php|(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts)~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[tmauthors\\\\s[^\\\\]]*(?:before|after|separator)\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|toggle|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1097", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1097", "description": "ThemeRuby Multi Authors <=1.0.0 Contributor+ stored XSS via tmauthors shortcode before/after/separator attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "themeruby-multi-authors", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1098-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[css_columns[^\\\\]]*tag\\\\s*=\\\\s*[\\"\'](?:[^\\"\']*[\\\\s<>][^\\"\']*|(?:script|iframe|object|embed|svg|math|style))[\\"\']~i"}], "cve": "CVE-2026-1098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1098", "description": "CM CSS Columns <=1.2.1 Stored XSS via [css_columns] shortcode tag attribute (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cm-css-columns", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1098-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[css_columns[^\\\\]]*tag\\\\s*=\\\\s*[\\"\'](?:[^\\"\']*[\\\\s<>][^\\"\']*|(?:script|iframe|object|embed|svg|math|style))[\\"\']~i"}], "cve": "CVE-2026-1098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1098", "description": "CM CSS Columns <=1.2.1 Stored XSS via [css_columns] shortcode tag attribute (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "cm-css-columns", "tags": ["xss", "stored-xss", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1104-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages(/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1104", "mode": "block", "severity": 8.8, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-1127-01": {"ajax_action": "timeline_shortcode", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<|>|%3[Cc]|%3[Ee])~"}], "cve": "CVE-2026-1127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1127", "description": "Timeline Event History <=3.2 reflected XSS via id parameter in timeline_shortcode AJAX handler (unauthenticated)", "mode": "block", "severity": 6.1, "slug": "timeline-event-history", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.2"}, "RULE-CVE-2026-11395-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~^(?:169\\\\.254\\\\.|127\\\\.0\\\\.0\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|0(?:x[0-9a-f]+|[0-7]+\\\\.)|\\\\[?::1\\\\]?$|0\\\\.0\\\\.0\\\\.0|localhost)~i"}], "cve": "CVE-2026-11395", "description": "CF7 to Webhook <=5.0.0 unauthenticated SSRF via CF7 field placeholder in webhook URL host segment", "mode": "block", "severity": 7.2, "slug": "cf7-to-zapier", "target": "plugin", "versions": "<=5.0.0"}, "RULE-CVE-2026-11551-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:password_1", "type": "exists"}], "cve": "CVE-2026-11551", "description": "Branda <=3.4.29 unauthenticated privilege escalation via account takeover through registration password fields (single-site)", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<=3.4.29"}, "RULE-CVE-2026-11551-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-signup\\\\.php~"}, {"name": "ARGS:signup_password", "type": "exists"}], "cve": "CVE-2026-11551", "description": "Branda <=3.4.29 unauthenticated privilege escalation via multisite signup password fields", "mode": "block", "severity": 9.8, "slug": "branda-white-labeling", "target": "plugin", "versions": "<=3.4.29"}, "RULE-CVE-2026-1165-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "equals", "value": "ays_pb_publish_popupbox"}, {"name": "ARGS:popupbox", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF publish popupbox via admin.php action parameter", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1165-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "equals", "value": "ays_pb_unpublish_popupbox"}, {"name": "ARGS:popupbox", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF unpublish popupbox via admin.php action parameter", "method": "GET", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1165-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-popup-box"}, {"name": "ARGS:action", "type": "regex", "value": "~^ays_pb_(?:publish|unpublish)_popupbox$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1165", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1165", "description": "Popup Box <=6.1.1 CSRF bulk publish/unpublish popupbox via POST", "method": "POST", "mode": "block", "severity": 4.3, "slug": "ays-popup-box", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-1187-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[zoomify\\\\s[^\\\\]]*filename\\\\s*=\\\\s*[\'\\"][^\'\\"]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</script>)[^\'\\"]*[\'\\"]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1187", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1187", "description": "ZoomifyWP Free <=1.1 Contributor+ Stored XSS via zoomify shortcode filename attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tz-zoomifywp-free", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-11911-01": {"ajax_action": "simplefilelist_edit_job", "conditions": [{"name": "ARGS:eeSubFolder", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee][\\\\\\\\/]|%2[Ee]%2[Ee]%2[Ff]|%252[Ee]%252[Ee])~i"}], "cve": "CVE-2026-11911", "description": "Simple File List <=6.3.7 unauthenticated arbitrary file deletion via path traversal in eeSubFolder parameter", "mode": "block", "severity": 7.5, "slug": "simple-file-list", "target": "plugin", "versions": "<=6.3.7"}, "RULE-CVE-2026-11911-02": {"ajax_action": "simplefilelist_edit_job", "conditions": [{"name": "ARGS:eeFileName", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee][\\\\\\\\/]|%2[Ee]%2[Ee]%2[Ff]|%252[Ee]%252[Ee])~i"}], "cve": "CVE-2026-11911", "description": "Simple File List <=6.3.7 unauthenticated arbitrary file deletion via path traversal in eeFileName parameter", "mode": "block", "severity": 7.5, "slug": "simple-file-list", "target": "plugin", "versions": "<=6.3.7"}, "RULE-CVE-2026-11962-01": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "regex", "value": "~^(?:mkfile|rename)$~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp(?:x)?|jsp(?:x)?|cfm)(?:$|[\\"\'\\\\s&])|(?:^|[/\\\\\\\\])\\\\.htaccess(?:$|[\\"\'\\\\s&]))~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 authenticated arbitrary executable file creation through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-02": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "put"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\?(?:php\\\\b|=|[\\\\t\\\\r\\\\n ])~i"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 authenticated PHP content write through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-03": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "extract"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 unsafe archive extraction through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-11962-04": {"ajax_action": "fileorganizer_file_folder_manager", "conditions": [{"name": "ARGS:cmd", "type": "equals", "value": "put"}, {"name": "ARGS:encoding", "type": "regex", "value": "~^(?:scheme|hash)$~"}, {"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-11962", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-11962", "description": "FileOrganizer <1.2.0 encoded content write through elFinder", "mode": "block", "severity": 8.8, "slug": "fileorganizer", "tags": ["unrestricted-file-upload", "remote-code-execution", "authenticated"], "target": "plugin", "versions": "<1.2.0"}, "RULE-CVE-2026-1210-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~age[_-]?gate[^}]*(?:desc|footer_text)[^}]*<[^>]*(?:on[a-zA-Z]+=|<script|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1210", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1210", "description": "Happy Addons for Elementor <=3.20.7 Stored XSS via Age Gate widget desc/footer_text fields in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=3.20.7"}, "RULE-CVE-2026-1210-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_elementor_data", "type": "regex", "value": "~ha_custom_svg[^}]*(?:<script|on[a-zA-Z]+=|javascript:|foreignObject)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1210", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1210", "description": "Happy Addons for Elementor <=3.20.7 Stored XSS via SVG Draw widget ha_custom_svg field in _elementor_data", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["xss", "stored-xss", "elementor-widget", "svg-xss"], "target": "plugin", "versions": "<=3.20.7"}, "RULE-CVE-2026-1215-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mma_call_tracking_menu"}, {"name": "ARGS:submit", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1215", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1215", "description": "MMA Call Tracking <=2.3.15 CSRF allows unauthorized modification of plugin settings via forged request", "mode": "block", "severity": 4.3, "slug": "mma-call-tracking", "tags": ["csrf", "missing-authorization", "settings-update"], "target": "plugin", "versions": "<=2.3.15"}, "RULE-CVE-2026-1216-01": {"ajax_action": "wpra.render.display", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#[xX]?[0-9])~i"}], "cve": "CVE-2026-1216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1216", "description": "WP RSS Aggregator <=5.0.10 unauthenticated reflected XSS via template parameter in wpra.render.display AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2026-1216-02": {"ajax_action": "wprss_render", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:<[a-z/!]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|&#[xX]?[0-9])~i"}], "cve": "CVE-2026-1216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1216", "description": "WP RSS Aggregator <=5.0.10 unauthenticated reflected XSS via template parameter in legacy wprss_render AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-rss-aggregator", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.0.10"}, "RULE-CVE-2026-1219-01": {"ajax_action": "load_track_note_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_track_note_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1219-02": {"ajax_action": "load_post_by_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_post_by_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1219-03": {"ajax_action": "load_lyrics_ajax", "conditions": [{"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1219", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1219", "description": "MP3 Audio Player by Sonaar >=4.0 <=5.10 IDOR via load_lyrics_ajax exposes private post content (HIGH FP RISK: blocks legitimate anonymous music player usage)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mp3-music-player-by-sonaar", "tags": ["idor", "insecure-direct-object-reference", "unauthenticated"], "target": "plugin", "versions": ">=4.0 <=5.10"}, "RULE-CVE-2026-1231-01": {"action": "wp", "conditions": [{"name": "ARGS:fl_action", "type": "equals", "value": "save_global_settings"}, {"type": "missing_capability", "value": "delete_others_posts"}], "cve": "CVE-2026-1231", "method": "POST", "mode": "block", "severity": 6.4, "slug": "beaver-builder-lite-version", "target": "plugin", "versions": "<=2.10.0.5"}, "RULE-CVE-2026-1235-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^wpsc_~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;&])O:\\\\d+:\\"[A-Za-z_]~"}], "cve": "CVE-2026-1235", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-e-commerce", "target": "plugin", "versions": "<3.15.2"}, "RULE-CVE-2026-1236-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/envira(?:/[0-9]+)?(?:[/?]|$)~"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1236", "description": "Envira Gallery Lite <=1.12.3 stored XSS via justified_gallery_theme parameter in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "envira-gallery-lite", "tags": ["xss", "stored", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.12.3"}, "RULE-CVE-2026-1236-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_eg_gallery_data[config][justified_gallery_theme]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\'][\\\\s]*on[a-z]+=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1236", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1236", "description": "Envira Gallery Lite <=1.12.3 stored XSS via justified_gallery_theme parameter in post edit form", "method": "POST", "mode": "block", "severity": 6.4, "slug": "envira-gallery-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.12.3"}, "RULE-CVE-2026-1238-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS:fh", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<iframe|<svg|<img[^>]*on[a-z]+\\\\s*=|on(?:error|load|click|mouseover|focus|blur)\\\\s*=)~i"}], "cve": "CVE-2026-1238", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1238", "description": "WP Slimstat <=5.3.5 unauthenticated stored XSS via slimtrack fh parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-slimstat", "tags": ["xss", "stored-xss", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=5.3.5"}, "RULE-CVE-2026-12407-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "e2pdf-templates"}, {"name": "ARGS:action", "type": "equals", "value": "screen"}, {"name": "ARGS:wp_screen_options[option]", "type": "regex", "value": "~^(?!screen_layout_columns$|metaboxhidden_)~"}, {"type": "missing_capability", "value": "e2pdf_templates"}], "cve": "CVE-2026-12407", "description": "E2Pdf <=1.32.26 authenticated arbitrary option update via screen_action() missing authorization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "e2pdf", "target": "plugin", "versions": "<=1.32.26"}, "RULE-CVE-2026-12416-01": {"ajax_action": "pravel_invoice_change_password", "conditions": [{"name": "ARGS:reset_user_id", "type": "exists"}], "cve": "CVE-2026-12416", "description": "Invoice Generator <=1.0.0 unauthenticated account takeover via pravel_invoice_change_password AJAX handler with weak reset code validation", "mode": "block", "severity": 9.8, "slug": "invoice-creator", "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-12417-01": {"ajax_action": "pravel_change_password", "conditions": [{"name": "ARGS:reset_user_id", "type": "exists"}, {"name": "ARGS:new_password_custom", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-12417", "description": "SignUp & SignIn <=1.0.0 unauthenticated account takeover via pravel_change_password AJAX handler", "mode": "block", "severity": 9.8, "slug": "signup-signin", "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1244-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[financoop_campaign\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2026-1244", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1244", "description": "Forms Bridge <= 4.2.5 Stored XSS via financoop_campaign shortcode id attribute in post content (wp-admin/post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forms-bridge", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2026-1244-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[financoop_campaign\\\\b[^\\\\]]*\\\\bid\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*|[^\\\\]\\\\s]*)(?:<[a-z/!]|on[a-z]+=|javascript:)~i"}], "cve": "CVE-2026-1244", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1244", "description": "Forms Bridge <= 4.2.5 Stored XSS via financoop_campaign shortcode id attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "forms-bridge", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=4.2.5"}, "RULE-CVE-2026-1246-01": {"ajax_action": "shortpixel_ajaxRequest", "conditions": [{"name": "ARGS:screen_action", "type": "equals", "value": "loadLogFile"}, {"name": "ARGS:loadFile", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|(?:^|[\\\\\\\\/])debug\\\\.log$)~i"}], "cve": "CVE-2026-1246", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1246", "description": "ShortPixel Image Optimizer <=6.4.2 authenticated arbitrary file read via path traversal in loadLogFile AJAX sub-action", "method": "POST", "mode": "block", "severity": 4.9, "slug": "shortpixel-image-optimiser", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.4.2"}, "RULE-CVE-2026-1249-01": {"ajax_action": "load_lyrics_ajax", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:post-id", "type": "exists"}], "cve": "CVE-2026-1249", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1249", "description": "MP3 Audio Player by Sonaar <=5.10 authenticated SSRF via load_lyrics_ajax AJAX action", "method": "POST", "mode": "block", "severity": 5.0, "slug": "mp3-music-player-by-sonaar", "tags": ["ssrf", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=5.10"}, "RULE-CVE-2026-1250-01": {"ajax_action": "get_court", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-1250", "description": "Court Reservation <=1.10.11 unauthenticated SQL injection via id parameter in get_court AJAX handler", "mode": "block", "severity": 7.5, "slug": "court-reservation", "target": "plugin", "versions": "<=1.10.11"}, "RULE-CVE-2026-1252-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_type", "type": "equals", "value": "events_listing"}, {"name": "ARGS:events_listing_url", "type": "regex", "value": "~(?:^[\\\\t\\\\n\\\\r ]*j[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*v[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*s[\\\\t\\\\n\\\\r ]*c[\\\\t\\\\n\\\\r ]*r[\\\\t\\\\n\\\\r ]*i[\\\\t\\\\n\\\\r ]*p[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*:|^[\\\\t\\\\n\\\\r ]*d[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*a[\\\\t\\\\n\\\\r ]*:|^[\\\\t\\\\n\\\\r ]*v[\\\\t\\\\n\\\\r ]*b[\\\\t\\\\n\\\\r ]*s[\\\\t\\\\n\\\\r ]*c[\\\\t\\\\n\\\\r ]*r[\\\\t\\\\n\\\\r ]*i[\\\\t\\\\n\\\\r ]*p[\\\\t\\\\n\\\\r ]*t[\\\\t\\\\n\\\\r ]*:|[\\"\'][\\\\t\\\\n\\\\r ]*(?:on[a-zA-Z0-9_]+)[\\\\t\\\\n\\\\r ]*=|<[ ]*(?:script|svg|img|iframe|object|embed|math|details|body|marquee|video|audio|input|button|select|textarea|form|base|link|meta|style)(?:[^a-zA-Z0-9_]|$))~i"}], "cve": "CVE-2026-1252", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1252", "description": "Events Listing Widget <=1.3.4 authenticated (Author+) stored XSS via events_listing_url parameter", "method": "POST", "mode": "block", "severity": 6.4, "slug": "events-listing-widget", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-1254-01": {"ajax_action": "modula_save_gallery", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1254", "method": "POST", "mode": "block", "severity": 4.3, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<2.14.0"}, "RULE-CVE-2026-1258-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/email/templates(?:[/?&]|$)~"}, {"name": "ARGS:order-type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order-type parameter on email/templates REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/email/templates(?:[/?&]|$)~"}, {"name": "ARGS:order-by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order-by parameter on email/templates REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/forms(?:[/?&]|$)~"}, {"name": "ARGS:order_type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_type parameter on forms REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/forms(?:[/?&]|$)~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_by parameter on forms REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/automation(?:[/?&]|$)~"}, {"name": "ARGS:order_type", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_type parameter on automation REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/automation(?:[/?&]|$)~"}, {"name": "ARGS:order_by", "type": "regex", "value": "~(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|UNION\\\\s+(?:ALL\\\\s+)?SELECT|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via order_by parameter on automation REST endpoint", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1258-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mint-mail/v1/contacts/import/tutorlms/map(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\)\\\\s+(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-1258", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1258", "description": "Mail Mint <=1.19.2 authenticated SQL injection via selectedCourses parameter on tutorlms import REST endpoint", "method": "POST", "mode": "block", "severity": 4.9, "slug": "mail-mint", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.19.2"}, "RULE-CVE-2026-1266-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "postalicious"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1266", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1266", "description": "Postalicious <=3.0.1 authenticated (admin+) stored XSS via plugin settings", "method": "POST", "mode": "block", "severity": 4.4, "slug": "postalicious", "tags": ["xss", "stored", "authenticated", "admin-settings"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1268-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:meta[dwc-content]", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1268", "description": "Dynamic Widget Content <=1.3.6 authenticated (Contributor+) stored XSS via dwc-content post meta on REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-widget-content", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2026-1268-02": {"action": "admin_init", "conditions": [{"name": "ARGS:dwc-content", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|\\\\bon(?:load|error|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1268", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1268", "description": "Dynamic Widget Content <=1.3.6 authenticated (Contributor+) stored XSS via dwc-content post meta on classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dynamic-widget-content", "tags": ["xss", "stored-xss"], "target": "plugin", "versions": "<=1.3.6"}, "RULE-CVE-2026-1271-01": {"ajax_action": "pm_upload_image", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271", "description": "ProfileGrid <= 5.9.7.2 IDOR via pm_upload_image - virtual patch blocks non-admin profile image uploads to prevent arbitrary user image modification (FP: legitimate subscriber self-uploads blocked until plugin update)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "profilegrid-user-profiles-groups-and-communities", "tags": ["idor", "authorization-bypass", "insecure-direct-object-reference"], "target": "plugin", "versions": "<=5.9.7.2"}, "RULE-CVE-2026-1271-02": {"ajax_action": "pm_upload_cover_image", "conditions": [{"name": "ARGS:user_id", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1271", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1271", "description": "ProfileGrid <= 5.9.7.2 IDOR via pm_upload_cover_image - virtual patch blocks non-admin cover image uploads to prevent arbitrary user image modification (FP: legitimate subscriber self-uploads blocked until plugin update)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "profilegrid-user-profiles-groups-and-communities", "tags": ["idor", "authorization-bypass", "insecure-direct-object-reference"], "target": "plugin", "versions": "<=5.9.7.2"}, "RULE-CVE-2026-1273-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ultp/v3/starter_dummy_post(/|\\\\?|$)~"}, {"name": "ARGS:api_endpoint", "type": "regex", "value": "~(?:://(?:(?:127(?:[.][0-9]+){0,3}|10(?:[.][0-9]+){1,3}|172[.](?:1[6-9]|2[0-9]|3[01])(?:[.][0-9]+){1,2}|192[.]168(?:[.][0-9]+){1,2}|169[.]254(?:[.][0-9]+){0,2}|0(?:[.]0){1,3}|0x[0-9a-fA-F]+|localhost)(?:[:/?#]|$)|[[]?::1[]]?)|^(?:gopher|file|dict|ftp)://)~i"}], "cve": "CVE-2026-1273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1273", "description": "PostX <= 5.0.8 SSRF via api_endpoint parameter on /ultp/v3/starter_dummy_post/ REST route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-post", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-1273-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ultp/v3/starter_import_content(/|\\\\?|$)~"}, {"name": "ARGS:api_endpoint", "type": "regex", "value": "~(?:://(?:(?:127(?:[.][0-9]+){0,3}|10(?:[.][0-9]+){1,3}|172[.](?:1[6-9]|2[0-9]|3[01])(?:[.][0-9]+){1,2}|192[.]168(?:[.][0-9]+){1,2}|169[.]254(?:[.][0-9]+){0,2}|0(?:[.]0){1,3}|0x[0-9a-fA-F]+|localhost)(?:[:/?#]|$)|[[]?::1[]]?)|^(?:gopher|file|dict|ftp)://)~i"}], "cve": "CVE-2026-1273", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1273", "description": "PostX <= 5.0.8 SSRF via api_endpoint parameter on /ultp/v3/starter_import_content/ REST route", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ultimate-post", "tags": ["ssrf", "server-side-request-forgery", "rest-api"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-1277-01": {"action": "admin_init", "conditions": [{"name": "ARGS:kc_us_dismiss_promotion", "type": "exists"}, {"name": "ARGS:redirect_to", "type": "regex", "value": "~^(?:https?:)?//(?=\\\\S)|^(?:https?:)?\\\\\\\\\\\\\\\\(?=\\\\S)~i"}], "cve": "CVE-2026-1277", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1277", "description": "URL Shortify <=1.12.1 unauthenticated open redirect via redirect_to parameter in promotional dismissal handler", "mode": "block", "severity": 4.7, "slug": "url-shortify", "tags": ["open-redirect", "unauthenticated", "phishing"], "target": "plugin", "versions": "<=1.12.1"}, "RULE-CVE-2026-1279-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[\\\\s*(?:search_employee_directory|employee_form)\\\\b[^\\\\]]*form_title\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[^>]*>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-1279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1279", "description": "Employee Directory <=1.2.1 Stored XSS via search_employee_directory shortcode form_title attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-staff-directory", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1279-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[\\\\s*(?:search_employee_directory|employee_form)\\\\b[^\\\\]]*form_title\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[^>]*>|on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-1279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1279", "description": "Employee Directory <=1.2.1 Stored XSS via REST API post content containing malicious shortcode form_title", "method": "POST", "mode": "block", "severity": 6.4, "slug": "employee-staff-directory", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-1280-01": {"ajax_action": "wpfm_send_file_in_email", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1280", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1280", "description": "Frontend File Manager Plugin <=23.5 unauthenticated arbitrary file sharing via wpfm_send_file_in_email AJAX action \\u2014 missing nonce and auth checks allow any visitor to email any uploaded file", "method": "POST", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated"], "target": "plugin", "versions": "<=23.5"}, "RULE-CVE-2026-1293-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "yoast-schema"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*/\\\\s*(?i:script)~"}], "cve": "CVE-2026-1293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1293", "description": "Yoast SEO <=26.8 Authenticated (Contributor+) Stored XSS via yoast-schema block attribute in REST API post creation/update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "tags": ["xss", "stored-xss", "rest-api", "gutenberg-block"], "target": "plugin", "versions": "<=26.8"}, "RULE-CVE-2026-1293-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "yoast-schema"}, {"name": "ARGS:content", "type": "regex", "value": "~<\\\\s*/\\\\s*(?i:script)~"}], "cve": "CVE-2026-1293", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1293", "description": "Yoast SEO <=26.8 Authenticated (Contributor+) Stored XSS via yoast-schema block attribute in admin post form submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wordpress-seo", "tags": ["xss", "stored-xss", "admin-post-form", "gutenberg-block"], "target": "plugin", "versions": "<=26.8"}, "RULE-CVE-2026-12937-01": {"ajax_action": "tf_room_availability", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:^|\\\\s)\'|[\'\\"]\\\\s*(?:OR|AND|UNION)\\\\s)~i"}], "cve": "CVE-2026-12937", "description": "Tourfic <=2.22.7 unauthenticated SQL injection via post_id in tf_room_availability AJAX handler", "mode": "block", "severity": 7.5, "slug": "tourfic", "target": "plugin", "versions": "<=2.22.7"}, "RULE-CVE-2026-1294-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=/?)bpivb/v1/image-proxy(?:/|\\\\?|$)~"}, {"name": "ARGS:url", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1294", "method": "GET", "mode": "block", "severity": 7.2, "slug": "image-viewer", "target": "plugin", "versions": ">=1.0.0 <=1.0.2"}, "RULE-CVE-2026-1295-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[buynowplus\\\\b[^\\\\]]*(?:<script|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg|<iframe|<img[^>]+onerror)[^\\\\]]*\\\\]~i"}], "cve": "CVE-2026-1295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1295", "description": "Buy Now Plus <=1.0.2 Stored XSS via buynowplus shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "buy-now-plus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1298-01": {"ajax_action": "eri_from_url", "conditions": [{"name": "ARGS:old_image_id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1298", "description": "Easy Replace Image <=3.5.2 missing authorization on eri_from_url AJAX handler allows Contributor+ arbitrary attachment replacement", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-replace-image", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-replacement"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2026-1298-02": {"ajax_action": "eri_from_upload", "conditions": [{"name": "ARGS:old_image_id", "type": "exists"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-1298", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1298", "description": "Easy Replace Image <=3.5.2 missing authorization on eri_from_upload AJAX handler allows Contributor+ arbitrary attachment replacement", "method": "POST", "mode": "block", "severity": 5.3, "slug": "easy-replace-image", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-replacement"], "target": "plugin", "versions": "<=3.5.2"}, "RULE-CVE-2026-1300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<embed[\\\\s/]|<object[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1300", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1300", "description": "Responsive Header Plugin <=1.0 authenticated (Administrator+) stored XSS via plugin settings parameters", "method": "POST", "mode": "block", "severity": 4.4, "slug": "responsive-header", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1302-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editattachment"}, {"name": "ARGS:post_excerpt", "type": "regex", "value": "~(?:<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<svg[\\\\s/+>]|<iframe[\\\\s/+>]|<embed[\\\\s/+>]|<object[\\\\s/+>]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on editattachment save", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1302-02": {"ajax_action": "save-attachment-compat", "conditions": [{"name": "ARGS:post_excerpt", "type": "regex", "value": "~(?:<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<svg[\\\\s/+>]|<iframe[\\\\s/+>]|<embed[\\\\s/+>]|<object[\\\\s/+>]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on AJAX save-attachment-compat", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1302-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/\\\\d+~"}, {"name": "ARGS:caption", "type": "regex", "value": "~(?:<script[\\\\s>]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<svg[\\\\s/+>]|<iframe[\\\\s/+>]|<embed[\\\\s/+>]|<object[\\\\s/+>]|data\\\\s*:\\\\s*text/html)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1302", "description": "Meta-box GalleryMeta <=3.0.1 Stored XSS via attachment caption (post_excerpt) on REST media update", "method": "POST", "mode": "block", "severity": 4.4, "slug": "meta-box-gallerymeta", "tags": ["xss", "stored-xss", "output-escaping", "rest-api"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-1303-01": {"ajax_action": "mailchimp_campaigns_manager_disconnect_app", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1303", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1303", "description": "MailChimp Campaigns <=3.2.4 missing authorization on disconnect_app AJAX action allows Subscriber+ to disconnect Mailchimp integration", "mode": "block", "severity": 5.3, "slug": "olalaweb-mailchimp-campaign-manager", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.2.4"}, "RULE-CVE-2026-1307-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ninja-forms-views/forms/[0-9]+/submissions(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1307", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1307", "description": "Ninja Forms <=3.14.1 sensitive information disclosure via REST submissions endpoint accessible to Contributor+", "mode": "block", "severity": 6.5, "slug": "ninja-forms", "tags": ["information-disclosure", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-1310-01": {"ajax_action": "miga_editor_cal_delete", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1310", "description": "Simple Calendar for Elementor <=1.6.6 missing authorization on miga_editor_cal_delete AJAX action allows unauthenticated calendar entry deletion", "method": "POST", "mode": "block", "severity": 5.3, "slug": "simple-calendar-for-elementor", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2026-1310-02": {"ajax_action": "miga_editor_cal_update", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1310", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1310", "description": "Simple Calendar for Elementor <=1.6.6 missing authorization on miga_editor_cal_update AJAX action allows unauthenticated calendar entry modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "simple-calendar-for-elementor", "tags": ["missing-authorization", "unauthenticated", "broken-access-control"], "target": "plugin", "versions": "<=1.6.6"}, "RULE-CVE-2026-1311-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "worrprba_ajax_upload_backup_file"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1311", "description": "Worry Proof Backup <=0.2.4 authenticated (Subscriber+) path traversal via backup ZIP upload leading to arbitrary file write and RCE", "method": "POST", "mode": "block", "severity": 8.8, "slug": "worry-proof-backup", "tags": ["path-traversal", "arbitrary-file-write", "missing-authorization", "remote-code-execution"], "target": "plugin", "versions": "<=0.2.4"}, "RULE-CVE-2026-1311-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/worrprba/v1/upload-chunk(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1311", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1311", "description": "Worry Proof Backup <=0.2.4 REST API upload-chunk endpoint path traversal via unsanitized chunk file upload", "method": "POST", "mode": "block", "severity": 8.8, "slug": "worry-proof-backup", "tags": ["path-traversal", "arbitrary-file-write", "rest-api"], "target": "plugin", "versions": "<=0.2.4"}, "RULE-CVE-2026-1314-01": {"ajax_action": "fb3d_send_post_pages", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1314", "description": "Interactive 3D FlipBook <=1.16.17 missing authorization on fb3d_send_post_pages AJAX action allows unauthenticated post page metadata disclosure", "mode": "block", "severity": 5.3, "slug": "interactive-3d-flipbook-powered-physics-engine", "target": "plugin", "versions": "<=1.16.17"}, "RULE-CVE-2026-1316-01": {"ajax_action": "cr_upload_media", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1316", "description": "Customer Reviews for WooCommerce <=5.97.0 unauthenticated stored XSS via media[].href in cr_upload_media AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.97.0"}, "RULE-CVE-2026-1316-02": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1316", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1316", "description": "Customer Reviews for WooCommerce <=5.97.0 unauthenticated stored XSS via media[].href in cr_submit_review AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "customer-reviews-woocommerce", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.97.0"}, "RULE-CVE-2026-1319-01": {"ajax_action": "wio_ng_reoptimize_image", "conditions": [{"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2026-1319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1319", "description": "Robin Image Optimizer <=2.0.2 reflected XSS via id parameter in wio_ng_reoptimize_image AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "robin-image-optimizer", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-1319-02": {"ajax_action": "wio_ng_restore_image", "conditions": [{"name": "ARGS:id", "type": "detectXSS"}], "cve": "CVE-2026-1319", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1319", "description": "Robin Image Optimizer <=2.0.2 reflected XSS via id parameter in wio_ng_restore_image AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "robin-image-optimizer", "tags": ["xss", "reflected-xss", "ajax"], "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-1320-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "detectXSS"}], "config": {}, "cve": "CVE-2026-1320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1320", "description": "Secure Copy Content Protection <= 4.9.8 stored XSS via X-Forwarded-For header in IP logging", "mode": "block", "severity": 7.2, "slug": "secure-copy-content-protection", "tags": ["xss", "stored", "header-injection"], "target": "plugin", "versions": "<4.9.9"}, "RULE-CVE-2026-1321-01": {"ajax_action": "rcp_process_register_form", "conditions": [{"name": "ARGS:rcp_level", "type": "exists"}, {"name": "ARGS:rcp_gateway", "type": "equals", "value": "free"}], "cve": "CVE-2026-1321", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1321", "description": "Membership Plugin \\u2013 Restrict Content <=3.2.20 unauthenticated privilege escalation via rcp_level parameter in AJAX registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "restrict-content", "tags": ["privilege-escalation", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-1336-01": {"ajax_action": "ays_chatgpt_admin_ajax", "conditions": [{"name": "ARGS:ays_chatgpt_assistant_api_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1336", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1336", "description": "AI ChatBot with ChatGPT and Content Generator by AYS <=2.7.5 unauthenticated API key modification via ays_chatgpt_admin_ajax AJAX handler", "mode": "block", "severity": 5.3, "slug": "ays-chatgpt-assistant", "tags": ["missing-authorization", "unauthenticated", "settings-modification"], "target": "plugin", "versions": "<=2.7.5"}, "RULE-CVE-2026-1368-01": {"ajax_action": "get_auth", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1368", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1368", "description": "Video Conferencing with Zoom API <4.6.6 unauthenticated Zoom SDK key disclosure via get_auth AJAX handler", "mode": "block", "severity": 7.5, "slug": "video-conferencing-with-zoom-api", "tags": ["improper-authentication", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<4.6.6"}, "RULE-CVE-2026-1369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:redirect_to", "type": "regex", "value": "~^(?:[a-z][a-z0-9+.-]*:|//|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-1369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1369", "description": "WP Conditional Captcha <=4.0.0 unauthenticated open redirect via redirect_to in comment submission flow", "mode": "block", "severity": 4.3, "slug": "wp-conditional-captcha", "tags": ["open-redirect", "unauthenticated", "comment-form"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-1373-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/profile.php"}, {"name": "ARGS:author_profile_picture_url", "type": "regex", "value": "~(?:<\\\\s*script|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1373", "description": "Easy Author Image <=1.7 Stored XSS via author_profile_picture_url on profile self-update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-author-image", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2026-1373-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/user-edit.php"}, {"name": "ARGS:author_profile_picture_url", "type": "regex", "value": "~(?:<\\\\s*script|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1373", "description": "Easy Author Image <=1.7 Stored XSS via author_profile_picture_url on admin user-edit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "easy-author-image", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.7"}, "RULE-CVE-2026-1375-01": {"ajax_action": "tutor_course_list_bulk_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1375", "description": "Tutor LMS <=3.9.5 IDOR in course bulk action allows instructors to modify/delete arbitrary courses via tutor_course_list_bulk_action", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tutor", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.9.5"}, "RULE-CVE-2026-1375-03": {"ajax_action": "tutor_course_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1375", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1375", "description": "Tutor LMS <=3.9.5 IDOR in course deletion allows instructors to delete arbitrary courses via tutor_course_delete", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tutor", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.9.5"}, "RULE-CVE-2026-1391-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vzaar-media-management"}, {"name": "ARGS:bulkcheck", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via bulkcheck parameter on admin upload page", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-02": {"action": "admin_init", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "vzaarmedia"}, {"name": "ARGS:guid", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via guid parameter on media upload tab", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-03": {"action": "admin_init", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "vzaarmedia"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via post_id parameter on media upload tab", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1391-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "vzaar-media-management"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc]|<)[a-zA-Z/!]~"}], "cve": "CVE-2026-1391", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1391", "description": "Vzaar Media Management <=1.1 Reflected XSS via PHP_SELF path injection on admin upload page", "method": "GET", "mode": "block", "severity": 5.3, "slug": "vzaar-media-management", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1394-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcEmail", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcEmail parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1394-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcSubject", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcSubject parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1394-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-quick-contact-us"}, {"name": "ARGS:wpQcSuccessMsg", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|on[a-zA-Z]{3,}[^=]*=~i"}], "cve": "CVE-2026-1394", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1394", "description": "WP Quick Contact Us <=1.0 CSRF to stored XSS via settings update - wpQcSuccessMsg parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-quick-contact-us", "tags": ["csrf", "xss", "stored-xss"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1400-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/helpers/update_media_metadata(?:/|\\\\?|&|$)~"}, {"name": "ARGS:filename", "type": "regex", "value": "~(?:\\\\.(?:ph(?:p\\\\d?|s|tml?|t|ar|gif)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$)~i"}], "cve": "CVE-2026-1400", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1400", "description": "AI Engine <=3.3.2 authenticated (Editor+) arbitrary file upload via filename parameter in update_media_metadata REST endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "ai-engine", "tags": ["arbitrary-file-upload", "file-rename", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1401-01": {"action": "admin_post_tune_lib_admin", "conditions": [{"name": "ARGS:importcsv", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1401", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1401", "description": "Tune Library <=1.6.3 missing authorization on CSV import allows authenticated (Subscriber+) stored XSS via admin_post_tune_lib_admin", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tune-library", "tags": ["missing-authorization", "stored-xss", "csv-import", "authenticated"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2026-1401-02": {"action": "admin_post_tune_lib_admin", "conditions": [{"name": "ARGS:importitunes", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1401", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1401", "description": "Tune Library <=1.6.3 missing authorization on iTunes import allows authenticated (Subscriber+) stored XSS via admin_post_tune_lib_admin", "method": "POST", "mode": "block", "severity": 6.4, "slug": "tune-library", "tags": ["missing-authorization", "stored-xss", "itunes-import", "authenticated"], "target": "plugin", "versions": "<=1.6.3"}, "RULE-CVE-2026-1404-01": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX search parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-02": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:sorting", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX sorting parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-03": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:filter_tag", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX filter_tag parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1404-04": {"ajax_action": "um_get_members", "conditions": [{"name": "ARGS:directory_id", "type": "regex", "value": "~(?:<[^>]*\\\\b(?:on\\\\w+|src|href|style|formaction|data)\\\\s*=|<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|form|base|video|audio|body|details|marquee)\\\\b|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-1404", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1404", "description": "Ultimate Member <=2.11.1 Reflected XSS via um_get_members AJAX directory_id parameter", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ultimate-member", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.11.1"}, "RULE-CVE-2026-1431-01": {"ajax_action": "WPBC_FLEXTIMELINE_NAV", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1431", "description": "Booking Calendar <=10.14.13 unauthenticated booking data exposure via WPBC_FLEXTIMELINE_NAV AJAX action", "mode": "block", "severity": 5.3, "slug": "booking", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=10.14.13"}, "RULE-CVE-2026-1454-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]{0,512}on[a-zA-Z]{3,30}[ \\\\t\\\\r\\\\n]*=~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - event handler injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1454-02": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[ \\\\t\\\\r\\\\n]*script(?:[ \\\\t\\\\r\\\\n]|>|/|$)~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - script tag injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1454-03": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~javascript(?:[ \\\\t\\\\r\\\\n]|%0[aAdD]|%09|&#0*9;|&#0*10;|&#0*13;|&Tab;|&NewLine;)*:~i"}], "cve": "CVE-2026-1454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1454", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via form submission - javascript URI injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "lead-form-builder", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-1455-01": {"ajax_action": "wsnfw_save_users_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_users_settings", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-02": {"ajax_action": "wsnfw_save_credentials", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_credentials", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-03": {"ajax_action": "wsnfw_save_wc_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_wc_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-04": {"ajax_action": "wsnfw_save_users_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_users_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1455-05": {"ajax_action": "wsnfw_save_gf_sms_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1455", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1455", "description": "Whatsiplus <=1.0.1 CSRF via missing nonce validation on wsnfw_save_gf_sms_data", "mode": "block", "severity": 4.3, "slug": "whatsiplus-scheduled-notification-for-woocommerce", "tags": ["csrf", "missing-authorization", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1461-01": {"action": "wp_loaded", "conditions": [{"name": "ARGS:swpm_process_stripe_subscription", "type": "equals", "value": "1"}, {"name": "ARGS:hook", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1461", "description": "Simple Membership <=4.7.0 unauthenticated Stripe webhook signature bypass via missing signing secret validation", "method": "POST", "mode": "block", "severity": 6.5, "slug": "simple-membership", "tags": ["signature-bypass", "unauthenticated", "webhook-forge", "improper-handling-missing-values"], "target": "plugin", "versions": "<=4.7.0"}, "RULE-CVE-2026-1492-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "user_registration_user_form_submit"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in user_registration_user_form_submit AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1492-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_.+$~"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in membership registration AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1492-03": {"action": "init", "conditions": [{"name": "ARGS:ur_frontend_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(administrator|editor|author|contributor)$~i"}], "cve": "CVE-2026-1492", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1492", "description": "User Registration & Membership <=5.1.2 unauthenticated privilege escalation via role parameter in frontend form submission", "method": "POST", "mode": "block", "severity": 9.8, "slug": "user-registration", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1499-01": {"ajax_action": "process_add_site", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1499", "method": "POST", "mode": "block", "severity": 9.8, "slug": "local-sync", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-15096-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_save_data"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 contributor+ stored XSS via b_width_map field in tb_save_data builder save handler (flat param)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_save_data"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 contributor+ stored XSS via b_width_map field nested in tb_save_data JSON data payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field in tb_render_element live builder render handler (flat param)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field nested in tb_render_element JSON module payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element_shortcode"}, {"name": "ARGS:b_width_map", "type": "regex", "value": "~(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field in tb_render_element_shortcode render handler (flat param, sibling of tb_render_element)", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-15096-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "tb_render_element_shortcode"}, {"name": "ARGS:data", "type": "regex", "value": "~b_width_map[\\\\s\\\\S]{0,300}?(?:<\\\\s*script[^>]*>|%3C\\\\s*script|%253C\\\\s*script|on(?:error|load|click|mouseover|focus|mouseenter|mouseout|dblclick)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html)~i"}], "cve": "CVE-2026-15096", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-15096", "description": "Themify Builder <=7.7.6 stored XSS via b_width_map field nested in tb_render_element_shortcode JSON module payload", "mode": "block", "severity": 6.4, "slug": "themify-builder", "tags": ["xss", "stored-xss", "authenticated", "page-builder"], "target": "plugin", "versions": "<=7.7.6"}, "RULE-CVE-2026-1540-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "wpcf7"}, {"name": "ARGS:post", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>]|document\\\\.(?:cookie|write|location)|eval\\\\s*\\\\()~i"}], "cve": "CVE-2026-1540", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1540", "description": "Spam Protect for Contact Form 7 <=1.2.9 authenticated (admin+) stored XSS / code injection via unsanitized CF7 form settings", "method": "POST", "mode": "block", "severity": 7.2, "slug": "wp-contact-form-7-spam-blocker", "tags": ["xss", "stored", "code-injection", "authenticated"], "target": "plugin", "versions": "<=1.2.9"}, "RULE-CVE-2026-1542-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;&])O:[0-9]+:\\"[A-Za-z_]~"}], "cve": "CVE-2026-1542", "method": "POST", "mode": "block", "severity": 6.5, "slug": "super-stage-wp", "target": "plugin", "versions": "<1.0.2"}, "RULE-CVE-2026-1557-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-responsive-images/image_handler\\\\.php~"}, {"name": "ARGS:src", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/etc/passwd|(?:^|[\\\\\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)$)~i"}], "cve": "CVE-2026-1557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1557", "description": "WP Responsive Images <=1.0 unauthenticated path traversal to arbitrary file read via src parameter in image_handler.php", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wp-responsive-images", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "local-file-inclusion"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1560-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lazy-blocks/v1/block-builder-preview(/|\\\\?|&|$)~"}, {"name": "REQUEST_COOKIES:/^wordpress_logged_in_/", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1560", "method": "POST", "mode": "block", "severity": 8.8, "slug": "lazy-blocks", "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-1565-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "upload-attachment"}, {"name": "ARGS:type", "type": "equals", "value": "wpuf-form-uploader"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1565", "description": "WP User Frontend <=4.2.8 authenticated (Author+) arbitrary file upload via upload-attachment with wpuf-form-uploader type bypass", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["arbitrary-file-upload", "file-upload-extension-bypass", "missing-authorization"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-1565-02": {"ajax_action": "wpuf_import_forms", "conditions": [{"name": "ARGS:file_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1565", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1565", "description": "WP User Frontend <=4.2.8 authenticated (Author+) arbitrary file import via wpuf_import_forms AJAX action", "method": "POST", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "tags": ["arbitrary-file-upload", "missing-authorization"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-1566-01": {"ajax_action": "latepoint_route_call", "conditions": [{"name": "ARGS:customer[wordpress_user_id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1566", "description": "LatePoint <=5.2.7 privilege escalation via mass-assignment of customer[wordpress_user_id] through AJAX route dispatcher", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "improper-privilege-management", "mass-assignment"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2026-1566-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:customer[wordpress_user_id]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1566", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1566", "description": "LatePoint <=5.2.7 privilege escalation via mass-assignment of customer[wordpress_user_id] through admin-post route dispatcher", "method": "POST", "mode": "block", "severity": 8.8, "slug": "latepoint", "tags": ["privilege-escalation", "improper-privilege-management", "mass-assignment"], "target": "plugin", "versions": "<=5.2.7"}, "RULE-CVE-2026-1569-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wueen-blocket\\\\b[^\\\\]]*err-404\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1569", "description": "Wueen <=0.2.0 contributor+ stored XSS via wueen-blocket shortcode err-404 attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wueen", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2026-1569-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wueen-blocket\\\\b[^\\\\]]*id\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1569", "description": "Wueen <=0.2.0 contributor+ stored XSS via wueen-blocket shortcode id attribute reflected through err-404 template", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wueen", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2026-1569-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(?:wp-admin/post(?:-new)?\\\\.php|wp-admin/admin-ajax\\\\.php)\\\\b~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(?:wueen-blocket)\\\\b[^\\\\]]*\\\\bv-[a-zA-Z0-9_]+\\\\s*=\\\\s*[\\"\'][^\\"\'\\\\]]*(?:<script\\\\b|<svg\\\\b|<iframe\\\\b|javascript\\\\s*:|on(?:error|load|mouseover|click|focus|blur)\\\\s*=)[^\\"\'\\\\]]*[\\"\'][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1569", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1569", "description": "Wueen <=0.2.0 contributor+ stored XSS via wueen-blocket shortcode v-* variable attributes", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wueen", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.2.0"}, "RULE-CVE-2026-1570-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "contains", "value": "[verse"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]verse[^]]*(?:<script|<svg|<iframe|<img|on[a-zA-Z]+=|javascript:|data:[a-zA-Z]+/[a-zA-Z]+)~i"}], "cve": "CVE-2026-1570", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1570", "description": "Simple Bible Verse Via Shortcode <=1.1 Stored XSS via [verse] shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-bible-verse-via-shortcode", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1574-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\']\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title attribute breakout (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*>\\\\s*<~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title tag injection (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[myqtip[^\\\\]]*\\\\].*<script~is"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode body script injection (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*[\\"\']\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title attribute breakout (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip\\\\s[^\\\\]]*title\\\\s*=\\\\s*[\\"\'][^\\"\']*>\\\\s*<~i"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode title tag injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1574-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[myqtip[^\\\\]]*\\\\].*<script~is"}], "cve": "CVE-2026-1574", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1574", "description": "MyQtip - easy qTip2 <=2.0.5 Stored XSS via [myqtip] shortcode body script injection (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "myqtip-easy-qtip2", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-1581-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-1581", "method": "GET", "mode": "block", "severity": 7.5, "slug": "wpforo", "target": "plugin", "versions": "<=2.4.14"}, "RULE-CVE-2026-1608-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]youtube[^]]*(?:on[a-zA-Z]+=|javascript:|<script|<img[^>]+onerror)~i"}], "cve": "CVE-2026-1608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1608", "description": "Video Onclick <=0.4.7 Stored XSS via youtube shortcode attributes in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "video-onclick", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.4.7"}, "RULE-CVE-2026-1608-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]youtube[^]]*(?:on[a-zA-Z]+=|javascript:|<script|<img[^>]+onerror)~i"}], "cve": "CVE-2026-1608", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1608", "description": "Video Onclick <=0.4.7 Stored XSS via youtube shortcode attributes in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "video-onclick", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.4.7"}, "RULE-CVE-2026-1611-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wikiloops\\\\b[^\\\\]]*(?:<[^>]+>|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1611", "description": "Wikiloops Track Player <=1.0.1 Stored XSS via wikiloops shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wikiloops-track-player", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1611-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/\\\\d+)?(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wikiloops\\\\b[^\\\\]]*(?:<[^>]+>|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1611", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1611", "description": "Wikiloops Track Player <=1.0.1 Stored XSS via wikiloops shortcode attributes in REST API content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wikiloops-track-player", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.1"}, "RULE-CVE-2026-1614-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post create", "method": "POST", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update (PUT)", "method": "PUT", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1614-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts/\\\\d+(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:rise-blocks/site-identity~"}, {"name": "ARGS:content", "type": "regex", "value": "~[\\"\']logoTag[\\"\']\\\\s*:\\\\s*[\\"\'][^\\"\']*[\\\\s=<>][^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1614", "description": "Rise Blocks <=3.7 Stored XSS via logoTag attribute in Site Identity block on post update (PATCH)", "method": "PATCH", "mode": "block", "severity": 6.4, "slug": "rise-blocks", "tags": ["xss", "stored-xss", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=3.7"}, "RULE-CVE-2026-1620-01": {"ajax_action": "lae_admin_ajax", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.{2,}/+){2,}|(?:php|phar|data|expect|zip|glob)://|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-1620", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1620", "description": "Livemesh Addons for Elementor <=9.0 authenticated (Contributor+) Local File Inclusion via template parameter in lae_admin_ajax handler", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=9.0"}, "RULE-CVE-2026-1634-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~subitem-al-slider~"}, {"name": "REQUEST_URI", "type": "detectXSS"}], "cve": "CVE-2026-1634", "method": "GET", "mode": "block", "severity": 6.1, "slug": "subitem-al-slider", "target": "plugin", "versions": "<1.1"}, "RULE-CVE-2026-1639-01": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-1639", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1639", "description": "Taskbuilder <=5.0.2 authenticated (Subscriber+) SQL injection via order parameter in wppm_get_project_list AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "taskbuilder", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-1639-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:sort_by", "type": "detectSQLi"}], "cve": "CVE-2026-1639", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1639", "description": "Taskbuilder <=5.0.2 authenticated (Subscriber+) SQL injection via sort_by parameter in wppm_get_project_list AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "taskbuilder", "tags": ["sql-injection", "time-based-blind", "authenticated"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-1643-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mp-ukagaka"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:[<>\\"\'=]|%(?:22|27|3[CEce]|3[Dd]))~i"}], "cve": "CVE-2026-1643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1643", "description": "MP-Ukagaka <=1.5.2 Reflected XSS via unsanitized PHP_SELF in admin settings page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "mp-ukagaka", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-1643-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mp-ukagaka"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:[<>\\"\'=]|%(?:22|27|3[CEce]|3[Dd]))~i"}], "cve": "CVE-2026-1643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1643", "description": "MP-Ukagaka <=1.5.2 Reflected XSS via unsanitized PHP_SELF in admin settings page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "mp-ukagaka", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-1644-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/users\\\\.php~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:approve|deny|block)$~i"}, {"name": "ARGS:user", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-1644", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1644", "description": "WP Front End Profile <=1.3.8 CSRF on user approval/denial/blocking via update_action on users.php", "mode": "block", "severity": 4.3, "slug": "wp-front-end-profile", "tags": ["csrf", "missing-authorization", "user-management"], "target": "plugin", "versions": "<=1.3.8"}, "RULE-CVE-2026-1646-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~gutenberg-extend/posts-block\\\\s*\\\\{[^}]*\\"(?:TitleColor|boxColor|TxtFontSize)\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<[a-z][\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mousedown|keydown|keyup)\\\\s*=|javascript\\\\s*:|</style\\\\s*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1646", "description": "Advance Block Extend <=1.0.4 contributor+ stored XSS via TitleColor/boxColor/TxtFontSize block attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advance-block-extend", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-1646-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~gutenberg-extend/posts-block\\\\s*\\\\{[^}]*\\"(?:TitleColor|boxColor|TxtFontSize)\\"\\\\s*:\\\\s*\\"(?:[^\\"\\\\\\\\]|\\\\\\\\.)*(?:<[a-z][\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|mousedown|keydown|keyup)\\\\s*=|javascript\\\\s*:|</style\\\\s*>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1646", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1646", "description": "Advance Block Extend <=1.0.4 contributor+ stored XSS via TitleColor/boxColor/TxtFontSize block attributes in classic editor post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "advance-block-extend", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-1649-01": {"action": "admin_post_save_community_events_venues", "conditions": [{"name": "ARGS:ce_venue_name", "type": "detectXSS"}], "cve": "CVE-2026-1649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1649", "description": "Community Events <=1.5.7 authenticated stored XSS via ce_venue_name in venue save handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "community-events", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.5.7"}, "RULE-CVE-2026-1650-01": {"action": "admin_init", "conditions": [{"name": "ARGS:delete_custom_field", "type": "exists"}, {"name": "ARGS:id", "type": "exists"}, {"type": "missing_capability", "value": "manage_mdjm"}], "cve": "CVE-2026-1650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1650", "description": "MDJM Event Management <=1.7.8.1 unauthenticated arbitrary custom field deletion via delete_custom_field parameter", "method": "GET", "mode": "block", "severity": 5.3, "slug": "mobile-dj-manager", "tags": ["missing-authorization", "unauthenticated", "arbitrary-deletion"], "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2026-1650-02": {"action": "admin_init", "conditions": [{"name": "ARGS:submit_custom_field", "type": "exists"}, {"type": "missing_capability", "value": "manage_mdjm"}], "cve": "CVE-2026-1650", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1650", "description": "MDJM Event Management <=1.7.8.1 unauthenticated arbitrary custom field creation/update via submit_custom_field parameter", "method": "POST", "mode": "block", "severity": 5.3, "slug": "mobile-dj-manager", "tags": ["missing-authorization", "unauthenticated", "arbitrary-modification"], "target": "plugin", "versions": "<=1.7.8.1"}, "RULE-CVE-2026-1651-01": {"ajax_action": "icegram-express", "conditions": [{"name": "ARGS:handler", "type": "equals", "value": "workflows"}, {"name": "ARGS:method", "type": "equals", "value": "update_status"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|[0-9]+[)]+[ ]*(?:AND|OR|UNION)[ ]|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|IF[ ]*[(].*,.*,|LOAD_FILE|INTO[ ]+(?:OUTFILE|DUMPFILE))~i"}], "cve": "CVE-2026-1651", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1651", "description": "Email Subscribers & Newsletters <=5.9.16 authenticated (Administrator+) SQL injection via workflow_ids in data parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "email-subscribers", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.9.16"}, "RULE-CVE-2026-1655-01": {"ajax_action": "ep_save_frontend_event_submission", "conditions": [{"name": "ARGS:event_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1655", "description": "EventPrime <=4.2.8.4 missing authorization on ep_save_frontend_event_submission allows subscriber+ arbitrary event modification via event_id IDOR", "mode": "block", "severity": 4.3, "slug": "eventprime-event-calendar-management", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.2.8.4"}, "RULE-CVE-2026-1656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpbdp_ajax"}, {"name": "ARGS:listing_id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"name": "ARGS:/listingfields|listing_fields|fields/", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1656", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1656", "description": "Business Directory Plugin <=6.4.20 unauthenticated arbitrary listing modification via wpbdp_ajax AJAX action", "method": "POST", "mode": "block", "severity": 5.3, "slug": "business-directory-plugin", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "idor"], "target": "plugin", "versions": "<=6.4.20"}, "RULE-CVE-2026-1671-01": {"ajax_action": "winter_activity_log_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:page", "type": "regex", "value": "~^(?:wal_favouritelogs|wal_controlsecurity|wal_history|wal_usersessions|wal_reports|wal_logalerts|wal_disabledlogs|wal_cloudintegration|winteractivitylog)$~"}, {"name": "ARGS:function", "type": "regex", "value": "~^(?:datatable|datatable_saved|edit_log|edit_history|control_log|filter_get|filter_save|filter_remove|clear_all_log|bulk_remove)$~"}], "cve": "CVE-2026-1671", "method": "POST", "mode": "block", "severity": 6.5, "slug": "winterlock", "target": "plugin", "versions": "<1.2.9"}, "RULE-CVE-2026-1675-01": {"action": "init", "conditions": [{"name": "ARGS:OpenSesame", "type": "regex", "value": "~^0*1$~"}], "cve": "CVE-2026-1675", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1675", "description": "Advanced Country Blocker <=2.3.1 unauthenticated authorization bypass via insecure default secret key", "mode": "block", "severity": 5.3, "slug": "advanced-country-blocker", "tags": ["authorization-bypass", "insecure-default", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-1706-01": {"action": "init", "conditions": [{"name": "ARGS:vi", "type": "regex", "value": "~(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-1706", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1706", "description": "All-in-One Video Gallery <=4.7.1 Reflected XSS via vi parameter in search form templates", "mode": "block", "severity": 6.1, "slug": "all-in-one-video-gallery", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-1708-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/appointments(/|\\\\?|$)~"}, {"name": "ARGS:append_where_sql", "type": "exists"}], "cve": "CVE-2026-1708", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1708", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated blind SQL injection via append_where_sql parameter in JSON body on REST /ssa/v1/appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api", "json-body-bypass"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-1714-01": {"ajax_action": "woolentor_suggest_price_action", "conditions": [{"name": "ARGS:send_to", "type": "regex", "value": "~[,;\\\\s]~"}], "cve": "CVE-2026-1714", "method": "POST", "mode": "block", "severity": 8.6, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1714-02": {"ajax_action": "woolentor_suggest_price_action", "conditions": [{"name": "ARGS:wlemail", "type": "regex", "value": "~(%0d|%0a|\\\\r|\\\\n)~i"}], "cve": "CVE-2026-1714", "method": "POST", "mode": "block", "severity": 8.6, "slug": "woolentor-addons", "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-1720-01": {"ajax_action": "optn_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-1720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1720", "description": "WowOptin <=1.4.24 missing authorization on optn_install AJAX action allows Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "optin", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.24"}, "RULE-CVE-2026-1720-02": {"ajax_action": "optn_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-1720", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1720", "description": "WowOptin <=1.4.24 missing authorization on optn_install_plugin AJAX action allows Subscriber+ arbitrary plugin installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "optin", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-plugin-install"], "target": "plugin", "versions": "<=1.4.24"}, "RULE-CVE-2026-1750-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on profile update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1750-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/user-edit\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on user edit", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1750-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:ec_store_admin_access", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1750", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1750", "description": "Ecwid Ecommerce Shopping Cart <=7.0.7 privilege escalation via ec_store_admin_access on user registration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ecwid-shopping-cart", "tags": ["missing-authorization", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=7.0.7"}, "RULE-CVE-2026-1754-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "personal-authors-category"}, {"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php(?:%2[fF]|/)[^?]~i"}], "cve": "CVE-2026-1754", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1754", "description": "Personal Authors Category <=0.3 reflected XSS via PHP_SELF path injection on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "personal-authors-category", "tags": ["xss", "reflected-xss", "php-self"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-1755-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_wp_attachment_image_alt", "type": "regex", "value": "~(?:<\\\\s*script|on(?:error|load|click|mouseover|focus|blur|input|change|submit|reset|keydown|keyup|keypress|dblclick|mousedown|mouseup|mouseenter|mouseleave|mousemove|mouseout)\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1755", "description": "Menu Icons by ThemeIsle <=0.13.20 Stored XSS via media attachment alt text (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "menu-icons", "tags": ["xss", "stored-xss", "media-upload"], "target": "plugin", "versions": "<=0.13.20"}, "RULE-CVE-2026-1755-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/\\\\d+~"}, {"name": "ARGS:alt_text", "type": "regex", "value": "~(?:<\\\\s*script|on(?:error|load|click|mouseover|focus|blur|input|change|submit|reset|keydown|keyup|keypress|dblclick|mousedown|mouseup|mouseenter|mouseleave|mousemove|mouseout)\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1755", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1755", "description": "Menu Icons by ThemeIsle <=0.13.20 Stored XSS via REST API media alt_text update", "method": "POST", "mode": "block", "severity": 6.4, "slug": "menu-icons", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=0.13.20"}, "RULE-CVE-2026-1786-01": {"action": "init", "conditions": [{"name": "ARGS:/^dg_tw_options/", "type": "regex", "value": "~\\\\S~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1786", "method": "POST", "mode": "block", "severity": 6.5, "slug": "twitter-posts-to-blog", "target": "plugin", "versions": "<1.11.26"}, "RULE-CVE-2026-1787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/.*delete-migrated-data/tutor(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1787", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1787", "description": "LearnPress Export Import <=4.1.0 unauthenticated deletion of migrated course data via REST API delete-migrated-data/tutor endpoint", "method": "DELETE", "mode": "block", "severity": 4.8, "slug": "learnpress-import-export", "tags": ["missing-authorization", "unauthenticated", "rest-api", "data-deletion"], "target": "plugin", "versions": "<=4.1.0"}, "RULE-CVE-2026-1792-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~options-general\\\\.php/[^?]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "ARGS:page", "type": "equals", "value": "GeoWidget"}], "cve": "CVE-2026-1792", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1792", "description": "GeoWidget <=1.0 reflected XSS via $_SERVER[\'PHP_SELF\'] on admin settings page", "mode": "block", "severity": 6.1, "slug": "geowidget", "tags": ["xss", "reflected", "php-self"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-1793-01": {"action": "init", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}(?:[\\\\w./\\\\\\\\-]*)?(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)~i"}], "cve": "CVE-2026-1793", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1793", "description": "Element Pack Addons for Elementor <=8.3.17 authenticated arbitrary file read via SVG Image widget path traversal", "method": "POST", "mode": "block", "severity": 6.5, "slug": "bdthemes-element-pack-lite", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=8.3.17"}, "RULE-CVE-2026-1796-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "stylebidet"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-1796", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1796", "description": "StyleBidet <=1.0.0 reflected XSS via $_SERVER[\'PHP_SELF\'] on admin settings page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "stylebidet", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1800-01": {"action": "init", "conditions": [{"name": "ARGS:fmcfIdSelectedFnt", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-1800", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1800", "description": "Fonts Manager | Custom Fonts <=1.2 unauthenticated SQL injection via fmcfIdSelectedFnt parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "fonts-manager-custom-fonts", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2026-1805-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~damedia_giglist[^]]*list_title[ ]*=[ ]*[\\"\'][^]]*(<[a-zA-Z]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1805", "description": "DAMedia GigList <=1.9.0 Stored XSS via damedia_giglist shortcode list_title attribute in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "damedia-giglist", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2026-1805-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~damedia_giglist[^]]*list_title[ ]*=[ ]*[\\"\'][^]]*(<[a-zA-Z]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1805", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1805", "description": "DAMedia GigList <=1.9.0 Stored XSS via damedia_giglist shortcode list_title attribute in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "damedia-giglist", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.9.0"}, "RULE-CVE-2026-1808-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[ocplus_button\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript:|&lt;script|&#x3c;script)~i"}], "cve": "CVE-2026-1808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1808", "description": "Orange Confort+ <=0.7 Stored XSS via ocplus_button shortcode style attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orange-confort-plus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.7"}, "RULE-CVE-2026-1808-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ocplus_button\\\\b[^\\\\]]*style\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z0-9_]+\\\\s*=|<script|javascript:|&lt;script|&#x3c;script)~i"}], "cve": "CVE-2026-1808", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1808", "description": "Orange Confort+ <=0.7 Stored XSS via ocplus_button shortcode style attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orange-confort-plus", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.7"}, "RULE-CVE-2026-1809-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via shortcode event handler attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1809-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via javascript: protocol in shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1809-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content[raw]", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*\\\\bon\\\\w+\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via shortcode event handler attributes in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1809-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content[raw]", "type": "regex", "value": "~\\\\[(?:a|div|span|button|img|p|hr|br|iframe)\\\\b[^\\\\]]*javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1809", "description": "HTML Shortcodes <=1.1 Stored XSS via javascript: protocol in shortcode attributes in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "html-shortcodes", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1820-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[bvmalt_sc_div_update_alt_text[^\\\\]]*post_id[^\\\\]]*(?:<script|<img|<iframe|<svg|<object|<embed|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1820", "description": "Media Library Alt Text Editor <=1.0.0 Stored XSS via bvmalt_sc_div_update_alt_text shortcode post_id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-library-alt-text-editor", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1820-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[bvmalt_sc_div_update_alt_text[^\\\\]]*post_id[^\\\\]]*(?:<script|<img|<iframe|<svg|<object|<embed|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1820", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1820", "description": "Media Library Alt Text Editor <=1.0.0 Stored XSS via bvmalt_sc_div_update_alt_text shortcode post_id attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "media-library-alt-text-editor", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1821-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[mt_(?:reservation|video|courses|form)[^\\\\]]*restkey\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1821", "description": "Microtango <=0.9.29 Stored XSS via restkey shortcode attribute in mt_reservation/mt_video", "method": "POST", "mode": "block", "severity": 6.4, "slug": "microtango", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.9.29"}, "RULE-CVE-2026-1821-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[mt_(?:reservation|video|courses|form)[^\\\\]]*restkey\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1821", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1821", "description": "Microtango <=0.9.29 Stored XSS via restkey shortcode attribute in mt_reservation/mt_video (post_content)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "microtango", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.9.29"}, "RULE-CVE-2026-1824-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~infomaniak_connect_generic_auth_url.*?endpoint_login[ ]*=[ ]*[\\"\']?[ ]*(?:javascript|data|vbscript)[ ]*:~i"}], "cve": "CVE-2026-1824", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1824", "description": "Infomaniak Connect OpenID <=1.0.2 Stored XSS via endpoint_login shortcode attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "infomaniak-connect-openid", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1825-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[syv\\\\s[^\\\\]]*id\\\\s*=\\\\s*[\'\\"][^\\\\]]*(?:on[a-zA-Z]+=|<script|javascript:|</iframe)~i"}], "cve": "CVE-2026-1825", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1825", "description": "Show YouTube Video <=1.1 Stored XSS via syv shortcode id attribute in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "show-youtube-video", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1826-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[order_qrcode[^\\\\]]*width\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img|<svg|<iframe)~i"}], "cve": "CVE-2026-1826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1826", "description": "OpenPOS Lite <=3.0 Stored XSS via order_qrcode shortcode width attribute in classic editor post submission", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpos-lite-version", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-1826-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[order_qrcode[^\\\\]]*width\\\\s*=\\\\s*[^\\\\]]*(?:on\\\\w+\\\\s*=|<script|javascript:|<img|<svg|<iframe)~i"}], "cve": "CVE-2026-1826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1826", "description": "OpenPOS Lite <=3.0 Stored XSS via order_qrcode shortcode width attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wpos-lite-version", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=3.0"}, "RULE-CVE-2026-1829-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~cvdb_content_visibility_check\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:system|passthru|exec|shell_exec|popen|proc_open|pcntl_exec|eval|assert|base64_decode|file_get_contents|file_put_contents|phpinfo|unlink|rmdir|mail|curl_exec|preg_replace|call_user_func|create_function|include|require)\\\\s*\\\\(~i"}], "cve": "CVE-2026-1829", "description": "Content Visibility for Divi Builder <=4.02 authenticated (Contributor+) RCE via cvdb_content_visibility_check shortcode attribute", "mode": "block", "severity": 8.8, "slug": "content-visibility-for-divi-builder", "target": "plugin", "versions": "<=4.02"}, "RULE-CVE-2026-1830-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/.*sync~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1830", "description": "Quick Playground <=1.3.1 unauthenticated sync code disclosure via REST API", "mode": "block", "severity": 9.8, "slug": "quick-playground", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-1830-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1830", "description": "Quick Playground <=1.3.1 unauthenticated arbitrary file upload via REST API with path traversal", "method": "POST", "mode": "block", "severity": 9.8, "slug": "quick-playground", "tags": ["arbitrary-file-upload", "path-traversal", "remote-code-execution", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-1834-01": {"ajax_action": "ive_ajax_save_template", "conditions": [{"name": "ARGS:template_data", "type": "regex", "value": "~<script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=|javascript\\\\s*:~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1834", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1834", "description": "Ibtana Visual Editor <=1.2.5.7 stored XSS via ive_ajax_save_template template_data", "mode": "block", "severity": 6.4, "slug": "ibtana-visual-editor", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.2.5.7"}, "RULE-CVE-2026-1841-01": {"action": "init", "conditions": [{"name": "ARGS:pys_source", "type": "detectXSS"}], "cve": "CVE-2026-1841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1841", "description": "PixelYourSite <=11.2.0 stored XSS via unsanitized pys_source request parameter during checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=11.2.0"}, "RULE-CVE-2026-1841-02": {"action": "init", "conditions": [{"name": "ARGS:pys_landing", "type": "regex", "value": "~<[a-zA-Z/!]|javascript:~i"}], "cve": "CVE-2026-1841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1841", "description": "PixelYourSite <=11.2.0 stored XSS via unsanitized pys_landing request parameter during checkout", "method": "POST", "mode": "block", "severity": 7.2, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=11.2.0"}, "RULE-CVE-2026-1843-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[\\\\s>]~i"}], "cve": "CVE-2026-1843", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1843", "description": "Super Page Cache <=5.2.2 unauthenticated stored XSS via Activity Log - script tag injection", "method": "GET", "mode": "block", "severity": 7.2, "slug": "wp-cloudflare-page-cache", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-1857-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/kb-getresponse/v1/get(?:[/?&]|$)~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|&|\\\\?)endpoint=~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1857", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1857", "description": "Kadence Blocks <=3.6.1 authenticated (Contributor+) SSRF via endpoint parameter in GetResponse REST API route", "method": "GET", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["ssrf", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-1860-01": {"ajax_action": "kaliforms_form_delete_uploaded_file", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<script|</script|<img|onerror[[:space:]]*=|onload[[:space:]]*=|javascript:)~i"}], "cve": "CVE-2026-1860", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1860", "description": "Kali Forms <= 2.4.7 Reflected XSS via id parameter in kaliforms_form_delete_uploaded_file AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "kali-forms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-1865-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^user_registration_membership_~"}, {"name": "ARGS:membership_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+)~i"}], "cve": "CVE-2026-1865", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1865", "description": "User Registration & Membership <=5.1.2 authenticated (Subscriber+) SQL injection via membership_ids[] in membership AJAX handlers", "mode": "block", "severity": 6.5, "slug": "user-registration", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-1866-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "regex", "value": "~(?:&amp;|&#0*38;|&#x0*26;)(lt|gt|quot|amp|apos|#0*\\\\d{2,5}|#x[0-9a-fA-F]+);~i"}], "cve": "CVE-2026-1866", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2026-1866-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "regex", "value": "~(?:&amp;|&#0*38;|&#x0*26;)(lt|gt|quot|amp|apos|#0*\\\\d{2,5}|#x[0-9a-fA-F]+);~i"}], "cve": "CVE-2026-1866", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "target": "plugin", "versions": "<=1.32.0"}, "RULE-CVE-2026-1867-01": {"ajax_action": "fe_get_formBuilder_data", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1867", "description": "Front Editor <5.0.6 sensitive form data disclosure via fe_get_formBuilder_data AJAX action", "mode": "block", "severity": 5.9, "slug": "front-editor", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<5.0.6"}, "RULE-CVE-2026-1867-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|[?&])rest_route=)/bfe/v1/form(?:/[0-9]+)?(?:[?&].*)?$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-1867", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1867", "description": "Front Editor <5.0.6 sensitive form data disclosure via unauthenticated GET access to REST /bfe/v1/form endpoint", "mode": "block", "severity": 5.9, "slug": "front-editor", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<5.0.6"}, "RULE-CVE-2026-1870-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/thim-ekit/archive-course/get-courses(?:[/?&]|$)~"}, {"name": "ARGS:params_url[post_status]", "type": "regex", "value": "~^(?:private|draft|pending|trash|auto-draft|future|inherit)$~i"}, {"name": "ARGS:atts", "type": "regex", "value": "~.+~"}], "cve": "CVE-2026-1870", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1870", "description": "Thim Elementor Kit <=1.3.7 unauthenticated information disclosure of private/draft LearnPress courses via post_status in params_url on REST endpoint", "mode": "block", "severity": 5.3, "slug": "thim-elementor-kit", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2026-1885-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[sswp-slide\\\\b[^\\\\]]*sswpid\\\\s*=\\\\s*[\\"\']?\\\\s*[0-9]*\\\\s*[^0-9\\"\'\\\\]\\\\s][^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1885", "description": "Slideshow WP <=1.1 Stored XSS via non-numeric sswpid attribute in sswp-slide shortcode", "method": "POST", "mode": "block", "severity": 6.4, "slug": "slideshow-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-1888-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[docusplaylist\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1888", "description": "Docus \\u2013 YouTube Video Playlist <=1.0.6 Stored XSS via [docusplaylist] shortcode attributes in post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "docus", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-1888-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[docusplaylist\\\\b[^\\\\]]*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1888", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1888", "description": "Docus \\u2013 YouTube Video Playlist <=1.0.6 Stored XSS via [docusplaylist] shortcode attributes in REST API post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "docus", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-1893-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[orbisius_random_name_generator\\\\b[^\\\\]]*btn_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1893", "description": "Orbisius Random Name Generator <=1.0.2 Stored XSS via btn_label shortcode attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orbisius-random-name-generator", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1893-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[orbisius_random_name_generator\\\\b[^\\\\]]*btn_label\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<[a-z/!]|\\\\bon\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1893", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1893", "description": "Orbisius Random Name Generator <=1.0.2 Stored XSS via btn_label shortcode attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "orbisius-random-name-generator", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1900-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/link-whisper(?:-[a-z0-9-]+)?/v[0-9]+/[a-z0-9_/-]*(?:setting|option|config|update|save)~i"}, {"name": "ARGS:settings.keywords", "type": "regex", "value": "~(?:hacked|injected|evil|malware|<script|onerror=|onload=)~i"}, {"name": "ARGS:settings.url", "type": "regex", "value": "~(?:evil|malware|attacker|payload)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1900", "description": "Link Whisper <=0.9.0 unauthenticated settings modification via REST API", "mode": "block", "severity": 6.5, "slug": "link-whisper", "target": "plugin", "versions": "<=0.9.0"}, "RULE-CVE-2026-1902-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[hp-calendar-manage-redirect[^\\\\]]*apix\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>();\\\\\\\\`]|[^\\\\s\\\\]]*[<>();\\\\\\\\`])~i"}], "cve": "CVE-2026-1902", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1902", "description": "Hammas Calendar <1.5.12 Stored XSS via apix shortcode attribute in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "hammas-calendar", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<1.5.12"}, "RULE-CVE-2026-1903-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sb_ravelry_designs\\\\b[^\\\\]]*layout\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>=()\\\\\\\\]|[\\"\'][^\\"\']*[\\"\'][><])~i"}], "cve": "CVE-2026-1903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1903", "description": "Ravelry Designs Widget <=1.0.0 Stored XSS via sb_ravelry_designs shortcode layout attribute in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ravelry-designs-widget", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1903-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[sb_ravelry_designs\\\\b[^\\\\]]*layout\\\\s*=\\\\s*(?:[\\"\'][^\\"\']*[<>=()\\\\\\\\]|[\\"\'][^\\"\']*[\\"\'][><])~i"}], "cve": "CVE-2026-1903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1903", "description": "Ravelry Designs Widget <=1.0.0 Stored XSS via sb_ravelry_designs shortcode layout attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "ravelry-designs-widget", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-1905-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~show_sphere_image[^\\\\]]*width\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*on\\\\w+\\\\s*=|<\\\\s*script|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-1905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1905", "description": "Sphere Manager <=1.0.2 Stored XSS via show_sphere_image shortcode width attribute in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sphere-manager", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1905-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~show_sphere_image[^\\\\]]*width\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:[\\"\'][^\\\\]]*on\\\\w+\\\\s*=|<\\\\s*script|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-1905", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1905", "description": "Sphere Manager <=1.0.2 Stored XSS via show_sphere_image shortcode width attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "sphere-manager", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1909-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wavesurfer\\\\b[^\\\\]]*\\\\b(?:src|ogg)\\\\s*=\\\\s*(?:(?:\\"[^\\"]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"]*\\")|(?:\'[^\']*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\']*\')|(?:[^\\\\s\\\\]]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1909", "description": "WaveSurfer-WP <=2.8.3 Stored XSS via [wavesurfer] shortcode src attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wavesurfer-wp", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2026-1909-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|&|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wavesurfer\\\\b[^\\\\]]*\\\\b(?:src|ogg)\\\\s*=\\\\s*(?:(?:\\"[^\\"]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\"]*\\")|(?:\'[^\']*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\']*\')|(?:[^\\\\s\\\\]]*(?:<|>|(?:^|[\\\\s\\"\'<>])on\\\\w+\\\\s*=|javascript\\\\s*:)[^\\\\s\\\\]]*))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1909", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1909", "description": "WaveSurfer-WP <=2.8.3 Stored XSS via [wavesurfer] shortcode src attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wavesurfer-wp", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=2.8.3"}, "RULE-CVE-2026-1910-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[upmenu-menu[^\\\\]]*lang[^\\\\]]*(?:<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 Stored XSS via lang attribute of upmenu-menu shortcode in post content (classic editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["xss", "stored-xss", "shortcode", "contributor"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1910-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[upmenu-menu[^\\\\]]*lang[^\\\\]]*(?:<[a-zA-Z/]|on[a-zA-Z]+=|javascript:)~i"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 Stored XSS via lang attribute of upmenu-menu shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "contributor"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1910-03": {"ajax_action": "ajaxUpdateOption", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1910", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1910", "description": "UpMenu <=3.1 unauthenticated arbitrary option update via ajaxUpdateOption AJAX endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "upmenu", "tags": ["missing-authorization", "unauthenticated", "arbitrary-option-update"], "target": "plugin", "versions": "<=3.1"}, "RULE-CVE-2026-1912-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ctdoi\\\\s+[^\\\\]]*code\\\\s*=\\\\s*[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1912", "description": "Citations Tools <=0.3.2 Contributor+ stored XSS via ctdoi shortcode code attribute in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "citations-tools", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=0.3.2"}, "RULE-CVE-2026-1912-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ctdoi\\\\s+[^\\\\]]*code\\\\s*=\\\\s*[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b|<svg\\\\b|<iframe\\\\b)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1912", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1912", "description": "Citations Tools <=0.3.2 Contributor+ stored XSS via ctdoi shortcode code attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "citations-tools", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=0.3.2"}, "RULE-CVE-2026-1915-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[plyr[^a-zA-Z0-9_][^\\\\]]*poster[ ]*=[ ]*[\'\\"][^\\\\]]*(?:<[a-z]|on[a-z]+=|javascript:|data:text/html)~i"}], "cve": "CVE-2026-1915", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1915", "description": "Simple Plyr <=0.0.1 Stored XSS via poster attribute in [plyr] shortcode (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-plyr", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=0.0.1"}, "RULE-CVE-2026-1915-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[plyr[^a-zA-Z0-9_][^\\\\]]*poster[ ]*=[ ]*[\'\\"][^\\\\]]*(?:<[a-z]|on[a-z]+=|javascript:|data:text/html)~i"}], "cve": "CVE-2026-1915", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1915", "description": "Simple Plyr <=0.0.1 Stored XSS via poster attribute in [plyr] shortcode (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "simple-plyr", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=0.0.1"}, "RULE-CVE-2026-1922-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[ecs-list-events\\\\b[^\\\\]]*message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<iframe|<svg|<object|<embed|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1922", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1922", "description": "The Events Calendar Shortcode & Block <=3.1.2 authenticated stored XSS via ecs-list-events shortcode message attribute in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-events-calendar-shortcode", "tags": ["xss", "stored-xss", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-1922-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[ecs-list-events\\\\b[^\\\\]]*message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script|<iframe|<svg|<object|<embed|on(?:error|load|click|mouseover|focus|toggle|animationend)\\\\s*=|javascript:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1922", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1922", "description": "The Events Calendar Shortcode & Block <=3.1.2 authenticated stored XSS via ecs-list-events shortcode message attribute in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "the-events-calendar-shortcode", "tags": ["xss", "stored-xss", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-1925-01": {"ajax_action": "emailkit_update_template_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1925", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1925", "description": "EmailKit <=1.6.2 missing authorization on emailkit_update_template_data AJAX handler allows subscriber+ post modification", "mode": "block", "severity": 4.3, "slug": "emailkit", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.2"}, "RULE-CVE-2026-1927-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/figma_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated information disclosure via GET /greenshift/v1/figma_settings/ REST endpoint missing authorization", "method": "GET", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1927-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/license_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated information disclosure via GET /greenshift/v1/license_settings/ REST endpoint missing authorization", "method": "GET", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1927-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/greenshift/v[0-9]+/figma_settings(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1927", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1927", "description": "GreenShift <=12.5.7 authenticated unauthorized settings update via POST /greenshift/v1/figma_settings/ REST endpoint missing authorization", "method": "POST", "mode": "block", "severity": 4.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "rest-api"], "target": "plugin", "versions": "<=12.5.7"}, "RULE-CVE-2026-1929-01": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|assert|eval|call_user_func|call_user_func_array|preg_replace|create_function|file_put_contents|file_get_contents|fwrite|fopen|include|require|include_once|require_once|unlink|rmdir|chmod|chown|curl_exec|mail|header|phpinfo|ob_start|register_shutdown_function|wp_insert_user|wp_set_password|update_option|delete_option|array_map|array_filter|array_walk|usort|uasort|uksort)$~i"}], "cve": "CVE-2026-1929", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1929", "description": "Advanced Woo Labels <=2.36 authenticated (Contributor+) RCE via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "advanced-woo-labels", "tags": ["code-injection", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-1931-01": {"ajax_action": "propertysearch", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1931-02": {"ajax_action": "floorplansearch", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1931-03": {"ajax_action": "rentfetch_track_search_view", "conditions": [{"name": "ARGS:keyword", "type": "detectXSS"}], "cve": "CVE-2026-1931", "method": "POST", "mode": "block", "severity": 7.2, "slug": "rentfetch", "target": "plugin", "versions": "<=0.32.6"}, "RULE-CVE-2026-1932-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookr/v1/appointments(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1932", "description": "Bookr <=1.0.2 unauthenticated appointment status modification via REST API (POST)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "bookr", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1932-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookr/v1/appointments(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1932", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1932", "description": "Bookr <=1.0.2 unauthenticated appointment status modification via REST API (PUT)", "method": "PUT", "mode": "block", "severity": 5.3, "slug": "bookr", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-1937-01": {"ajax_action": "yaymail_import_state", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1937", "method": "POST", "mode": "block", "severity": 9.8, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/delete(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/delete REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/activate(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/activate REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1938-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail-license/v1/license/update(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1938", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1938", "description": "YayMail <=4.3.2 missing authorization on license/update REST endpoint", "mode": "block", "severity": 5.3, "slug": "yaymail", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1941-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wp_events\\\\b[^\\\\]]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/])[^\\\\]]*\\\\]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1941", "description": "WP Event Aggregator <1.9.0 authenticated (contributor+) stored XSS via [wp_events] shortcode attributes in post_content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-event-aggregator", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<1.9.0"}, "RULE-CVE-2026-1941-02": {"ajax_action": "wpea_load_paged_events", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-1941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1941", "description": "WP Event Aggregator <1.9.0 unauthenticated reflected XSS via shortcode_args in wpea_load_paged_events AJAX handler", "mode": "block", "severity": 6.4, "slug": "wp-event-aggregator", "tags": ["xss", "reflected", "ajax", "unauthenticated"], "target": "plugin", "versions": "<1.9.0"}, "RULE-CVE-2026-1942-01": {"ajax_action": "b2s_curation_draft", "conditions": [{"name": "ARGS:b2s-draft-id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1942", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "target": "plugin", "versions": "<=8.7.4"}, "RULE-CVE-2026-1942-02": {"ajax_action": "b2s_curation_share", "conditions": [{"name": "ARGS:b2s-draft-id", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1942", "method": "POST", "mode": "block", "severity": 6.5, "slug": "blog2social", "target": "plugin", "versions": "<=8.7.4"}, "RULE-CVE-2026-1943-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/yaymail/v1/templates(/|\\\\?|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via REST template update (rich_text in template_elements)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1943-02": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via AJAX template import (yaymail_import_templates)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1943-03": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-1943", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1943", "description": "YayMail <=4.3.2 authenticated stored XSS via AJAX state import (yaymail_import_state)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "yaymail", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-1944-01": {"ajax_action": "cbk_save_v1", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1944", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1944", "description": "CallbackKiller Service Widget <=1.2 missing authorization on cbk_save_v1 AJAX action allows unauthenticated site ID modification", "method": "POST", "mode": "block", "severity": 5.3, "slug": "callbackkiller-service-widget", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.2"}, "RULE-CVE-2026-1947-01": {"ajax_action": "submit_nex_form", "conditions": [{"name": "ARGS:nf_set_entry_update_id", "type": "exists"}], "cve": "CVE-2026-1947", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1947", "description": "NEX-Forms <=9.1.9 unauthenticated arbitrary form entry overwrite via IDOR in submit_nex_form (nf_set_entry_update_id)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "nex-forms-express-wp-form-builder", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=9.1.9"}, "RULE-CVE-2026-1948-01": {"ajax_action": "deactivate_license", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1948", "description": "NEX-Forms <=9.1.9 missing authorization on deactivate_license AJAX handler allows Subscriber+ license deactivation", "mode": "block", "severity": 4.3, "slug": "nex-forms-express-wp-form-builder", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.1.9"}, "RULE-CVE-2026-1980-01": {"ajax_action": "wpb_ajax_get", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "get_customer_list"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1980", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1980", "description": "WPBookit <=1.0.8 unauthenticated sensitive customer data exposure via get_customer_list route", "mode": "block", "severity": 5.3, "slug": "wpbookit", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-1981-01": {"ajax_action": "winston_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_disconnect AJAX handler allows subscriber+ API disconnection", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1981-02": {"ajax_action": "winston_link_website", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_link_website AJAX handler allows subscriber+ site linking", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1981-03": {"ajax_action": "winston_verify_website", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1981", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1981", "description": "Winston AI <=0.0.3 missing authorization on winston_verify_website AJAX handler allows subscriber+ site verification", "mode": "block", "severity": 4.3, "slug": "winston-ai-wp", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.0.3"}, "RULE-CVE-2026-1983-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "seatt"}, {"name": "ARGS:remove_event", "type": "regex", "value": "~.+~"}, {"name": "ARGS:event_id", "type": "regex", "value": "~^[0-9]+$~"}], "cve": "CVE-2026-1983", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1983", "description": "Simple Event Attendance <=1.5.0 CSRF vulnerability allowing unauthenticated event deletion via forged requests", "method": "GET", "mode": "block", "severity": 4.3, "slug": "simple-event-attendance", "tags": ["csrf", "missing-authorization", "unauthenticated", "cross-site-request-forgery"], "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-1987-01": {"ajax_action": "scheduler_widget_save_event", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987", "description": "Scheduler Widget <=0.1.6 IDOR allows Subscriber+ to modify arbitrary events via scheduler_widget_save_event AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "scheduler-widget", "tags": ["idor", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=0.1.6"}, "RULE-CVE-2026-1987-02": {"ajax_action": "scheduler_widget_delete_event", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-1987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1987", "description": "Scheduler Widget <=0.1.6 IDOR allows Subscriber+ to delete arbitrary events via scheduler_widget_delete_event AJAX action", "method": "POST", "mode": "block", "severity": 5.4, "slug": "scheduler-widget", "tags": ["idor", "missing-authorization", "broken-access-control", "unauthorized-deletion"], "target": "plugin", "versions": "<=0.1.6"}, "RULE-CVE-2026-1988-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|[%]2[eE][%]2[eE][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:php|phar|data|expect|zip)(?:://|[%]3[aA][%]2[fF][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute (PHP wrapper variant)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-03": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|[%]2[eE][%]2[eE][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute in content field", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "path-traversal", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1988-04": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~flexipsg_carousel[^]]*theme *= *[\\"\'][^\\"\']*(?:php|phar|data|expect|zip)(?:://|[%]3[aA][%]2[fF][%]2[fF])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-1988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1988", "description": "Flexi Product Slider/Grid <=1.0.5 authenticated (Contributor+) Local File Inclusion via flexipsg_carousel shortcode theme attribute in content field (PHP wrapper variant)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "flexi-product-slider-grid", "tags": ["local-file-inclusion", "php-wrapper", "shortcode"], "target": "plugin", "versions": "<=1.0.5"}, "RULE-CVE-2026-1993-01": {"ajax_action": "exactmetrics_vue_update_settings", "conditions": [{"name": "ARGS:setting", "type": "equals", "value": "save_settings"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings save_settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-02": {"ajax_action": "exactmetrics_vue_update_settings", "conditions": [{"name": "ARGS:setting", "type": "equals", "value": "view_reports"}, {"name": "ARGS:value", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings view_reports", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-04": {"ajax_action": "exactmetrics_vue_update_settings_bulk", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~save_settings~i"}, {"name": "ARGS:settings", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings_bulk save_settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1993-05": {"ajax_action": "exactmetrics_vue_update_settings_bulk", "conditions": [{"name": "ARGS:settings", "type": "regex", "value": "~view_reports~i"}, {"name": "ARGS:settings", "type": "regex", "value": "~(?:subscriber|contributor|author|editor)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-1993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-1993", "description": "ExactMetrics >=7.1.0 <=9.0.2 improper privilege management via exactmetrics_vue_update_settings_bulk view_reports", "method": "POST", "mode": "block", "severity": 8.8, "slug": "google-analytics-dashboard-for-wp", "tags": ["privilege-escalation", "improper-privilege-management", "broken-access-control", "ajax"], "target": "plugin", "versions": ">=7.1.0 <=9.0.2"}, "RULE-CVE-2026-1994-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-login\\\\.php~i"}, {"name": "ARGS:action", "type": "equals", "value": "register"}, {"name": "ARGS:ws_plugin__s2member_custom_reg_field_user_pass1", "type": "exists"}], "cve": "CVE-2026-1994", "method": "POST", "mode": "block", "slug": "s2member", "target": "plugin", "versions": "<=260127"}, "RULE-CVE-2026-2001-01": {"ajax_action": "revx_install", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-2001", "method": "POST", "mode": "block", "severity": 8.8, "slug": "revenue", "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-2020-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(post|admin-ajax)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (post.php/admin-ajax save)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2020-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (REST /wp/v2/posts)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2020-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/pages(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[(jQueryArchiveList|JSArchiveList|JsArchiveList)[^\\\\]]*(?:included|excluded)[^\\\\]]*[OC]:[0-9]+:~i"}], "cve": "CVE-2026-2020", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2020", "description": "JS Archive List <=6.1.7 PHP Object Injection via shortcode included/excluded attributes (REST /wp/v2/pages)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "shortcode", "rest-api"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-2022-01": {"ajax_action": "rednao_smart_forms_get_campaigns", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2022", "method": "POST", "mode": "block", "severity": 4.3, "slug": "smart-forms", "target": "plugin", "versions": "<2.7.0"}, "RULE-CVE-2026-2023-01": {"ajax_action": "wppic_save_custom_plugin", "conditions": [{"name": "ARGS:wppicFormData[slug]", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2023", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2023", "description": "WP Plugin Info Card <=6.2.0 Cross-Site Request Forgery via disabled nonce in wppic_save_custom_plugin AJAX handler", "method": "POST", "mode": "block", "severity": 4.3, "slug": "wp-plugin-info-card", "tags": ["csrf", "missing-nonce"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-2024-01": {"ajax_action": "myajax-submit", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-2024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2024", "description": "PhotoStack Gallery <=0.4.1 unauthenticated SQL injection via postid parameter in myajax-submit AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "photostack-gallery", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=0.4.1"}, "RULE-CVE-2026-2025-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mailmint/v1/contacts(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2025", "description": "Mail Mint <1.19.5 unauthenticated access to contacts REST API endpoint exposing user email addresses", "method": "GET", "mode": "block", "severity": 7.5, "slug": "mail-mint", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<1.19.5"}, "RULE-CVE-2026-2027-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:amp_enhancer_custom_css_settings[amp_custom_css]", "type": "regex", "value": "~<\\\\s*(?:script|/style)|\\\\bexpression\\\\s*\\\\(|\\\\burl\\\\s*\\\\(\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|-moz-binding\\\\s*:\\\\s*url|\\\\bbehavior\\\\s*:\\\\s*url~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2027", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2027", "description": "AMP Enhancer <=1.0.49 authenticated stored XSS via AMP Custom CSS setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "amp-enhancer", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=1.0.49"}, "RULE-CVE-2026-2029-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[labb_pricing_item\\\\b[^\\\\]]*(?:&lt;|&#0*60;?|&#x0*3[cC];?)(?:script|img|svg|iframe|details|object|embed|link|meta|body|input|select|textarea|button|form|marquee|video|audio|source|math|style)[ \\\\t>/]~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2029", "description": "Livemesh Addons for Beaver Builder <=3.9.2 Stored XSS via labb_pricing_item shortcode title/value attributes (htmlspecialchars_decode after wp_kses_post)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "addons-for-beaver-builder", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=3.9.2"}, "RULE-CVE-2026-2052-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS:expression", "type": "regex", "value": "~(?:array_map\\\\s*\\\\(\\\\s*[\'\\"]|array_reduce\\\\s*\\\\(\\\\s*[\'\\"]|create_function\\\\s*\\\\(|preg_replace\\\\s*\\\\(\\\\s*[\'\\"][^\'\\"]*\\\\/e[\'\\"]|(?:call_user_func|call_user_func_array)\\\\s*\\\\()~i"}], "cve": "CVE-2026-2052", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2052", "description": "Widget Options <=4.2.2 authenticated RCE via Display Logic expression bypass using eval-triggering PHP functions", "mode": "block", "severity": 8.8, "slug": "widget-options", "tags": ["remote-code-execution", "code-injection", "authenticated", "bypass"], "target": "plugin", "versions": "<=4.2.2"}, "RULE-CVE-2026-2144-01": {"action": "init", "conditions": [{"name": "ARGS:uid", "type": "regex", "value": "~^[+]?0*(?:[1-5])$~"}, {"name": "ARGS:token", "type": "regex", "value": "~^[a-f0-9]{20,}$~"}], "cve": "CVE-2026-2144", "method": "GET", "mode": "block", "severity": 8.1, "slug": "magic-login-mail", "target": "plugin", "versions": "<2.07"}, "RULE-CVE-2026-22193-01": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions email parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-02": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:activation_key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions activation_key parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-03": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:subscription_date", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions subscription_date parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22193-04": {"ajax_action": "wpdGetSubscriptionsPage", "conditions": [{"name": "ARGS:imported_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-22193", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22193", "description": "wpDiscuz <7.6.47 unauthenticated SQL injection via getAllSubscriptions imported_from parameter", "mode": "block", "severity": 7.5, "slug": "wpdiscuz", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22201-01": {"ajax_action": "wpdAddComment", "conditions": [{"name": "REQUEST_HEADERS:Client-IP", "type": "regex", "value": "~^\\\\s*(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\s*$~"}], "cve": "CVE-2026-22201", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22201", "description": "wpDiscuz <=7.6.54 IP spoofing via Client-IP header allows bypass of IP-based rate limiting and ban enforcement", "mode": "block", "severity": 5.3, "slug": "wpdiscuz", "tags": ["ip-spoofing", "rate-limit-bypass", "unauthenticated"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-22202-01": {"ajax_action": "wpdiscuzDeleteDataWithEmail", "conditions": [{"name": "ARGS:commentemail", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22202", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22202", "description": "wpDiscuz <=7.6.54 unauthenticated/low-privilege destructive comment deletion via wpdiscuzDeleteDataWithEmail AJAX action (CSRF)", "mode": "block", "severity": 6.5, "slug": "wpdiscuz", "tags": ["cross-site-request-forgery", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-22209-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "wpdiscuz_form"}, {"name": "ARGS", "type": "regex", "value": "~</\\\\s*style\\\\s*>\\\\s*(?:<\\\\s*(?:script[\\\\s/>]|svg\\\\b|img\\\\b|iframe\\\\b|body\\\\b|input\\\\b)|[^<]*on[a-z]+\\\\s*=)~i"}], "cve": "CVE-2026-22209", "description": "wpDiscuz <7.6.47 admin-authenticated stored XSS via unescaped customCss in wpdiscuz_form CPT rendered inside style tag", "mode": "block", "severity": 5.5, "slug": "wpdiscuz", "target": "plugin", "versions": "<7.6.47"}, "RULE-CVE-2026-22216-01": {"ajax_action": "wpdAddSubscription", "conditions": [{"name": "ARGS:subscribe_email", "type": "regex", "value": "~[%*?]~"}], "cve": "CVE-2026-22216", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22216", "description": "wpDiscuz <=7.6.54 unauthenticated subscription flood via LIKE wildcard email enumeration", "mode": "block", "severity": 5.3, "slug": "wpdiscuz", "tags": ["missing-rate-limiting", "unauthenticated", "email-enumeration"], "target": "plugin", "versions": "<=7.6.54"}, "RULE-CVE-2026-2230-01": {"ajax_action": "AJAX_SAVE_USER_META_DATA", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2230", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2230", "description": "Booking Calendar <=10.14.14 authenticated IDOR allows subscriber+ to modify other users booking meta via AJAX_SAVE_USER_META_DATA", "method": "POST", "mode": "block", "severity": 4.3, "slug": "booking", "tags": ["idor", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=10.14.14"}, "RULE-CVE-2026-2231-01": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:first_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via first_name in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-02": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:last_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via last_name in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-03": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:phone", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via phone in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-04": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:message", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via message in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-05": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:address", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via address in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-06": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:location[user_location_input]", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via location[user_location_input] in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-07": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_source", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_source in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-08": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_medium", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_medium in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-09": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_campaign", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_campaign in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-10": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_term", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_term in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2231-11": {"ajax_action": "fluent_cal_schedule_meeting", "conditions": [{"name": "ARGS:utm_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|<img[\\\\s/]|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/]|<embed[\\\\s/]|<math[\\\\s/]|<details[\\\\s/]|on(?:error|load|mouseover|click|focus|blur|mouseenter|animationend|toggle)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2231", "description": "Fluent Booking <=2.0.01 unauthenticated stored XSS via utm_content in booking submission", "mode": "block", "severity": 7.2, "slug": "fluent-booking", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.01"}, "RULE-CVE-2026-2232-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?i:(?:\'\\\\s+(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s+UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s+(?:\\\\d|NULL\\\\b|@@|CHAR\\\\s*\\\\(|0x[0-9a-f]|version\\\\s*\\\\(|concat\\\\s*\\\\()|\'\\\\s*[^\\\\n]{0,40}\\\\bSLEEP\\\\s*\\\\(|\'\\\\s*[^\\\\n]{0,40}\\\\bBENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\'\\\\s*;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|WAITFOR)\\\\b))~"}], "cve": "CVE-2026-2232", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.2"}, "RULE-CVE-2026-2232-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-ajax=wcpt_ajax(/|&|$)~"}, {"name": "ARGS:data", "type": "regex", "value": "~(?i:(?:\'\\\\s+(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s+UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s+(?:\\\\d|NULL\\\\b|@@|CHAR\\\\s*\\\\(|0x[0-9a-f]|version\\\\s*\\\\(|concat\\\\s*\\\\()|\'\\\\s*[^\\\\n]{0,40}\\\\bSLEEP\\\\s*\\\\(|\'\\\\s*[^\\\\n]{0,40}\\\\bBENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\'\\\\s*;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP|WAITFOR)\\\\b))~"}], "cve": "CVE-2026-2232", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.2"}, "RULE-CVE-2026-22344-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22344", "description": "fivestar theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fivestar", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22344-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22344", "description": "fivestar theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fivestar", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22345-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "image_gallery"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"~"}], "cve": "CVE-2026-22345", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22345", "description": "Image Gallery <= 1.6.0 authenticated (Contributor+) PHP Object Injection via save_post deserialization", "method": "POST", "mode": "block", "severity": 8.8, "slug": "new-image-gallery", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.6.0"}, "RULE-CVE-2026-22346-01": {"ajax_action": "slide_responsive", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[;]|[{])O:[0-9]+:\\"~"}], "cve": "CVE-2026-22346", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22346", "description": "Slider Responsive Slideshow <=1.5.4 PHP object injection via slide_responsive AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "slider-responsive-slideshow", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2026-22347-01": {"ajax_action": "wa_chpcs_action", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~[^a-zA-Z0-9_-]~"}], "cve": "CVE-2026-22347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22347", "description": "Carousel Horizontal Posts Content Slider <=3.3.2 reflected XSS via unsanitized post_type parameter in wa_chpcs_action AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "carousel-horizontal-posts-content-slider", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-22352-01": {"ajax_action": "change_sms_text", "conditions": [{"name": "ARGS:order_status", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[a-z]+[^>]*\\\\bon[a-z]+=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22352", "description": "Persian WooCommerce SMS <=7.1.1 reflected XSS via order_status parameter in change_sms_text AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "persian-woocommerce-sms", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-22353-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "teachpress/authors.php"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ reflected XSS via search parameter on authors admin page", "method": "GET", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22353-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "teachpress/addpublications.php"}, {"name": "ARGS:tags", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+onerror\\\\s*=|<svg[^>]+onload\\\\s*=)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ stored XSS via tags parameter on add publication admin page", "method": "POST", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22353-03": {"ajax_action": "tp_document_upload", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "tp_document_upload"}, {"name": "ARGS:/^(async-upload|name)$/", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[^>]+onload\\\\s*=|<img[^>]+onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-22353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22353", "description": "teachPress <=9.0.12 contributor+ reflected XSS via async-upload parameter in tp_document_upload AJAX handler", "mode": "block", "severity": 6.5, "slug": "teachpress", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=9.0.12"}, "RULE-CVE-2026-22357-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:orderby", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via orderby parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:order", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via order parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:post_mime_type", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via post_mime_type parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:detached", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via detached parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:type", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via type parameter in admin report table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:category", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via category parameter in admin error table", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-07": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:post_id", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via post_id parameter in admin error/click tables", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-08": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:codes", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via codes parameter in admin error/report tables", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-09": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:link_min_count", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via link_min_count parameter in report search", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-10": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:link_max_count", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via link_max_count parameter in report search", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-11": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper_settings"}, {"name": "ARGS:tab", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via tab parameter in settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-12": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper_settings"}, {"name": "ARGS:setting_highlight", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via setting_highlight parameter in settings page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22357-13": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "link_whisper"}, {"name": "ARGS:keywords", "type": "detectXSS"}], "cve": "CVE-2026-22357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22357", "description": "Link Whisper Free <=0.9.2 reflected XSS via keywords parameter in click details page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "link-whisper", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=0.9.2"}, "RULE-CVE-2026-22361-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22361", "description": "a-mart theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "a-mart", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22361-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22361", "description": "a-mart theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "a-mart", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22362-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22362", "description": "photolia theme <= 1.0.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "photolia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22362-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22362", "description": "photolia theme <= 1.0.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "photolia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22363-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22363", "description": "rhodos theme <= 1.3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rhodos", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2026-22363-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22363", "description": "rhodos theme <= 1.3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rhodos", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.3"}, "RULE-CVE-2026-22364-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22364", "description": "seventrees theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "seventrees", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22364-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22364", "description": "seventrees theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "seventrees", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22365-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22365", "description": "soleng theme <= 1.0.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "soleng", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.5"}, "RULE-CVE-2026-22365-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22365", "description": "soleng theme <= 1.0.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "soleng", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.5"}, "RULE-CVE-2026-22366-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22366", "description": "jude theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "jude", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22366-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22366", "description": "jude theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "jude", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22367", "description": "coworking theme <= 1.6.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "coworking", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2026-22367-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22367", "description": "coworking theme <= 1.6.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "coworking", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6.1"}, "RULE-CVE-2026-22368-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22368", "description": "redy theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "redy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22368-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22368", "description": "redy theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "redy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-22369-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22369", "description": "ironfit theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ironfit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22369-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22369", "description": "ironfit theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ironfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22370-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22370", "description": "marveland theme <= 1.3.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "marveland", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22370-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22370", "description": "marveland theme <= 1.3.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "marveland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.0"}, "RULE-CVE-2026-22371-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22371", "description": "gustavo theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gustavo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22371-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22371", "description": "gustavo theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gustavo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22372-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22372", "description": "isida theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "isida", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-22372-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22372", "description": "isida theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "isida", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-22373-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22373", "description": "fooddy theme <= 1.3.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fooddy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.10"}, "RULE-CVE-2026-22373-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22373", "description": "fooddy theme <= 1.3.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fooddy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.10"}, "RULE-CVE-2026-22374-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22374", "description": "zioalberto theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "zioalberto", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22374-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22374", "description": "zioalberto theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "zioalberto", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22375-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22375", "description": "impacto-patronus theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "impacto-patronus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22375-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22375", "description": "impacto-patronus theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "impacto-patronus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22376-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22376", "description": "parkivia theme <= 1.1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "parkivia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22376-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22376", "description": "parkivia theme <= 1.1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "parkivia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22377-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22377", "description": "saveo theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "saveo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22377-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22377", "description": "saveo theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "saveo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22378-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22378", "description": "blabber theme <= 1.7.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "blabber", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2026-22378-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22378", "description": "blabber theme <= 1.7.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "blabber", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7.0"}, "RULE-CVE-2026-22379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22379", "description": "netmix theme <= 1.0.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "netmix", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-22379-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22379", "description": "netmix theme <= 1.0.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "netmix", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.10"}, "RULE-CVE-2026-22380-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22380", "description": "unlimhost theme <= 1.2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unlimhost", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22380-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22380", "description": "unlimhost theme <= 1.2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unlimhost", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.3"}, "RULE-CVE-2026-22381-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22381", "description": "pawfriends theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "pawfriends", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22381-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22381", "description": "pawfriends theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "pawfriends", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22387-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22387", "description": "aviana theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "aviana", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22387-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22387", "description": "aviana theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "aviana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22389-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22389", "description": "cocco theme <= 1.5.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cocco", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5.1"}, "RULE-CVE-2026-22389-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22389", "description": "cocco theme <= 1.5.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cocco", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.1"}, "RULE-CVE-2026-22390-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "ba_cheetah_disable"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22390", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22390", "description": "Builderall Builder for WordPress <=3.0.1 missing authorization on ba_cheetah_disable AJAX handler", "mode": "block", "severity": 9.9, "slug": "builderall-cheetah-for-wp", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-22390-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "ba_cheetah_duplicate_wpml_layout"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22390", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22390", "description": "Builderall Builder for WordPress <=3.0.1 missing authorization on ba_cheetah_duplicate_wpml_layout AJAX handler", "mode": "block", "severity": 9.9, "slug": "builderall-cheetah-for-wp", "tags": ["missing-authorization", "broken-access-control", "ajax"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-22392-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22392", "description": "cortex theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cortex", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22392-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22392", "description": "cortex theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cortex", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22394-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22394", "description": "evently theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "evently", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22394-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22394", "description": "evently theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "evently", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22395-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22395", "description": "fiorello theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fiorello", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22395-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22395", "description": "fiorello theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fiorello", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22397-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22397", "description": "fleur theme <= 2.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fleur", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.0"}, "RULE-CVE-2026-22397-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22397", "description": "fleur theme <= 2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fleur", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.0"}, "RULE-CVE-2026-22399-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22399", "description": "holmes theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "holmes", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22399-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22399", "description": "holmes theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "holmes", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22403-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22403", "description": "innovio theme <= 1.7 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "innovio", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22403-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22403", "description": "innovio theme <= 1.7 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "innovio", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.7"}, "RULE-CVE-2026-22405-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22405", "description": "overton theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "overton", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22405-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22405", "description": "overton theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "overton", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22408-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22408", "description": "justicia theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "justicia", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22408-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22408", "description": "justicia theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "justicia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22410-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22410", "description": "dolcino theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dolcino", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22410-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22410", "description": "dolcino theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dolcino", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22412-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22412", "description": "eona theme <= 1.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "eona", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22412-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22412", "description": "eona theme <= 1.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "eona", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22413-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22413", "description": "malgre theme <= 1.0.3 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "malgre", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22413-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22413", "description": "malgre theme <= 1.0.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "malgre", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.3"}, "RULE-CVE-2026-22414-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22414", "description": "marra theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "marra", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22414-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22414", "description": "marra theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "marra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22415-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22415", "description": "the-mounty theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "the-mounty", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22415-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22415", "description": "the-mounty theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "the-mounty", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22416-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22416", "description": "fixteam theme <= 1.5.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "fixteam", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2026-22416-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22416", "description": "fixteam theme <= 1.5.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "fixteam", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5.0"}, "RULE-CVE-2026-22418-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22418", "description": "great-lotus theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "great-lotus", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-22418-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22418", "description": "great-lotus theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "great-lotus", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-22419-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22419", "description": "honor theme <= 2.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "honor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.3"}, "RULE-CVE-2026-22419-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22419", "description": "honor theme <= 2.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "honor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.3"}, "RULE-CVE-2026-22420-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22420", "description": "horizon theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "horizon", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22420-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22420", "description": "horizon theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "horizon", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-22421-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22421", "description": "quantum theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "quantum", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22421-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22421", "description": "quantum theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "quantum", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-22424-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22424", "description": "shaha theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "shaha", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22424-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22424", "description": "shaha theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "shaha", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-22427-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22427", "description": "gotravel theme <= 2.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "gotravel", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22427-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22427", "description": "gotravel theme <= 2.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "gotravel", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.1"}, "RULE-CVE-2026-22428-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22428", "description": "tooth-fairy theme <= 1.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "tooth-fairy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2026-22428-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22428", "description": "tooth-fairy theme <= 1.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "tooth-fairy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.16"}, "RULE-CVE-2026-22429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22429", "description": "verdure theme <= 1.6 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "verdure", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22429-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22429", "description": "verdure theme <= 1.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "verdure", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-22431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22431", "description": "wabi-sabi theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wabi-sabi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22431", "description": "wabi-sabi theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wabi-sabi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22432-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22432", "description": "woopy theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "woopy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22432-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22432", "description": "woopy theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "woopy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-22433-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22433", "description": "cloudme theme <= 1.2.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "cloudme", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22433-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22433", "description": "cloudme theme <= 1.2.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "cloudme", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.2"}, "RULE-CVE-2026-22434-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22434", "description": "crown-art theme <= 1.2.11 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "crown-art", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2026-22434-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22434", "description": "crown-art theme <= 1.2.11 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "crown-art", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.11"}, "RULE-CVE-2026-22435-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22435", "description": "electroserv theme <= 1.3.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "electroserv", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22435-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22435", "description": "electroserv theme <= 1.3.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "electroserv", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22437-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22437", "description": "playa theme <= 1.3.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "playa", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.9"}, "RULE-CVE-2026-22437-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22437", "description": "playa theme <= 1.3.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "playa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.9"}, "RULE-CVE-2026-22439-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22439", "description": "green-planet theme <= 1.1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "green-planet", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.14"}, "RULE-CVE-2026-22439-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22439", "description": "green-planet theme <= 1.1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "green-planet", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.14"}, "RULE-CVE-2026-22449-01": {"ajax_action": "donpeppe_select_blog_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:[.][.][/.]{2}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-22449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22449", "description": "Don Peppe Theme <=1.3 local file inclusion via blogType parameter in donpeppe_select_blog_load_more", "mode": "block", "severity": 8.1, "slug": "donpeppe", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22449-02": {"ajax_action": "donpeppe_select_blog_shortcode_load_more", "conditions": [{"name": "ARGS:blogType", "type": "regex", "value": "~(?:[.][.][/.]{2}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-22449", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22449", "description": "Don Peppe Theme <=1.3 local file inclusion via blogType parameter in shortcode handler", "mode": "block", "severity": 8.1, "slug": "donpeppe", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.3"}, "RULE-CVE-2026-22457-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22457", "description": "wanderland theme <= 1.5 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wanderland", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22457-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22457", "description": "wanderland theme <= 1.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wanderland", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.5"}, "RULE-CVE-2026-22460-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/formgent/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env)|/etc/passwd~i"}], "cve": "CVE-2026-22460", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22460", "description": "FormGent <=1.5.4 unauthenticated arbitrary file deletion via path traversal in REST API", "mode": "block", "severity": 8.6, "slug": "formgent", "tags": ["path-traversal", "arbitrary-file-deletion", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.5.4"}, "RULE-CVE-2026-22472-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "set_setting_Emsfb"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22472", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22472", "description": "Easy Form Builder <=3.9.6 missing authorization on set_setting_Emsfb AJAX action allows subscriber+ settings manipulation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-form-builder", "tags": ["missing-authorization", "broken-access-control", "settings-manipulation"], "target": "plugin", "versions": "<=3.9.6"}, "RULE-CVE-2026-22472-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "add_addons_Emsfb"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22472", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22472", "description": "Easy Form Builder <=3.9.6 missing authorization on add_addons_Emsfb AJAX action allows subscriber+ arbitrary addon installation", "method": "POST", "mode": "block", "severity": 8.8, "slug": "easy-form-builder", "tags": ["missing-authorization", "broken-access-control", "arbitrary-file-install"], "target": "plugin", "versions": "<=3.9.6"}, "RULE-CVE-2026-22477-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22477", "description": "felizia theme <= 1.3.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "felizia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.4"}, "RULE-CVE-2026-22477-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22477", "description": "felizia theme <= 1.3.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "felizia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.4"}, "RULE-CVE-2026-22480-01": {"ajax_action": "pf_export_ajax_basic", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22480", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22480", "description": "Product Feed for WooCommerce <=2.3.3 PHP object injection via form_data in pf_export_ajax_basic", "mode": "block", "severity": 7.2, "slug": "webtoffee-product-feed", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-22480-02": {"ajax_action": "pf_schedule_ajax", "conditions": [{"name": "ARGS:form_data", "type": "regex", "value": "~[OC]:[0-9]+:\\\\\\"~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22480", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22480", "description": "Product Feed for WooCommerce <=2.3.3 PHP object injection via form_data in pf_schedule_ajax", "mode": "block", "severity": 7.2, "slug": "webtoffee-product-feed", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=2.3.3"}, "RULE-CVE-2026-22481-01": {"ajax_action": "save_courier_settings", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on save_courier_settings AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-02": {"ajax_action": "refresh_courier_data_edit", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on refresh_courier_data_edit AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-03": {"ajax_action": "refresh_courier_data_list", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on refresh_courier_data_list AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22481-04": {"ajax_action": "fetch_order_ratios", "conditions": [{"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-22481", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22481", "description": "BD Courier Order Ratio Checker <=2.0.1 missing authorization on fetch_order_ratios AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "bd-courier-order-ratio-checker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-22482-01": {"ajax_action": "wb_scrapy_image", "conditions": [{"name": "ARGS:op", "type": "regex", "value": "~^(?:scrapy|down)$~"}, {"name": "ARGS:image", "type": "regex", "value": "~(?:^https?://(?:localhost(?=[:/]|$)|127\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|0\\\\.0\\\\.0\\\\.0(?=[:/]|$)|10\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|192\\\\.168\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|169\\\\.254\\\\.[0-9]{1,3}\\\\.[0-9]{1,3}(?=[:/]|$)|\\\\[::1\\\\](?=[:/]|$)|0x[0-9a-f]{8}(?=[:/]|$))|^file://)~i"}], "cve": "CVE-2026-22482", "method": "POST", "mode": "block", "severity": 9.1, "slug": "imgspider", "target": "plugin", "versions": "<2.3.13"}, "RULE-CVE-2026-22495-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22495", "description": "greenville theme <= 1.3.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "greenville", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22495-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22495", "description": "greenville theme <= 1.3.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "greenville", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.2"}, "RULE-CVE-2026-22496-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22496", "description": "hypnotherapy theme <= 1.2.10 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "hypnotherapy", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.10"}, "RULE-CVE-2026-22496-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22496", "description": "hypnotherapy theme <= 1.2.10 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "hypnotherapy", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.10"}, "RULE-CVE-2026-22502-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22502", "description": "mr-cobbler theme <= 1.1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "mr-cobbler", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22502-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22502", "description": "mr-cobbler theme <= 1.1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "mr-cobbler", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.9"}, "RULE-CVE-2026-22508-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22508", "description": "dentalux theme <= 3.3 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "dentalux", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2026-22508-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22508", "description": "dentalux theme <= 3.3 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "dentalux", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=3.3"}, "RULE-CVE-2026-22513-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22513", "description": "triompher theme <= 1.1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "triompher", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2026-22513-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22513", "description": "triompher theme <= 1.1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "triompher", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.0"}, "RULE-CVE-2026-22514-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22514", "description": "unica theme <= 1.4.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "unica", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.1"}, "RULE-CVE-2026-22514-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22514", "description": "unica theme <= 1.4.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "unica", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.1"}, "RULE-CVE-2026-22515-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22515", "description": "vegadays theme <= 1.2.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "vegadays", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2026-22515-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22515", "description": "vegadays theme <= 1.2.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "vegadays", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.0"}, "RULE-CVE-2026-22516-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-22516", "description": "wizors-investments theme <= 2.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "wizors-investments", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.12"}, "RULE-CVE-2026-22516-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-22516", "description": "wizors-investments theme <= 2.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "wizors-investments", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.12"}, "RULE-CVE-2026-22522-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/block-slider/~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-22522", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22522", "description": "Block Slider <=2.2.3 broken access control on REST API endpoints allows subscriber+ unauthorized data access", "mode": "block", "severity": 6.5, "slug": "block-slider", "tags": ["missing-authorization", "broken-access-control", "rest-api", "information-disclosure"], "target": "plugin", "versions": "<=2.2.3"}, "RULE-CVE-2026-2268-01": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\\\{post_meta:[^}]+\\\\}~i"}], "cve": "CVE-2026-2268", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.0"}, "RULE-CVE-2026-2268-02": {"ajax_action": "nf_ajax_submit", "conditions": [{"name": "ARGS:formData", "type": "regex", "value": "~\\\\{user_meta:[^}]+\\\\}~i"}], "cve": "CVE-2026-2268", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ninja-forms", "target": "plugin", "versions": "<=3.14.0"}, "RULE-CVE-2026-2279-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "list_links"}, {"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|IF\\\\s*\\\\(|CASE\\\\s+WHEN|CONCAT\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|;\\\\s*(?:SELECT|DROP|ALTER|CREATE|INSERT|UPDATE|DELETE)|--\\\\s|/\\\\*|\\\\(\\\\s*SELECT)~i"}], "cve": "CVE-2026-2279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2279", "description": "myLinksDump <=1.6 authenticated (Administrator+) SQL Injection via sort_by parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 7.2, "slug": "mylinksdump", "tags": ["sql-injection", "order-by-injection", "authenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-2279-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "list_links"}, {"name": "ARGS:sort_order", "type": "regex", "value": "~^(?!(?:ASC|DESC)$).+~i"}], "cve": "CVE-2026-2279", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2279", "description": "myLinksDump <=1.6 authenticated (Administrator+) SQL Injection via sort_order parameter in ORDER BY clause", "method": "GET", "mode": "block", "severity": 7.2, "slug": "mylinksdump", "tags": ["sql-injection", "order-by-injection", "authenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-22850-01": {"action": "init", "conditions": [{"name": "ARGS:pa", "type": "regex", "value": "~[)\'][ ]*[,;][ ]*(?:[(][ ]*[\'\\"]|DROP |DELETE |INSERT |UPDATE |SELECT |ALTER |TRUNCATE |CREATE |--)~i"}], "cve": "CVE-2026-22850", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22850", "description": "Koko Analytics <2.1.3 stored SQL injection via pa tracking parameter", "mode": "block", "severity": 8.3, "slug": "koko-analytics", "tags": ["sql-injection", "stored-sqli", "tracking"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-22850-02": {"action": "init", "conditions": [{"name": "ARGS:r", "type": "regex", "value": "~[)\'][ ]*[,;][ ]*(?:[(][ ]*[\'\\"]|DROP |DELETE |INSERT |UPDATE |SELECT |ALTER |TRUNCATE |CREATE |--)~i"}], "cve": "CVE-2026-22850", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-22850", "description": "Koko Analytics <2.1.3 stored SQL injection via r referrer parameter", "mode": "block", "severity": 8.3, "slug": "koko-analytics", "tags": ["sql-injection", "stored-sqli", "tracking"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-2295-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~\\"post_status\\"[ ]*:~i"}], "cve": "CVE-2026-2295", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2295", "description": "WPZOOM Addons for Elementor <=1.3.2 unauthenticated information disclosure via post_status injection in wpz_posts_grid_load_more AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "wpzoom-elementor-addons", "tags": ["information-disclosure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2026-2296-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpa/~"}, {"name": "ARGS", "type": "regex", "value": "~[();`$]|\\\\bsystem\\\\b|\\\\bexec\\\\b|\\\\bpassthru\\\\b|\\\\bshell_exec\\\\b|\\\\bpopen\\\\b|\\\\bproc_open\\\\b|\\\\beval\\\\b|\\\\bassert\\\\b|\\\\bphpinfo\\\\b|\\\\bbase64_decode\\\\b|\\\\bfile_get_contents\\\\b|\\\\bfile_put_contents\\\\b|\\\\bchr\\\\s*\\\\(|\\\\bpack\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-2296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2296", "description": "Product Addons for Woocommerce <=3.1.0 authenticated (Shop Manager+) PHP code injection via conditional logic operator field in REST API", "method": "POST", "mode": "block", "severity": 7.2, "slug": "woo-custom-product-addons", "tags": ["code-injection", "rce", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-2351-01": {"ajax_action": "get_text_from_url_tm", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:^|/)(?:wp-config\\\\.php|etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2351", "description": "Task Manager <=3.0.2 arbitrary file read via get_text_from_url_tm AJAX handler", "mode": "block", "severity": 6.5, "slug": "task-manager", "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-23549-01": {"ajax_action": "mep_re_ajax_load_ticket_type_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_ticket_type_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-02": {"ajax_action": "mep_re_ajax_load_extra_service_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_extra_service_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-03": {"ajax_action": "mep_re_ajax_load_ticket_time_list", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_re_ajax_load_ticket_time_list", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23549-04": {"ajax_action": "mep_event_list_date_schedule", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-23549", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23549", "description": "WpEvently <=5.1.1 unauthenticated PHP Object Injection via event_id in mep_event_list_date_schedule", "method": "POST", "mode": "block", "severity": 9.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.1.1"}, "RULE-CVE-2026-23550-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/api/modular-connector/login/.*~i"}], "config": {}, "cve": "CVE-2026-23550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550", "description": "Modular Connector <=2.5.1 unauthenticated privilege escalation in the Modular DS/Modular Connector plugin caused by incorrect privilege assignment and an overly permissive custom routing layer that allows crafted unauthenticated requests to reach login-related endpoints and obtain elevated privileges, as described by NVD, Patchstack, and the vendor advisory.", "mode": "block", "severity": 10.0, "slug": "modular-connector", "tags": ["priv-esc", "auth-bypass", "modular-connector", "routing"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-23550-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/(api/modular-connector|api-modular-connector)/(login|lb|oauth)/[^/?]+~i"}], "config": {}, "cve": "CVE-2026-23550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23550", "description": "Heuristic coverage for Modular Connector <=2.5.1 privilege escalation where unauthenticated attackers can reach internal login-related routes handled by the plugin\\u2019s custom router (for example, variants of an /api-modular-connector/login path) because routing middleware is bypassed, enabling admin-login behavior consistent with external analyses of this CVE.", "mode": "block", "severity": 10.0, "slug": "modular-connector", "tags": ["priv-esc", "auth-bypass", "modular-connector", "routing"], "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-2356-01": {"ajax_action": "user_registration_membership_register_member", "conditions": [{"name": "ARGS:members_data", "type": "regex", "value": "~\\"payment_method\\"\\\\s*:\\\\s*\\"\\"~"}], "cve": "CVE-2026-2356", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2356", "description": "User Registration & Membership <=5.1.2 unauthenticated IDOR user deletion via register_member AJAX handler (empty payment_method path)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "user-registration", "tags": ["idor", "improper-access-control", "unauthenticated", "user-deletion"], "target": "plugin", "versions": "<=5.1.2"}, "RULE-CVE-2026-2358-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~[[]wp_ulike_likers_box[^]]*template[ ]*=[ ]*[\\"\'][^\\"\']*(?:&#(?:0*60|[xX]0*3[cC]);?|&lt;)[ ]*(?:script|img|svg|iframe|details|object|embed|body|marquee|video|audio|input|select|textarea|form|button|a[ ])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-2358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2358", "description": "WP ULike <=5.0.1 Stored XSS via [wp_ulike_likers_box] shortcode template attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-ulike", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2358-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~[[]wp_ulike_likers_box[^]]*template[ ]*=[ ]*[\\"\'][^\\"\']*(?:&#(?:0*60|[xX]0*3[cC]);?|&lt;)[ ]*(?:script|img|svg|iframe|details|object|embed|body|marquee|video|audio|input|select|textarea|form|button|a[ ])[^\\"\']*[\\"\']~i"}], "cve": "CVE-2026-2358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2358", "description": "WP ULike <=5.0.1 Stored XSS via [wp_ulike_likers_box] shortcode template attribute in REST API post/page save", "mode": "block", "severity": 6.4, "slug": "wp-ulike", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2362-01": {"ajax_action": "save-attachment", "conditions": [{"name": "ARGS:changes[alt]", "type": "regex", "value": "~<[a-zA-Z][^>]*on[a-zA-Z]+=|<(script|svg|iframe|embed|object|math|xmp|noscript)|javascript\\\\s*:~i"}], "cve": "CVE-2026-2362", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2362", "description": "WP Accessibility <=2.3.1 Stored DOM-Based XSS via image alt text in save-attachment AJAX handler", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-accessibility", "tags": ["xss", "stored-dom-xss", "media-library"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2365-01": {"ajax_action": "fluentform_step_form_save_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|javascript\\\\s*:|on(?:error|load|click|mouseover|focus|blur)\\\\s*=~i"}], "cve": "CVE-2026-2365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2365", "description": "Fluent Forms <=6.1.17 unauthenticated stored XSS via fluentform_step_form_save_data AJAX draft endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "fluentform", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=6.1.17"}, "RULE-CVE-2026-2367-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "[ays_block"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2367", "description": "Secure Copy Content Protection <= 5.0.1 Stored XSS via ays_block shortcode in post content (post.php)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "secure-copy-content-protection", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2367-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "contains", "value": "[ays_block"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[^>]*>|\\\\bon(?:error|load|click|mouseover|focus|mouseenter)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\bon|<iframe[^>]*>~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2367", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2367", "description": "Secure Copy Content Protection <= 5.0.1 Stored XSS via ays_block shortcode in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "secure-copy-content-protection", "tags": ["xss", "stored-xss", "shortcode", "rest-api"], "target": "plugin", "versions": "<=5.0.1"}, "RULE-CVE-2026-2371-01": {"ajax_action": "gspb_el_reusable_load", "conditions": [{"type": "missing_capability", "value": "read"}, {"name": "ARGS:post_id", "type": "exists"}], "cve": "CVE-2026-2371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2371", "description": "GreenShift <=12.8.3 unauthenticated IDOR disclosure of private/draft/password-protected reusable blocks via gspb_el_reusable_load AJAX handler", "method": "POST", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2373-05": {"ajax_action": "wpr_get_filtered_count_products", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:grid_settings[post_type]", "type": "regex", "value": "~^(?!post$|page$|product$|attachment$|nav_menu_item$|revision$|custom_css$|customize_changeset$|oembed_cache$|user_request$|wp_block$|wp_template$|wp_template_part$|wp_global_styles$|wp_navigation$|elementor_library$)[a-z][a-z0-9_-]{1,31}$~i"}], "cve": "CVE-2026-2373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373", "description": "Royal Elementor Addons <=1.7.1049 unauthenticated CPT count exposure via wpr_get_filtered_count_products", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1049"}, "RULE-CVE-2026-2373-06": {"ajax_action": "wpr_get_media_filtered_count", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:grid_settings[post_type]", "type": "regex", "value": "~^(?!post$|page$|product$|attachment$|nav_menu_item$|revision$|custom_css$|customize_changeset$|oembed_cache$|user_request$|wp_block$|wp_template$|wp_template_part$|wp_global_styles$|wp_navigation$|elementor_library$)[a-z][a-z0-9_-]{1,31}$~i"}], "cve": "CVE-2026-2373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2373", "description": "Royal Elementor Addons <=1.7.1049 unauthenticated CPT count exposure via wpr_get_media_filtered_count", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1049"}, "RULE-CVE-2026-2374-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-login\\\\.php|/xmlrpc\\\\.php)/.*(?:<[a-zA-Z]|%3[cC][a-zA-Z]|%253[cC])~i"}], "cve": "CVE-2026-2374", "description": "Login No Captcha reCAPTCHA <=1.8.0 unauthenticated stored XSS via PATH_INFO in $_SERVER[\'PHP_SELF\'] on wp-login.php/xmlrpc.php", "mode": "block", "severity": 7.2, "slug": "login-recaptcha", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-23800-01": {"action": "plugins_loaded", "conditions": [{"name": "ARGS:origin", "type": "equals", "value": "mo"}, {"name": "ARGS:type", "type": "equals", "value": "request"}, {"name": "ARGS:mrid", "type": "regex", "value": "~.+~"}, {"name": "ARGS:sig", "type": "regex", "value": "~.+~"}], "cve": "CVE-2026-23800", "method": "GET", "mode": "block", "severity": 10.0, "slug": "modular-connector", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-23806-01": {"action": "init", "conditions": [{"name": "ARGS:job-search", "type": "regex", "value": "~(?:UNION[\\\\s/*]+(?:ALL[\\\\s/*]+)?SELECT[\\\\s/*]|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|[\'\\")0-9]\\\\s*--\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-23806", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23806", "description": "Jobs for WordPress <=2.8 unauthenticated SQL injection via job-search shortcode parameter", "mode": "block", "severity": 7.5, "slug": "job-postings", "tags": ["sql-injection", "unauthenticated", "shortcode", "broken-access-control"], "target": "plugin", "versions": "<=2.8"}, "RULE-CVE-2026-23807-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wptelegram_widget_view"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-23807", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23807", "description": "WP Telegram Widget <=2.2.13 unauthenticated reflected XSS via wptelegram_widget_view admin-post handler", "mode": "block", "severity": 7.1, "slug": "wptelegram-widget", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=2.2.13"}, "RULE-CVE-2026-2386-01": {"ajax_action": "tpae_create_page", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~^(?:page|nxt_builder)$~i"}, {"type": "missing_capability", "value": "edit_pages"}], "cve": "CVE-2026-2386", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2386", "description": "The Plus Addons for Elementor <=6.4.7 incorrect authorization in tpae_create_page allows Author+ to create restricted post type drafts via post_type parameter", "method": "POST", "mode": "block", "severity": 4.3, "slug": "the-plus-addons-for-elementor-page-builder", "tags": ["incorrect-authorization", "broken-access-control", "privilege-escalation"], "target": "plugin", "versions": "<=6.4.7"}, "RULE-CVE-2026-23977-01": {"action": "init", "conditions": [{"name": "ARGS:stswpro_save_ticket", "type": "exists"}, {"name": "ARGS:post_title", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-23977", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-23977", "description": "Helpdesk Support Ticket System for WooCommerce <=2.1.2 unauthorized ticket creation via WooCommerce tickets endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "support-ticket-system-for-woocommerce", "tags": ["missing-authorization", "broken-access-control", "ticket-creation", "frontend"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2026-2410-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wdanp-edit-redirects"}, {"name": "ARGS:wdan_add_block", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2410", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2410", "description": "Disable Admin Notices <=1.4.1 CSRF on blocked redirect URL addition via wdanp-edit-redirects admin page", "method": "POST", "mode": "block", "severity": 4.3, "slug": "disable-admin-notices", "tags": ["csrf", "cross-site-request-forgery", "settings-change"], "target": "plugin", "versions": "<=1.4.1"}, "RULE-CVE-2026-2416-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "detectSQLi"}], "cve": "CVE-2026-2416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2416", "description": "Geo Mashup <=1.13.17 unauthenticated SQL injection via sort parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.17"}, "RULE-CVE-2026-2416-02": {"ajax_action": "geo_mashup_suggest_custom_keys", "conditions": [{"name": "ARGS:sort", "type": "detectSQLi"}], "cve": "CVE-2026-2416", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2416", "description": "Geo Mashup <=1.13.17 authenticated SQL injection via sort parameter in geo_mashup_suggest_custom_keys AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=1.13.17"}, "RULE-CVE-2026-2420-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:option_page", "type": "equals", "value": "ltm_popup_group"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2420", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2420", "description": "LotekMedia Popup Form <=1.0.6 stored XSS via plugin settings", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ltm-popup-form", "tags": ["stored-xss", "authenticated", "settings"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-2429-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "save_community_events_venues"}, {"name": "ARGS:ce_csv_import", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2429", "description": "Community Events <=1.5.8 authenticated (admin+) SQL injection via ce_venue_name CSV field in venue import", "method": "POST", "mode": "block", "severity": 4.9, "slug": "community-events", "tags": ["sql-injection", "csv-import", "authenticated"], "target": "plugin", "versions": "<=1.5.8"}, "RULE-CVE-2026-2431-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "cm-custom-reports"}, {"name": "ARGS:date_from", "type": "regex", "value": "~(?:<|>|\\"|\'|on[a-zA-Z0-9_]+[ ]*=|script|svg|img)~i"}], "cve": "CVE-2026-2431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2431", "description": "CM Custom Reports <=1.2.7 Reflected XSS via date_from parameter on admin reports page", "mode": "block", "severity": 6.1, "slug": "cm-custom-reports", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-2431-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:page", "type": "equals", "value": "cm-custom-reports"}, {"name": "ARGS:date_to", "type": "regex", "value": "~(?:<|>|\\"|\'|on[a-zA-Z0-9_]+[ ]*=|script|svg|img)~i"}], "cve": "CVE-2026-2431", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2431", "description": "CM Custom Reports <=1.2.7 Reflected XSS via date_to parameter on admin reports page", "mode": "block", "severity": 6.1, "slug": "cm-custom-reports", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=1.2.7"}, "RULE-CVE-2026-24353-01": {"ajax_action": "user_registration_membership_register_member", "conditions": [{"name": "ARGS:members_data", "type": "regex", "value": "~(?:administrator|editor|manage_options|delete_users|edit_users)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24353", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24353", "description": "User Registration <= 4.4.9 privilege escalation via membership registration allowing non-admin role assignment", "method": "POST", "mode": "block", "severity": 8.1, "slug": "user-registration", "tags": ["priv-esc", "role-assignment"], "target": "plugin", "versions": "<=4.4.9"}, "RULE-CVE-2026-24357-01": {"ajax_action": "wprm_reset_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_reset_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-02": {"ajax_action": "wprm_export_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_export_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-03": {"ajax_action": "wprm_import_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_import_settings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-04": {"ajax_action": "wprm_export_templates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_export_templates AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-05": {"ajax_action": "wprm_import_templates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_import_templates AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-06": {"ajax_action": "wprm_anonymize_ratings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_anonymize_ratings AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "data-manipulation"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-07": {"ajax_action": "wprm_analytics_export_csv", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_analytics_export_csv AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24357-08": {"ajax_action": "wprm_health_check", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24357", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24357", "description": "WP Recipe Maker <=10.2.4 missing authorization on wprm_health_check AJAX action", "mode": "block", "severity": 8.1, "slug": "wp-recipe-maker", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=10.2.4"}, "RULE-CVE-2026-24373-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~"}, {"name": "ARGS:form_id", "type": "exists"}, {"name": "ARGS:rm_user_role", "type": "regex", "value": "~(?:^|\\\\s)(?:administrator|editor|author|contributor)(?:\\\\s|$)~i"}], "cve": "CVE-2026-24373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24373", "description": "RegistrationMagic <=6.0.7.1 unauthenticated privilege escalation via rm_user_role parameter in registration form submission", "method": "POST", "mode": "block", "severity": 8.1, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=6.0.7.1"}, "RULE-CVE-2026-24374-01": {"ajax_action": "rm_activate_rm_user", "conditions": [{"name": "ARGS:user_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24374", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24374", "description": "RegistrationMagic <= 6.0.6.9 broken authentication on user activation allowing non-admin account takeover", "method": "POST", "mode": "block", "severity": 5.4, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.6.9"}, "RULE-CVE-2026-24377-01": {"ajax_action": "tpgb_get_template_content", "conditions": [{"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-24377", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24377", "description": "Nexter Blocks <=4.6.3 unauthenticated sensitive data exposure via tpgb_get_template_content AJAX handler", "mode": "block", "severity": 7.5, "slug": "the-plus-addons-for-block-editor", "tags": ["sensitive-data-exposure", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-24378-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-24378", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24378", "description": "EventPrime <=4.2.8.0 unauthenticated PHP object injection via eventprime_api AJAX handler", "mode": "block", "severity": 9.8, "slug": "eventprime-event-calendar-management", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8.0"}, "RULE-CVE-2026-24382-01": {"ajax_action": "newsx_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "activate_plugins"}], "cve": "CVE-2026-24382", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24382", "description": "News Magazine X <=1.2.50 unauthenticated plugin activation via newsx_activate_required_plugins AJAX handler", "mode": "block", "severity": 7.5, "slug": "news-magazine-x", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "theme", "versions": "<=1.2.50"}, "RULE-CVE-2026-24383-01": {"ajax_action": "bsbPosts", "conditions": [{"name": "ARGS:queryAttr", "type": "regex", "value": "~(?i)(</?[a-z][a-z0-9]*[\\\\s>]|<script|<img|onerror\\\\s*=|onload\\\\s*=|javascript:)~"}], "cve": "CVE-2026-24383", "method": "POST", "mode": "block", "severity": 6.5, "slug": "b-slider", "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2026-24385-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/podlove-web-player/(?:options|configs)(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24385", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24385", "description": "Podlove Web Player <=5.9.1 PHP Object Injection via unauthenticated REST options/configs endpoints", "method": "POST", "mode": "block", "severity": 7.5, "slug": "podlove-web-player", "tags": ["object-injection", "deserialization", "rest-api", "missing-authorization"], "target": "plugin", "versions": "<=5.9.1"}, "RULE-CVE-2026-24389-01": {"ajax_action": "pb_save_gallery", "conditions": [{"type": "missing_capability", "value": "unfiltered_html"}, {"name": "ARGS:gallery_data", "type": "regex", "value": "~custom_event_[a-z_]*[^}]*?(?:<script[\\\\s/>]|<img[^>]*onerror[\\\\s]*=|<svg[^>]*onload[\\\\s]*=|on(?:error|load|click|mouseover|focus|blur|toggle)[\\\\s]*=|=\\\\s*javascript\\\\s*:)~i"}], "cve": "CVE-2026-24389", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24389", "description": "Gallery PhotoBlocks <=1.3.2 stored XSS via custom event fields in gallery save for users without unfiltered_html capability", "mode": "block", "severity": 6.5, "slug": "photoblocks-grid-gallery", "tags": ["xss", "stored", "authenticated", "ajax"], "target": "plugin", "versions": "<=1.3.2"}, "RULE-CVE-2026-2440-01": {"ajax_action": "SurveyJS_SaveResult", "conditions": [{"name": "ARGS:Json", "type": "regex", "value": "~&(amp;)?#(?:x0*(?:3[cC]|3[eE]|2[27fF]|3[bB]|2[28fF]|2[29fF])|0*(?:60|62|34|39|59|40|41));~i"}], "cve": "CVE-2026-2440", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2440", "description": "SurveyJS <=2.5.3 stored XSS via HTML-entity-encoded payloads in Json survey result submissions", "method": "POST", "mode": "block", "severity": 7.2, "slug": "surveyjs", "tags": ["xss", "stored-xss", "unauthenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-2442-01": {"ajax_action": "pagelayer_contact_submit", "conditions": [{"name": "ARGS:/pagelayer_name|pagelayer_email|pagelayer_subject|pagelayer_message/", "type": "regex", "value": "~[\\\\r\\\\n]~"}], "cve": "CVE-2026-2442", "description": "PageLayer <=2.0.7 CRLF injection via contact form submission allows email header injection", "mode": "block", "severity": 5.3, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-2448-01": {"ajax_action": "so_panels_live_editor_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in live editor preview", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-2448-02": {"ajax_action": "so_panels_layout_block_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in layout block preview", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-2448-03": {"ajax_action": "so_panels_builder_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:[.][.][/\\\\\\\\]|[.][.][%](?:2[fF]|5[cC])|%2e%2e[%2f%5c\\\\\\\\]|%252e%252e[%2f%5c\\\\\\\\%]|\\\\\\\\u002e\\\\\\\\u002e(?:\\\\\\\\u002[fF]|\\\\\\\\u005[cC]))~i"}], "cve": "CVE-2026-2448", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2448", "description": "Page Builder by SiteOrigin <=2.33.5 Local File Inclusion via path traversal in builder content", "method": "POST", "mode": "block", "severity": 8.8, "slug": "siteorigin-panels", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=2.33.5"}, "RULE-CVE-2026-24523-01": {"ajax_action": "WP_FullCalendar", "conditions": [{"name": "ARGS:type", "type": "equals", "value": "attachment"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-24523", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24523", "description": "WP FullCalendar <=1.6 unauthenticated attachment enumeration via WP_FullCalendar AJAX action with type=attachment", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-fullcalendar", "tags": ["sensitive-data-exposure", "information-disclosure", "ajax", "unauthenticated"], "target": "plugin", "versions": "<=1.6"}, "RULE-CVE-2026-24524-01": {"ajax_action": "store_tablesome_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on store_tablesome_data AJAX handler allows low-privilege users to modify table data", "method": "POST", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24524-02": {"ajax_action": "get_tables_data", "conditions": [{"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on get_tables_data AJAX handler allows low-privilege users to read all table data", "method": "GET", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24524-03": {"ajax_action": "get_table_columns", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24524", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24524", "description": "Tablesome <1.2.4 missing authorization on get_table_columns AJAX handler allows low-privilege users to read table column metadata", "method": "GET", "mode": "block", "severity": 8.1, "slug": "tablesome", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<1.2.4"}, "RULE-CVE-2026-24525-01": {"action": "admin_init", "conditions": [{"name": "ARGS:clp-varnish-cache", "type": "equals", "value": "purge-entire-cache"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24525", "description": "CLP Varnish Cache <=1.0.2 unauthenticated cache purge via missing authorization on clp-varnish-cache GET parameter", "mode": "block", "severity": 5.3, "slug": "clp-varnish-cache", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-24526-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-json/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~a3blocks/product-inquiry-button[^}]*\\"(?:textAlign|width)\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|%3C|>|%3E)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24526-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "regex", "value": "~^(?:editpost|edit_post)$~i"}, {"name": "ARGS:post_content", "type": "regex", "value": "~<!--\\\\s*wp:a3blocks/product-inquiry-button\\\\b[^>]*\\\\{[^}]*\\"(?:textAlign|width)\\"\\\\s*:\\\\s*\\"[^\\"]*(?:<|%3C|>|%3E)[^\\"]*\\"[^}]*\\\\}[^>]*-->~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24526", "cve_link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24526", "description": "Stored XSS via unescaped Gutenberg block attributes (textAlign/width) in product-inquiry-button block render callback", "method": "POST", "mode": "block", "severity": 6.5, "slug": "woocommerce-email-inquiry-cart-options", "tags": ["xss", "stored-xss", "gutenberg-block", "woocommerce"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-24529-01": {"ajax_action": "cancel", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on cancel AJAX action allows authenticated users to cancel bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-02": {"ajax_action": "confirm_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on confirm_email AJAX action allows authenticated users to confirm bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-03": {"ajax_action": "pending_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on pending_email AJAX action allows authenticated users to set bookings to pending", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24529-04": {"ajax_action": "reject_email", "conditions": [{"name": "ARGS:post_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-24529", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24529", "description": "Quick Restaurant Reservations <=1.6.7 missing authorization on reject_email AJAX action allows authenticated users to reject bookings", "method": "POST", "mode": "block", "severity": 5.3, "slug": "quick-restaurant-reservations", "tags": ["missing-authorization", "broken-access-control", "idor"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-24532-01": {"ajax_action": "sitelock_scan", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_scan AJAX handler allows subscribers to trigger scans", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24532-02": {"ajax_action": "sitelock_dismiss_notice", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24532", "description": "SiteLock Security <=5.0.2 missing authorization on sitelock_dismiss_notice AJAX handler allows subscribers to dismiss admin notices", "method": "POST", "mode": "block", "severity": 4.3, "slug": "sitelock", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-24565-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=bab_Dashboard~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24565", "mode": "block", "severity": 6.5, "slug": "b-accordion", "target": "plugin", "versions": "<=2.0.2"}, "RULE-CVE-2026-24572-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nelio-content/v1/posts(/|\\\\?|$)~"}, {"name": "ARGS:searchTerm", "type": "regex", "value": "~(?:\'[ \\\\t]*(?:OR|AND)[ \\\\t]+[0-9]|UNION[ \\\\t]+(?:ALL[ \\\\t]+)?SELECT|\'[ \\\\t]*(?:--|#)|SLEEP[ \\\\t]*\\\\(|BENCHMARK[ \\\\t]*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24572", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24572", "description": "Nelio Content <=4.2.0 authenticated (Contributor+) SQL injection via searchTerm in REST posts endpoint", "method": "GET", "mode": "block", "severity": 8.8, "slug": "nelio-content", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-24596-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "relpoststh_options"}, {"name": "ARGS", "type": "regex", "value": "~(?:</style|<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|expression\\\\s*\\\\()~i"}], "cve": "CVE-2026-24596", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24596", "description": "Related Posts Thumbnails <=4.3.2 CSRF to stored XSS via unsanitized plugin settings in head_style output", "method": "POST", "mode": "block", "severity": 4.7, "slug": "related-posts-thumbnails", "tags": ["csrf", "stored-xss", "settings-update"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-24616-01": {"ajax_action": "wppopups_settings_provider_add", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_add AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24616-02": {"ajax_action": "wppopups_settings_provider_disconnect", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24616", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24616", "description": "WP Popups <=2.2.0.5 missing authorization on wppopups_settings_provider_disconnect AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wp-popups-lite", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.2.0.5"}, "RULE-CVE-2026-24623-01": {"action": "init", "conditions": [{"name": "ARGS:forum", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via forum parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-02": {"action": "init", "conditions": [{"name": "ARGS:topic", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 unauthenticated reflected XSS via topic parameter in shortcode rendering", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24623-03": {"ajax_action": "neoforum_get_new_topic_form", "conditions": [{"name": "ARGS:forumid", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-24623", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24623", "description": "NeoForum <=1.0 authenticated reflected XSS via forumid parameter in neoforum_get_new_topic_form AJAX handler", "mode": "block", "severity": 6.5, "slug": "neoforum", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-01": {"ajax_action": "neoforum_close_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in close_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-02": {"ajax_action": "neoforum_restrict_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in restrict_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-03": {"ajax_action": "neoforum_delete_forum", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in delete_forum AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-04": {"ajax_action": "neoforum_edit_forum_title", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_title AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-05": {"ajax_action": "neoforum_edit_forum_descr", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:SLEEP\\\\s*[(]|BENCHMARK\\\\s*[(]|UNION\\\\s+(?:ALL\\\\s+)?SELECT|(?:^|[^a-zA-Z0-9_])(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via data in edit_forum_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-06": {"ajax_action": "neoforum_delete_moderators", "conditions": [{"name": "ARGS:type", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via type in delete_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-07": {"ajax_action": "neoforum_add_moderators", "conditions": [{"name": "ARGS:forumid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via forumid in add_moderators AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-08": {"ajax_action": "neoforum_topic_restore", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-09": {"ajax_action": "neoforum_topic_eradicate", "conditions": [{"name": "ARGS:topicid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via topicid in topic_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-10": {"ajax_action": "neoforum_post_restore", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_restore AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-11": {"ajax_action": "neoforum_post_eradicate", "conditions": [{"name": "ARGS:postid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via postid in post_eradicate AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-12": {"ajax_action": "neoforum_report_leave_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_leave_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-13": {"ajax_action": "neoforum_report_delete_post", "conditions": [{"name": "ARGS:reportid", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via reportid in report_delete_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-14": {"ajax_action": "neoforum_ban_user", "conditions": [{"name": "ARGS:ban", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via ban in ban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-15": {"ajax_action": "neoforum_unban_user", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in unban_user AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-16": {"ajax_action": "neoforum_make_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in make_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-17": {"ajax_action": "neoforum_remove_admin", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in remove_admin AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-18": {"ajax_action": "neoforum_delete_topic", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated blind SQL injection via id in delete_topic AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24624-19": {"ajax_action": "neoforum_theme_descr", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/\\\\\\\\]){2,}|[\\\\/\\\\\\\\]etc[\\\\/\\\\\\\\]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-24624", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24624", "description": "Neoforum <=1.0 authenticated local file inclusion via theme in theme_descr AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "neoforum", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.0"}, "RULE-CVE-2026-24637-01": {"ajax_action": "powerpress_media_info", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24637", "description": "Blocks unauthenticated/low-privilege SQL injection via powerpress_media_info AJAX handler (CWE-89, Contributor+ SQLi in PowerPress <= 11.15.10). Requires edit_posts capability, mirroring the vendor patch.", "mode": "block", "severity": 8.5, "slug": "powerpress", "target": "plugin", "versions": "<=11.15.10"}, "RULE-CVE-2026-2471-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OC]:\\\\d+:\\"[^\\"]*\\":\\\\d+:\\\\{~"}], "cve": "CVE-2026-2471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2471", "description": "WP Mail Logging <=1.15.0 unauthenticated PHP Object Injection via serialized object payload in form fields logged by wp_mail hook", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-mail-logging", "tags": ["object-injection", "deserialization", "unauthenticated", "stored-payload"], "target": "plugin", "versions": "<=1.15.0"}, "RULE-CVE-2026-2479-01": {"ajax_action": "rl_upload_image", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2479", "description": "Responsive Lightbox & Gallery <=2.7.1 SSRF via strpos()-based hostname bypass in rl_upload_image AJAX handler", "method": "POST", "mode": "block", "severity": 5.0, "slug": "responsive-lightbox", "tags": ["ssrf", "hostname-bypass", "authenticated"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-2486-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ma_el_bh_table_btn_text[\\\\\\"\']\\\\s*:\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:<[^>]+\\\\bon\\\\w+\\\\s*=|javascript\\\\s*:|<iframe\\\\b|<embed\\\\b|<object\\\\b)~i"}], "cve": "CVE-2026-2486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2486", "description": "Master Addons for Elementor <=2.1.1 Stored XSS via ma_el_bh_table_btn_text in Elementor AJAX save (event handler vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "master-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-2486-02": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS:actions", "type": "regex", "value": "~ma_el_bh_table_btn_text[\\\\\\"\']\\\\s*:\\\\s*[\\\\\\"\'][^\\\\\\"\']*<script\\\\b~i"}], "cve": "CVE-2026-2486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2486", "description": "Master Addons for Elementor <=2.1.1 Stored XSS via ma_el_bh_table_btn_text in Elementor AJAX save (script tag vector)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "master-addons", "tags": ["xss", "stored-xss", "elementor-widget"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-2489-01": {"ajax_action": "tp2wp_importer_attachments", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|video|audio|math|details|body|form|input|link|style|base|meta|a)[^a-zA-Z0-9](?:[^>]*(?:on[a-zA-Z]+=|(?:href|src|action|formaction|data) *= *[\\"\']? *(?:javascript|data|vbscript) *:))?~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2489", "description": "TP2WP Importer <=1.1 Authenticated (Administrator+) Stored XSS via Watched Domains AJAX handler", "method": "POST", "mode": "block", "severity": 4.4, "slug": "tp2wp-importer", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1"}, "RULE-CVE-2026-2495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/WPNakama/v1/boards(?:[/?&]|$)~i"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(.*,|CASE\\\\s+WHEN|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s|\\\\(\\\\s*SELECT\\\\s)~i"}], "cve": "CVE-2026-2495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2495", "description": "WPNakama <=0.6.5 unauthenticated SQL injection via order parameter on /WPNakama/v1/boards REST endpoint", "mode": "block", "severity": 7.5, "slug": "wpnakama", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=0.6.5"}, "RULE-CVE-2026-24950-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/authorsy/v1/authors(?:/|$|\\\\?)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24950", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24950", "description": "Authorsy <=1.0.6 unauthenticated access to REST API author endpoints leaking sensitive user data (IDOR)", "method": "GET", "mode": "block", "severity": 7.5, "slug": "authorsy", "tags": ["missing-authorization", "idor", "information-disclosure", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-24952-01": {"ajax_action": "update_episode_embed_code", "conditions": [{"name": "ARGS:width", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>]|<iframe[\\\\s/>]|<img\\\\b[^>]*\\\\bon[a-z]+\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-24952", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24952", "description": "Seriously Simple Podcasting <=3.14.1 authenticated XSS via width parameter in update_episode_embed_code AJAX handler", "method": "POST", "mode": "block", "severity": 6.5, "slug": "seriously-simple-podcasting", "tags": ["xss", "authenticated", "ajax"], "target": "plugin", "versions": "<=3.14.1"}, "RULE-CVE-2026-24954-01": {"ajax_action": "mpwem_save_faq", "conditions": [{"name": "ARGS:/^mep_faq/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_faq AJAX handler (question/answer fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-02": {"ajax_action": "mpwem_save_timeline", "conditions": [{"name": "ARGS:/^mep_timeline_details/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via mpwem_save_timeline AJAX handler (title/desc fields)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_speaker_list", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_speaker_list)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-04": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:mep_event_cc_email_text", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_event_cc_email_text)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24954-05": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:/^mep_ev_more_date/", "type": "regex", "value": "~[OC]:[0-9]+:\\"~"}], "cve": "CVE-2026-24954", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24954", "description": "WpEvently <=5.0.8 PHP Object Injection via save_post meta fields (mep_ev_more_date)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "mage-eventpress", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=5.0.8"}, "RULE-CVE-2026-24956-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wpdm-elementor/v1/search-packages(/|\\\\?|&|$)~"}, {"name": "ARGS:term", "type": "regex", "value": "~(?:union(?:/[*][^*]*[*]/|[+[:space:]])+(?:all(?:/[*][^*]*[*]/|[+[:space:]])+)?select|select(?:/[*][^*]*[*]/|[+[:space:]])+.*from|(?:sleep|benchmark)[[:space:]]*[(]|waitfor(?:/[*][^*]*[*]/|[+[:space:]])+delay|load_file[[:space:]]*[(]|into(?:/[*][^*]*[*]/|[+[:space:]])+(?:outfile|dumpfile)|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[0-9]+[[:space:]]*=[[:space:]]*[0-9]+|[\\"\'`]?[[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]+[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`][^\\"\'`]+[\\"\'`]|[\\"\'`][[:space:]]*(?:or|and)(?:/[*][^*]*[*]/|[+[:space:]])+[\\"\'`][^\\"\'`]*[\\"\'`][[:space:]]*=[[:space:]]*[\\"\'`])~i"}], "cve": "CVE-2026-24956", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24956", "description": "Download Manager Addons for Elementor <=1.3.0 blind SQL injection via term parameter in search-packages REST endpoint", "method": "GET", "mode": "block", "severity": 9.3, "slug": "wpdm-elementor", "tags": ["sql-injection", "blind-sqli", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.3.0"}, "RULE-CVE-2026-24957-01": {"ajax_action": "wpmtst_add_field", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-02": {"ajax_action": "wpmtst_add_field_2", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_2 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-03": {"ajax_action": "wpmtst_add_field_3", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_3 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24957-04": {"ajax_action": "wpmtst_add_field_4", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:nextKey", "type": "exists"}], "cve": "CVE-2026-24957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24957", "description": "Strong Testimonials <=3.2.20 broken access control on wpmtst_add_field_4 via nextKey parameter", "method": "POST", "mode": "block", "severity": 6.5, "slug": "strong-testimonials", "tags": ["broken-access-control", "missing-authorization", "ajax"], "target": "plugin", "versions": "<=3.2.20"}, "RULE-CVE-2026-24959-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via id parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-24959-02": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:status", "type": "regex", "value": "~[0-9]+[ ]+(?:AND|OR|UNION)[ (]+~i"}], "cve": "CVE-2026-24959", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24959", "description": "JS Help Desk <=3.0.1 authenticated blind SQL injection via status parameter in jsticket_ajax AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "js-support-ticket", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.0.1"}, "RULE-CVE-2026-2498-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_admins", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_admins settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_app_id", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_app_id settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_site", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_site settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_fb_type", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_fb_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_tw_card", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_tw_card settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-2498-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpsm_gp_type", "type": "regex", "value": "~<script[\\\\s>]|\\\\bon[a-z]+\\\\s*=|javascript\\\\s*:|<iframe[\\\\s>]|<svg[\\\\s>]~i"}], "cve": "CVE-2026-2498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2498", "description": "WP Social Meta <=4.1.1 Stored XSS via wpsm_gp_type settings field (options.php)", "method": "POST", "mode": "block", "severity": 4.4, "slug": "wp-social-meta", "tags": ["xss", "stored-xss", "admin-settings"], "target": "plugin", "versions": "<=4.1.1"}, "RULE-CVE-2026-24984-01": {"ajax_action": "vlp_get_post_content", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-24984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-24984", "description": "Visual Link Preview <=2.2.9 missing authorization on vlp_get_post_content allows unauthorized post content disclosure", "mode": "block", "severity": 6.5, "slug": "visual-link-preview", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=2.2.9"}, "RULE-CVE-2026-2499-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:wpcl_custom_logo_path", "type": "regex", "value": "~(<script|</style|javascript:|on(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-2499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2499", "description": "Custom Logo <=2.2 Authenticated (Administrator+) Stored XSS via wpcl_custom_logo_path setting", "method": "POST", "mode": "block", "severity": 4.4, "slug": "custom-logo", "tags": ["xss", "stored-xss", "settings-api"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-24990-01": {"ajax_action": "wpdocs_create_folder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24990", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2026-24990-02": {"ajax_action": "wpdocs_delete_folder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-24990", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-docs", "target": "plugin", "versions": "<=2.2.8"}, "RULE-CVE-2026-25001-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[post_snippets[^\\\\]]*(?:(?:eval|assert|system|exec|include|require)\\\\s*\\\\(|passthru\\\\s*\\\\(|shell_exec\\\\s*\\\\(|popen\\\\s*\\\\(|proc_open\\\\s*\\\\(|pcntl_exec\\\\s*\\\\(|base64_decode\\\\s*\\\\(|file_(?:get_contents|put_contents)\\\\s*\\\\(|unserialize\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-25001", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25001", "description": "Post Snippets <=4.0.12 authenticated (Contributor+) Remote Code Execution via shortcode PHP eval of attacker-controlled attributes", "mode": "block", "severity": 8.5, "slug": "post-snippets", "tags": ["remote-code-execution", "code-injection", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.0.12"}, "RULE-CVE-2026-25002-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/learnpress-sepay/v1/webhook(?:[/?]|$)~"}, {"name": "REQUEST_HEADERS:Authorization", "type": "regex", "value": "~^.{1,31}$~"}], "cve": "CVE-2026-25002", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25002", "description": "LearnPress - Sepay Payment <=4.0.0 broken authentication on webhook REST endpoint via substring API key matching", "method": "POST", "mode": "block", "severity": 7.5, "slug": "learnpress-sepay-payment", "tags": ["broken-authentication", "rest-api", "unauthenticated", "payment-bypass"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-25007-01": {"ajax_action": "elementinvader_addons_for_elementor_forms_send_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT(?:[\\\\s(]|$)|;\\\\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\\\\b|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|[\'\\\\\\")]+\\\\s*(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|OR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+))~i"}], "cve": "CVE-2026-25007", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25007", "description": "ElementInvader Addons for Elementor <=1.4.2 SQL injection via forms AJAX handler", "mode": "block", "severity": 8.6, "slug": "elementinvader-addons-for-elementor", "tags": ["sql-injection", "unauthenticated", "forms"], "target": "plugin", "versions": "<=1.4.2"}, "RULE-CVE-2026-2502-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:X-Forwarded-For", "type": "detectXSS"}], "cve": "CVE-2026-2502", "mode": "block", "severity": 6.1, "slug": "xmlrpc-attacks-blocker", "target": "plugin", "versions": "<1.1"}, "RULE-CVE-2026-25022-01": {"ajax_action": "ajax_post", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "static_data"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|SELECT[ ]+.{0,200}FROM[ ]+|(?:AND|OR)[ ]+[0-9]+[ ]*=[ ]*[0-9]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(][ ]*\\\\~[ ]*|(?:AND|OR)[ ]+(?:IF|CASE)[ ]*[(])~i"}], "cve": "CVE-2026-25022", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25022", "description": "KiviCare Clinic Management System <=3.6.16 SQL injection via ajax_post dispatcher (static_data route)", "method": "POST", "mode": "block", "severity": 8.5, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25022-02": {"ajax_action": "ajax_get", "conditions": [{"name": "ARGS:route_name", "type": "equals", "value": "static_data"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION[ ]+(?:ALL[ ]+)?SELECT|SELECT[ ]+.{0,200}FROM[ ]+|(?:AND|OR)[ ]+[0-9]+[ ]*=[ ]*[0-9]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|EXP[ ]*[(][ ]*\\\\~[ ]*|(?:AND|OR)[ ]+(?:IF|CASE)[ ]*[(])~i"}], "cve": "CVE-2026-25022", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25022", "description": "KiviCare Clinic Management System <=3.6.16 SQL injection via ajax_get dispatcher (static_data route)", "method": "GET", "mode": "block", "severity": 8.5, "slug": "kivicare-clinic-management-system", "tags": ["sql-injection", "ajax"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25025-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/admin-ajax\\\\.php)~"}, {"name": "ARGS:action", "type": "equals", "value": "vikrestaurants"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/]on)~i"}], "cve": "CVE-2026-25025", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25025", "description": "VikRestaurants <=1.5.2 unauthenticated reflected XSS via vikrestaurants AJAX handler", "mode": "block", "severity": 7.1, "slug": "vikrestaurants", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.5.2"}, "RULE-CVE-2026-25026-01": {"ajax_action": "tlp_team_smart_popup", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25026", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25026", "description": "Team Plugin <=5.0.11 missing authorization on tlp_team_smart_popup allows unauthenticated/subscriber access to team member popup data", "mode": "block", "severity": 7.5, "slug": "tlp-team", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=5.0.11"}, "RULE-CVE-2026-25026-02": {"ajax_action": "tlp_md_popup_single", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25026", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25026", "description": "Team Plugin <=5.0.11 missing authorization on tlp_md_popup_single allows unauthenticated/subscriber access to team member modal data", "mode": "block", "severity": 7.5, "slug": "tlp-team", "tags": ["missing-authorization", "broken-access-control", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=5.0.11"}, "RULE-CVE-2026-25030-01": {"ajax_action": "ideapark_wishlist_toggle", "conditions": [{"name": "REQUEST_COOKIES:ideapark_wishlist", "type": "regex", "value": "~^(?:[OC]:[0-9]+:\\"|a:[0-9]+:\\\\{)~"}], "cve": "CVE-2026-25030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25030", "description": "Goldish <=3.45 unauthenticated PHP object injection via ideapark_wishlist cookie", "mode": "block", "severity": 9.8, "slug": "goldish", "tags": ["object-injection", "deserialization", "unauthenticated", "cookie-injection"], "target": "theme", "versions": "<=3.45"}, "RULE-CVE-2026-2504-01": {"ajax_action": "dealia_ajax_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_reset AJAX handler allowing Contributor+ plugin configuration reset", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "settings-reset"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-02": {"ajax_action": "dealia_ajax_login", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_login AJAX handler allowing Contributor+ API credential hijack", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "credential-hijack"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-03": {"ajax_action": "dealia_ajax_manage_account", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_manage_account AJAX handler allowing Contributor+ external account creation", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "account-creation"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-04": {"ajax_action": "dealia_save_additional_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_save_additional_settings AJAX handler allowing Contributor+ settings modification", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "settings-modification"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-05": {"ajax_action": "dealia_ajax_refresh", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_ajax_refresh AJAX handler allowing Contributor+ token refresh", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "token-refresh"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2504-06": {"ajax_action": "dealia_get_forms", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2504", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504", "description": "Dealia - Request a Quote <=1.0.7 missing authorization on dealia_get_forms AJAX handler allowing Contributor+ information disclosure", "method": "POST", "mode": "block", "severity": 4.3, "slug": "dealia-request-a-quote", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=1.0.7"}, "RULE-CVE-2026-2506-01": {"action": "init", "conditions": [{"name": "ARGS:customer_name", "type": "exists"}, {"name": "ARGS:customer_name", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 unauthenticated stored XSS via customer_name in front-end order form", "method": "POST", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2506-02": {"action": "admin_init", "conditions": [{"name": "ARGS:cpage", "type": "exists"}, {"name": "ARGS:cpage", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>~i"}], "cve": "CVE-2026-2506", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2506", "description": "EM Cost Calculator <=2.3.1 reflected XSS via cpage parameter on admin Customers page", "method": "GET", "mode": "block", "severity": 6.1, "slug": "cost-calculator", "tags": ["xss", "reflected-xss"], "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-2509-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?<![a-zA-Z])on(?:pointer(?:over|enter|leave|down|up|move|out|cancel|rawupdate)|animation(?:end|start|iteration|cancel)|transition(?:end|run|start|cancel)|focus(?:in|out)|auxclick|toggle|beforeinput|formdata|reset|select(?:start)?|gotpointercapture|lostpointercapture|webkitanimation(?:end|start|iteration)|webkittransitionend|touch(?:start|end|move|cancel)|wheel|contextmenu|drag(?:start|end|over|enter|leave)|drop|before(?:copy|cut|paste|toggle)|scrollend|securitypolicyviolation)\\\\s*=~i"}], "cve": "CVE-2026-2509", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2509", "description": "Pagelayer <=2.0.8 contributor+ stored XSS via incomplete event handler blocklist in Button widget custom_attributes (pagelayer_save_content)", "mode": "block", "severity": 6.4, "slug": "pagelayer", "tags": ["xss", "stored", "authenticated", "incomplete-sanitization"], "target": "plugin", "versions": "<=2.0.8"}, "RULE-CVE-2026-2509-02": {"ajax_action": "pagelayer_save_templ_content", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?<![a-zA-Z])on(?:pointer(?:over|enter|leave|down|up|move|out|cancel|rawupdate)|animation(?:end|start|iteration|cancel)|transition(?:end|run|start|cancel)|focus(?:in|out)|auxclick|toggle|beforeinput|formdata|reset|select(?:start)?|gotpointercapture|lostpointercapture|webkitanimation(?:end|start|iteration)|webkittransitionend|touch(?:start|end|move|cancel)|wheel|contextmenu|drag(?:start|end|over|enter|leave)|drop|before(?:copy|cut|paste|toggle)|scrollend|securitypolicyviolation)\\\\s*=~i"}], "cve": "CVE-2026-2509", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2509", "description": "Pagelayer <=2.0.8 contributor+ stored XSS via incomplete event handler blocklist in Button widget custom_attributes (pagelayer_save_templ_content)", "mode": "block", "severity": 6.4, "slug": "pagelayer", "tags": ["xss", "stored", "authenticated", "incomplete-sanitization"], "target": "plugin", "versions": "<=2.0.8"}, "RULE-CVE-2026-2511-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:multiformid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bAND\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-2511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2511", "description": "JS Support Ticket <=3.0.4 unauthenticated SQL injection via multiformid parameter in jsticket_ajax AJAX handler", "mode": "block", "severity": 7.5, "slug": "js-support-ticket", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-2511-02": {"action": "init", "conditions": [{"name": "ARGS:multiformid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\bOR\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bAND\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-2511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2511", "description": "JS Support Ticket <=3.0.4 unauthenticated SQL injection via multiformid parameter in frontend form submission", "mode": "block", "severity": 7.5, "slug": "js-support-ticket", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-2519-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:action", "type": "regex", "value": "~^bookly[a-z0-9_-]*~i"}, {"name": "ARGS:tips", "type": "regex", "value": "~^\\\\s*(?:-|%2[Dd]|\\\\xe2\\\\x88\\\\x92)\\\\s*[0-9]+(?:\\\\.[0-9]+)?(?:[eE]-?[0-9]+)?\\\\s*$~"}], "cve": "CVE-2026-2519", "description": "Bookly <=27.0 unauthenticated price manipulation via negative tips parameter (CWE-472)", "method": "POST", "mode": "block", "severity": 5.3, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.0"}, "RULE-CVE-2026-25309-01": {"ajax_action": "ppma_block_fetch_author_boxes", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25309", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25309", "description": "PublishPress Authors <=4.10.1 unauthenticated access to author box editor preview via ppma_block_fetch_author_boxes", "mode": "block", "severity": 7.5, "slug": "publishpress-authors", "tags": ["missing-authorization", "broken-access-control", "information-disclosure", "unauthenticated"], "target": "plugin", "versions": "<=4.10.1"}, "RULE-CVE-2026-25345-01": {"ajax_action": "pgc_sgb_action_wizard", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25345", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25345", "description": "Simply Gallery Block <=3.3.2 unauthorized access to pgc_sgb_action_wizard AJAX handler", "mode": "block", "severity": 9.9, "slug": "simply-gallery-block", "tags": ["arbitrary-code-execution", "missing-authorization", "rce"], "target": "plugin", "versions": "<=3.3.2"}, "RULE-CVE-2026-25346-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "faq-builder-ays"}, {"name": "ARGS:faq", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25346", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25346", "description": "FAQ Builder AYS <=1.8.3 reflected XSS via faq parameter in admin page", "mode": "block", "severity": 7.1, "slug": "faq-builder-ays", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=1.8.3"}, "RULE-CVE-2026-25361-01": {"ajax_action": "mep_event_list_date_schedule", "conditions": [{"name": "ARGS:event_id", "type": "regex", "value": "~(?:<script[^a-zA-Z]|on(?:error|load|mouseover|click|focus|blur)[ \\\\t]*=|javascript[ \\\\t]*:|<(?:img|svg|iframe|object|embed|video|audio|details|math)[^a-zA-Z])~i"}], "cve": "CVE-2026-25361", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25361", "description": "WPEvently <=5.1.4 unauthenticated reflected XSS via event_id in mep_event_list_date_schedule AJAX handler", "mode": "block", "severity": 7.1, "slug": "mage-eventpress", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-25369-02": {"action": "init", "conditions": [{"name": "ARGS:search_referral_url", "type": "regex", "value": "~(?:on(?:load|error|mouseover|click|focus)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25369", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25369", "description": "Flexmls IDX <=3.15.9 reflected XSS via unsanitized search_referral_url on listing details pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "flexmls-idx", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=3.15.9"}, "RULE-CVE-2026-25383-01": {"action": "init", "conditions": [{"name": "ARGS:page_url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|video|audio|body|details|math|marquee|isindex|form|input|button|select|textarea|keygen|frameset)\\\\b[^>]*\\\\bon[a-z]+=)~i"}], "cve": "CVE-2026-25383", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25383", "description": "KiviCare Clinic Management System <=3.6.16 unauthenticated reflected XSS via page_url parameter in popupBookAppointment template", "mode": "block", "severity": 7.1, "slug": "kivicare-clinic-management-system", "tags": ["xss", "reflected", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=3.6.16"}, "RULE-CVE-2026-25396-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "ccwc_hide_notice"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25396", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25396", "description": "Commerce Coinbase for WooCommerce <=1.6.7 missing authorization on ccwc_hide_notice admin-post action allows subscriber+ option update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "commerce-coinbase-for-woocommerce", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.6.7"}, "RULE-CVE-2026-25418-01": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-02": {"ajax_action": "bitforms_get_form_entries", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_get_form_entries AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-03": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-04": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-05": {"ajax_action": "bitforms_get_entries_for_report", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_get_entries_for_report AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-06": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:orderBy", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via orderBy parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-07": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:order", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via order parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-08": {"ajax_action": "bitforms_filter_export_data", "conditions": [{"name": "ARGS:fields", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via fields parameter in bitforms_filter_export_data AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-09": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:id", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via id parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-10": {"ajax_action": "bitforms_form_log_history", "conditions": [{"name": "ARGS:offset", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via offset parameter in bitforms_form_log_history AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25418-11": {"ajax_action": "bitforms_entry_status_update", "conditions": [{"name": "ARGS:entryID", "type": "detectSQLi"}], "cve": "CVE-2026-25418", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25418", "description": "Bit Form <=2.21.10 SQL injection via entryID parameter in bitforms_entry_status_update AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "bit-form", "tags": ["sql-injection", "authenticated", "admin-ajax"], "target": "plugin", "versions": "<=2.21.10"}, "RULE-CVE-2026-25429-01": {"ajax_action": "nexa_load_more_posts", "conditions": [{"name": "ARGS:attributes", "type": "regex", "value": "~(?:[OC]:[0-9]+:[\\"\\\\{]|(?:Tzo|Qzo)[0-9A-Za-z+/]*[=]{0,2})~"}], "cve": "CVE-2026-25429", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25429", "description": "Nexa Blocks <=1.1.1 unauthenticated PHP object injection via base64-encoded attributes parameter in nexa_load_more_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "nexa-blocks", "tags": ["object-injection", "deserialization", "unauthenticated", "php-object-injection"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-25430-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^log_detail_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on log_detail AJAX action allows subscriber+ to read CRM logs and trigger reflected XSS", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^review_dismiss_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing authorization on review_dismiss AJAX action allows subscriber+ to toggle admin notice state", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25430-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^get_objects_[A-Za-z0-9_-]+$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25430", "description": "CF7 Mailchimp <=1.2.2 missing capability check on get_objects AJAX action allows subscriber+ to enumerate CRM objects", "mode": "block", "severity": 6.5, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-25435-01": {"ajax_action": "wpdevart_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|focus|blur|toggle|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25435", "description": "Booking Calendar <=3.2.36 unauthenticated stored XSS via wpdevart_id in wpdevart_ajax handler", "mode": "block", "severity": 7.1, "slug": "booking-calendar", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.2.36"}, "RULE-CVE-2026-25435-02": {"ajax_action": "wpdevart_form_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|focus|blur|toggle|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25435", "description": "Booking Calendar <=3.2.36 unauthenticated stored XSS via wpdevart_id in wpdevart_form_ajax handler", "mode": "block", "severity": 7.1, "slug": "booking-calendar", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.2.36"}, "RULE-CVE-2026-25435-03": {"ajax_action": "wpdevart_payment_ajax", "conditions": [{"name": "ARGS:wpdevart_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|<svg[\\\\s/>]|<img[\\\\s/]|<details[\\\\s/]|on(?:error|load|click|focus|blur|toggle|mouseover)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25435", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25435", "description": "Booking Calendar <=3.2.36 unauthenticated stored XSS via wpdevart_id in wpdevart_payment_ajax handler", "mode": "block", "severity": 7.1, "slug": "booking-calendar", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.2.36"}, "RULE-CVE-2026-25438-01": {"ajax_action": "unlimited_section_post_category_layout_block", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_category_layout_block AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-02": {"ajax_action": "unlimited_section_post_category_layout_choose_category", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_category_layout_choose_category AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-03": {"ajax_action": "unlimited_section_post_image_five_post", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_image_five_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-04": {"ajax_action": "unlimited_section_post_image_four_post", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_image_four_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-05": {"ajax_action": "unlimited_section_post_image_three_post", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_image_three_post AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-06": {"ajax_action": "unlimited_section_post_layout_grid", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_layout_grid AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25438-07": {"ajax_action": "unlimited_section_post_layout_list", "conditions": [{"name": "ARGS:attr", "type": "regex", "value": "~(?:<[a-zA-Z!/]|on[a-zA-Z]{3,}[ ]*=|javascript[ ]*:|\\\\\\\\u003[cC]|%3[cC])~i"}], "cve": "CVE-2026-25438", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25438", "description": "Unlimited Blocks <=1.2.8 reflected XSS via attr parameter in post_layout_list AJAX handler", "method": "POST", "mode": "block", "severity": 7.1, "slug": "unlimited-blocks", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.8"}, "RULE-CVE-2026-25447-01": {"ajax_action": "widget_wrangler_preview", "conditions": [{"name": "ARGS:form_state", "type": "regex", "value": "~(\\\\beval\\\\b|\\\\bsystem\\\\b|shell_exec|\\\\bexec\\\\b|base64_decode|passthru|popen|proc_open|call_user_func|create_function|O:[0-9]+:|<\\\\?php)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25447", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25447", "description": "Widget Wrangler <=2.3.9 code injection via form_state in widget_wrangler_preview AJAX handler", "mode": "block", "severity": 9.1, "slug": "widget-wrangler", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": ">=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25447-02": {"ajax_action": "ww_form_ajax", "conditions": [{"name": "ARGS:context", "type": "regex", "value": "~(\\\\beval\\\\b|\\\\bsystem\\\\b|shell_exec|\\\\bexec\\\\b|base64_decode|passthru|popen|proc_open|call_user_func|create_function|O:[0-9]+:|<\\\\?php)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-25447", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25447", "description": "Widget Wrangler <=2.3.9 code injection via context in ww_form_ajax AJAX handler", "mode": "block", "severity": 9.1, "slug": "widget-wrangler", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": ">=2.0.0 <=2.3.9"}, "RULE-CVE-2026-25452-01": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:\\\\b(?:AND|OR)\\\\b(?:/\\\\*.*?\\\\*/|\\\\s|[\'\\"`()0-9]){0,32}(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])[[:space:]]*=[[:space:]]*(?:\\\\d+|[\'\\"][^\'\\"]*[\'\\"])|\\\\bUN(?:/\\\\*.*?\\\\*/|\\\\s)*ION\\\\b(?:/\\\\*.*?\\\\*/|\\\\s)+(?:ALL(?:/\\\\*.*?\\\\*/|\\\\s)+)?SELECT\\\\b|/\\\\*.*?\\\\*/|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\b|--\\\\s*[^\\\\r\\\\n]*)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated SQL injection via remoji_id parameter in Reaction::_del", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["sql-injection", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-02": {"action": "init", "conditions": [{"name": "ARGS:remoji_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>][^>]*onload\\\\s*=|<img[\\\\s/>][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via remoji_id parameter", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25452-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/remoji/v1/add(?:/|\\\\?|$)~"}, {"name": "ARGS:emoji", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/>][^>]*onload\\\\s*=|<img[\\\\s/>][^>]*onerror\\\\s*=|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-25452", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25452", "description": "Remoji <=2.2 unauthenticated stored XSS via emoji parameter on Remoji REST add route", "mode": "block", "severity": 7.1, "slug": "remoji", "tags": ["xss", "stored", "unauthenticated", "rest-api", "no-patch"], "target": "plugin", "versions": "<=2.2"}, "RULE-CVE-2026-25456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/shipi/v1/connect/fedex/?(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-25456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25456", "description": "Automated FedEx Shipping <=5.1.8 unauthenticated access to transient nonce data via shipi/v1/connect/fedex REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "a2z-fedex-shipping", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-25471-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "exists"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 broken authentication via OTP submission on wp-login.php", "method": "POST", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["authentication-bypass", "broken-authentication", "unauthenticated", "otp-bypass"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-25471-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:tpsa_verify_email_otp", "type": "regex", "value": "~(?:<script[^>]*>|<img[^>]*onerror[[:space:]]*=|on(?:error|load|mouseover|click)[[:space:]]*=|javascript:)~i"}], "cve": "CVE-2026-25471", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25471", "description": "Admin Safety Guard <=1.2.6 reflected XSS via unsanitized tpsa_verify_email_otp on wp-login.php", "method": "GET", "mode": "block", "severity": 8.1, "slug": "admin-safety-guard", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.2.6"}, "RULE-CVE-2026-2554-01": {"ajax_action": "delete_wcfm_customer", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2554", "description": "WCFM <=6.7.25 IDOR allowing authenticated Vendor+ to delete arbitrary users via customerid parameter", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "authorization-bypass", "privilege-escalation"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-2568-01": {"action": "admin_init", "conditions": [{"name": "ARGS:entry_id", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via entry_id parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-02": {"action": "admin_init", "conditions": [{"name": "ARGS:start_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via start_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-03": {"action": "admin_init", "conditions": [{"name": "ARGS:end_date", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via end_date parameter on admin logs page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2568-04": {"action": "admin_init", "conditions": [{"name": "ARGS:vx_debug", "type": "detectXSS"}], "cve": "CVE-2026-2568", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2568", "description": "WP Zendesk for Contact Form 7 <=1.1.5 reflected XSS via vx_debug parameter on admin entry box page", "method": "GET", "mode": "block", "severity": 7.2, "slug": "cf7-zendesk", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-2571-01": {"ajax_action": "wpdmdz_user_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2571", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2571", "description": "Download Manager <=3.3.49 missing authorization on wpdmdz_user_status AJAX handler allows subscriber+ user enumeration", "mode": "block", "severity": 4.3, "slug": "download-manager", "tags": ["missing-authorization", "information-disclosure", "idor"], "target": "plugin", "versions": "<=3.3.49"}, "RULE-CVE-2026-2576-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment", "type": "detectSQLi"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment parameter (scalar)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[0]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2576-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:payment[1]", "type": "regex", "value": "~(?:\'|\\"|;|--|#|/\\\\*|\\\\bOR\\\\b|\\\\bAND\\\\b|\\\\bUNION\\\\b|\\\\bSELECT\\\\b|\\\\bSLEEP\\\\b|\\\\bBENCHMARK\\\\b)~i"}], "cve": "CVE-2026-2576", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2576", "description": "Business Directory Plugin <=6.4.21 unauthenticated time-based SQL injection via payment[] array parameter (index 1)", "mode": "block", "severity": 7.5, "slug": "business-directory-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=6.4.21"}, "RULE-CVE-2026-2579-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wopb/product-search(/|\\\\?|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?i)(?:[\'\\"`]\\\\s*(?:OR|AND)\\\\s+[\'\\"`\\\\d]|\\\\bUNION\\\\b\\\\s+(?:ALL\\\\s+)?\\\\bSELECT\\\\b\\\\s+(?:[0-9]|NULL\\\\b|@@|0x|CONCAT|CHAR)|\\\\bSLEEP\\\\s*[(]|\\\\bBENCHMARK\\\\s*[(]|\\\\bEXTRACTVALUE\\\\s*[(]|\\\\bUPDATEXML\\\\s*[(]|/[*][!*]|;\\\\s*(?:DROP|ALTER|CREATE|TRUNCATE)\\\\b)~"}], "cve": "CVE-2026-2579", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2579", "description": "ProductX/WowStore <=4.4.3 unauthenticated SQL injection via search parameter in wopb/product-search REST endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "product-blocks", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=4.4.3"}, "RULE-CVE-2026-2580-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-2580", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2580", "description": "WP Google Map Plugin <=4.9.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "authenticated"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-2582-01": {"ajax_action": "show_direct_debit", "conditions": [{"name": "ARGS:account_holder", "type": "regex", "value": "~\\\\[\\\\s*[a-z_][a-z0-9_]{2,}[\\\\s\\\\]\\\\/]~"}], "cve": "CVE-2026-2582", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2582", "description": "Germanized for WooCommerce <=3.20.5 unauthenticated arbitrary shortcode execution via account_holder parameter in direct debit mandate AJAX handler", "mode": "block", "severity": 6.5, "slug": "woocommerce-germanized", "tags": ["code-injection", "shortcode-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.20.5"}, "RULE-CVE-2026-2583-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:meta[blocksy_meta]", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-2583-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:blocksy_meta", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|<\\\\s*(?:img|svg|iframe|object|embed|details|video|audio|math|body|input|button|select|textarea|form|marquee|a|div|p|table|style)\\\\b[^>]*\\\\bon(?:error|load|mouseover|click|focus|blur|animationend|toggle|resize|pointerover|auxclick)\\\\s*=|javascript\\\\s*:|<\\\\s*svg[\\\\s/>])~i"}], "cve": "CVE-2026-2583", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2583", "description": "Blocksy <=2.1.30 Contributor+ stored XSS via blocksy_meta in classic post editor", "mode": "block", "severity": 6.4, "slug": "blocksy", "tags": ["xss", "stored", "authenticated"], "target": "theme", "versions": "<=2.1.30"}, "RULE-CVE-2026-25863-01": {"ajax_action": "cf7mls_validation", "conditions": [{"name": "ARGS:_count", "type": "regex", "value": "~^\\\\d{4,}$~"}], "cve": "CVE-2026-25863", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-25863", "description": "Contact Form 7 Conditional Fields <=2.7.3 unauthenticated denial of service via repeater _count parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "cf7-conditional-fields", "tags": ["denial-of-service", "resource-consumption", "unauthenticated"], "target": "plugin", "versions": "<=2.7.3"}, "RULE-CVE-2026-2589-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/plugins/greenshift-animation-and-page-builder-blocks/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in plugin directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2589-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-content/uploads/greenshift/).*(?:backup|settings_backup).*\\\\.(?:json|txt|zip)(?:\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2589", "description": "GreenShift <= 12.8.3 unauthenticated sensitive information exposure via settings backup file in uploads directory", "method": "GET", "mode": "block", "severity": 5.3, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["information-disclosure", "unauthenticated", "sensitive-data-exposure"], "target": "plugin", "versions": "<=12.8.3"}, "RULE-CVE-2026-2592-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "equals", "value": "wc_zpal"}, {"name": "ARGS:Status", "type": "equals", "value": "OK"}, {"name": "ARGS:wc_order", "type": "exists"}, {"name": "ARGS:Authority", "type": "regex", "value": "~^[A-Za-z0-9]{16,35}$~"}], "cve": "CVE-2026-2592", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2592", "description": "ZarinPal WooCommerce Payment Gateway <=5.0.16 improper access control via wc-api wc_zpal callback with forged short Authority token", "mode": "block", "severity": 7.7, "slug": "zarinpal-woocommerce-payment-gateway", "tags": ["improper-access-control", "payment-bypass", "woocommerce-api", "unauthenticated"], "target": "plugin", "versions": "<=5.0.16"}, "RULE-CVE-2026-2593-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:meta[_gspb_post_css]", "type": "regex", "value": "~</?[a-zA-Z][a-zA-Z0-9]*[\\\\s/>]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css post meta through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2593-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(/[0-9]+)?(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~greenshift-blocks/element[^}]*dynamicAttributes[^}]*<[a-zA-Z][a-zA-Z0-9]*[ /][^>]*(?:on[a-zA-Z]+=|javascript:|<script)~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via dynamicAttributes in block content through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "rest-api", "block-editor"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2593-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:meta[_gspb_post_css]", "type": "regex", "value": "~</?[a-zA-Z][a-zA-Z0-9]*[\\\\s/>]~i"}], "cve": "CVE-2026-2593", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2593", "description": "GreenShift <=12.8.5 Stored XSS via _gspb_post_css meta through classic editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "greenshift-animation-and-page-builder-blocks", "tags": ["xss", "stored-xss", "classic-editor"], "target": "plugin", "versions": "<=12.8.5"}, "RULE-CVE-2026-2599-01": {"action": "init", "conditions": [{"name": "ARGS:vx_crm_form_action", "type": "equals", "value": "download_csv"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2599", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2599", "description": "Contact Form Entries <=1.4.7 unauthenticated PHP Object Injection via download_csv deserialization trigger", "method": "GET", "mode": "block", "severity": 9.8, "slug": "contact-form-entries", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=1.4.7"}, "RULE-CVE-2026-2628-01": {"action": "init", "conditions": [{"name": "ARGS:id_token", "type": "regex", "value": "~^[A-Za-z0-9_=-]+\\\\.[A-Za-z0-9_=-]+\\\\.?[A-Za-z0-9_=-]*$~"}, {"name": "ARGS:code", "type": "exists"}], "cve": "CVE-2026-2628", "method": "GET", "mode": "block", "severity": 9.8, "slug": "login-with-azure", "target": "plugin", "versions": "<2.2.6"}, "RULE-CVE-2026-27044-01": {"ajax_action": "totalpoll_modules_install_from_file", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27044", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27044", "description": "Total Poll Lite <=4.12.0 authenticated remote code execution via totalpoll_modules_install_from_file AJAX handler", "mode": "block", "severity": 9.9, "slug": "totalpoll-lite", "tags": ["remote-code-execution", "code-injection", "missing-authorization"], "target": "plugin", "versions": "<=4.12.0"}, "RULE-CVE-2026-27053-01": {"ajax_action": "vwls_stream_setup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream_setup AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-02": {"ajax_action": "h5vls_app", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via h5vls_app AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27053-03": {"ajax_action": "vwls_stream", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27053", "description": "Broadcast Live Video <7.1.3 unauthenticated PHP object injection via vwls_stream AJAX handler", "mode": "block", "severity": 9.8, "slug": "videowhisper-live-streaming-integration", "target": "plugin", "versions": "<7.1.3"}, "RULE-CVE-2026-27067-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_media(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_media REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27067-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprne/v1/media/insert_font(/|\\\\?|$)~"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini|htaccess|htpasswd)$~i"}], "cve": "CVE-2026-27067", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27067", "description": "Mobile App Editor <=1.3.1 arbitrary file upload via /wprne/v1/media/insert_font REST endpoint", "method": "POST", "mode": "block", "severity": 9.1, "slug": "mobile-app-editor", "tags": ["arbitrary-file-upload", "web-shell", "rest-api", "CWE-434"], "target": "plugin", "versions": "<=1.3.1"}, "RULE-CVE-2026-27068-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:llms_generator_settings", "type": "regex", "value": "~(?:<script[^>]*>|</script>|javascript\\\\s*:|on[a-z]+\\\\s*=|<iframe[^>]*>|<svg[^>]*>)~i"}], "cve": "CVE-2026-27068", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27068", "description": "Website LLMs.txt <=8.2.6 reflected XSS via llms_generator_settings reflected in admin/admin-page.php hidden input attributes", "mode": "block", "severity": 7.1, "slug": "website-llms-txt", "tags": ["xss", "reflected-xss", "admin-page", "crafted-link"], "target": "plugin", "versions": "<=8.2.6"}, "RULE-CVE-2026-2707-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/weforms/v1/forms/[0-9]+/entries(/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "rest-api"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-2707-02": {"ajax_action": "weforms_frontend_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<script[^>]*>|on(error|load|click|mouseover|focus|blur) *=~i"}], "cve": "CVE-2026-2707", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2707", "description": "weForms <=1.6.27 authenticated stored XSS via form entry field values submitted through AJAX frontend submit", "method": "POST", "mode": "block", "severity": 6.4, "slug": "weforms", "tags": ["xss", "stored-xss", "ajax"], "target": "plugin", "versions": "<=1.6.27"}, "RULE-CVE-2026-27071-01": {"ajax_action": "save_location", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-27071", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27071", "description": "WPCafe <=3.0.6 unauthenticated broken access control on save_location AJAX handler", "mode": "block", "severity": 9.1, "slug": "wp-cafe", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.0.6"}, "RULE-CVE-2026-27072-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_head", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_head parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27072-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:pys_footer", "type": "exists"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27072", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27072", "description": "PixelYourSite <=11.2.0.1 Stored XSS via pys_footer parameter in HeadFooter save_meta_box", "method": "POST", "mode": "block", "severity": 7.1, "slug": "pixelyoursite", "tags": ["xss", "stored-xss", "post-meta"], "target": "plugin", "versions": "<=11.2.0.1"}, "RULE-CVE-2026-27075-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27075", "description": "belfort theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "belfort", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27076-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27076", "description": "luxedrive theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "luxedrive", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27077-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27077-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27077", "description": "multioffice theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "multioffice", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27078-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27078-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27078", "description": "emaurri theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "emaurri", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-27079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27079", "description": "amfissa theme <= 1.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "amfissa", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1"}, "RULE-CVE-2026-27080-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27080-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27080", "description": "deston theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "deston", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27081-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27081-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27081", "description": "rosebud theme <= 1.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "rosebud", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4"}, "RULE-CVE-2026-27082-01": {"ajax_action": "lovestory_options_import", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_import AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27082-02": {"ajax_action": "lovestory_options_save", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|%25(?:4[fF]|4[fF])%25(?:3[aA]|3[aA])|%4[fF]%3[aA])O(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\"|%22|%2522)[^\\"]+(?:\\"|%22|%2522)(?::|%3[Aa]|%253[Aa])[0-9]+(?::|%3[Aa]|%253[Aa])(?:\\\\{|%7[Bb]|%257[Bb])~"}], "cve": "CVE-2026-27082", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27082", "description": "Love Story <=1.3.12 PHP object injection via lovestory_options_save AJAX data parameter", "mode": "block", "severity": 9.8, "slug": "lovestory", "tags": ["object-injection", "deserialization", "authenticated", "ajax"], "target": "theme", "versions": "<=1.3.12"}, "RULE-CVE-2026-27094-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:coblocks/[a-z-]+\\\\s*\\\\{[^}]*(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|toggle|pointer\\\\w+)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-27094", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27094", "description": "CoBlocks <=3.1.16 Contributor+ stored XSS via CoBlocks block attributes in post content", "mode": "block", "severity": 6.5, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-27095-04": {"ajax_action": "get_wbtm_return_date", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_return_date AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-05": {"ajax_action": "get_wbtm_dropping_point", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via get_wbtm_dropping_point AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-06": {"ajax_action": "wbtm_create_seat_plan", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-07": {"ajax_action": "wbtm_create_seat_plan_dd", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_create_seat_plan_dd AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-08": {"ajax_action": "wbtm_get_bus_detail", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_get_bus_detail AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27095-09": {"ajax_action": "wbtm_reload_pricing", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php|wp-admin/admin-post\\\\.php)(?:$|[?])~"}, {"name": "ARGS", "type": "regex", "value": "~(?:^|[;{])(?:O|C):\\\\d+:\\"[^\\"]+\\"(?::\\\\d+)?:\\\\{~"}], "cve": "CVE-2026-27095", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27095", "description": "Bus Ticket Booking with Seat Reservation <=5.6.0 unauthenticated PHP object injection via wbtm_reload_pricing AJAX handler", "mode": "block", "severity": 9.8, "slug": "bus-ticket-booking-with-seat-reservation", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=5.6.0"}, "RULE-CVE-2026-27097-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-27097-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27097", "description": "casamia theme <= 1.1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "casamia", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.2"}, "RULE-CVE-2026-2712-01": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS:data[wp-optimize-heartbeat-smush][command]", "type": "regex", "value": "~^(?:get_smush_logs|clean_all_backup_images|process_bulk_smush|update_smush_options|get_smush_options|clear_smush_stats|clear_backup_images|clear_backup_images_directory|delete_log_files|get_logfile_path)$~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2712", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2712", "description": "WP-Optimize <=4.5.0 missing authorization in receive_heartbeat() allows subscriber+ to invoke admin-only Smush commands via Heartbeat API", "method": "POST", "mode": "block", "severity": 5.4, "slug": "wp-optimize", "tags": ["incorrect-authorization", "missing-capability", "heartbeat-abuse"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2718-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in classic editor post content", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2718-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "contains", "value": "wp:dealia/"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:dealia/[^}]*(?:on[a-z]+\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2718", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2718", "description": "Dealia - Request a Quote <=1.0.8 Contributor+ stored XSS via Gutenberg block attributes in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "dealia-request-a-quote", "tags": ["xss", "stored", "gutenberg-block", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-2721-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/options\\\\.php~"}, {"name": "ARGS:mailarchiver_archiver_privacy_encryption", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|focus|blur|click)\\\\s*=|javascript\\\\s*:|<i(?:mg|frame)[\\\\s/]|</(?:title|textarea|style)>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2721", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2721", "description": "MailArchiver <=4.4.0 authenticated stored XSS via mailarchiver_archiver_privacy_encryption settings field", "method": "POST", "mode": "block", "severity": 4.8, "slug": "mailarchiver", "tags": ["xss", "stored", "authenticated", "settings-api"], "target": "plugin", "versions": "<=4.4.0"}, "RULE-CVE-2026-2724-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "unitecreator_ajax_action"}, {"name": "ARGS", "type": "detectXSS"}], "cve": "CVE-2026-2724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2724", "description": "Unlimited Elements for Elementor <=2.0.5 unauthenticated stored XSS via form field values", "method": "POST", "mode": "block", "severity": 7.2, "slug": "unlimited-elements-for-elementor", "tags": ["xss", "stored-xss", "unauthenticated", "elementor"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-2732-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_prepare_remove_background"}, {"name": "ARGS:attachment_id", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background GET handler allows Author+ to access arbitrary attachments", "method": "GET", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-2732-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "emr_process_remove_background"}, {"name": "ARGS:ID", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2732", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2732", "description": "Enable Media Replace <=4.1.7 missing authorization on Remove Background POST handler allows Author+ to replace arbitrary attachments", "method": "POST", "mode": "block", "severity": 5.4, "slug": "enable-media-replace", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=4.1.7"}, "RULE-CVE-2026-27326-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27326-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27326", "description": "window-ac-services theme <= 1.2.5 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "window-ac-services", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.5"}, "RULE-CVE-2026-27333-01": {"ajax_action": "vmls_app", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls_app AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27333-02": {"ajax_action": "vmls", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:Tzo|bzo|YTo)[A-Za-z0-9+/=%\\\\s]~i"}], "cve": "CVE-2026-27333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27333", "description": "PPV Live Webcams <=7.3.23 unauthenticated PHP object injection via vmls AJAX handler deserialization of base64-encoded data parameter", "mode": "block", "severity": 8.1, "slug": "ppv-live-webcams", "tags": ["object-injection", "deserialization", "unauthenticated"], "target": "plugin", "versions": "<=7.3.23"}, "RULE-CVE-2026-27335-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27335-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27335", "description": "ekoterra theme <= 1.0.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "ekoterra", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-27336-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27336", "description": "consultor theme <= 1.2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "consultor", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.4"}, "RULE-CVE-2026-27337-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27337-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27337", "description": "chronicle theme <= 1.0 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "chronicle", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0"}, "RULE-CVE-2026-27339-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27339-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27339", "description": "buzzstone theme <= 1.0.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "buzzstone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.2"}, "RULE-CVE-2026-27340-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27340-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27340", "description": "apollo theme <= 1.3.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "apollo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.1"}, "RULE-CVE-2026-27341-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27341-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27341", "description": "topscorer theme <= 1.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topscorer", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2"}, "RULE-CVE-2026-27342-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. Mikado-Themes mikado-core/bridge-core framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "path-traversal", "generic", "mikado-core"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27342-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-27342", "description": "topfit theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "topfit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-27366-01": {"action": "init", "conditions": [{"name": "ARGS:mainwpsignature", "type": "exists"}, {"name": "ARGS:register", "type": "exists"}], "cve": "CVE-2026-27366", "description": "MainWP Child <=6.1.1 unauthenticated broken access control via site registration flow", "mode": "block", "severity": 7.5, "slug": "mainwp-child", "target": "plugin", "versions": "<=6.1.1"}, "RULE-CVE-2026-27379-01": {"ajax_action": "nxs_saveSiteSets", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_saveSiteSets AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27379-02": {"ajax_action": "nxs_snap_aj", "conditions": [{"name": "ARGS:fltrs", "type": "regex", "value": "~[OC]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27379", "description": "NextScripts SNAP <=4.4.7 PHP Object Injection via unserialize of fltrs parameter in nxs_snap_aj AJAX handler", "method": "POST", "mode": "block", "severity": 8.8, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=4.4.7"}, "RULE-CVE-2026-27384-01": {"ajax_action": "w3tc_dismiss_license_notice", "conditions": [{"name": "ARGS:notice_id", "type": "detectSQLi"}], "cve": "CVE-2026-27384", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27384", "description": "W3 Total Cache <=2.9.1 authenticated SQL injection via notice_id in w3tc_dismiss_license_notice AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "w3-total-cache", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.9.1"}, "RULE-CVE-2026-27410-01": {"ajax_action": "slimtrack", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via slimtrack AJAX tracker endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27410-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/slimstat/v1/hit(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-27410", "description": "Slimstat Analytics <5.4.0 unauthenticated PHP object injection via REST slimstat/v1/hit endpoint", "mode": "block", "severity": 6.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<5.4.0"}, "RULE-CVE-2026-27421-01": {"ajax_action": "count_compare_items", "conditions": [{"name": "ARGS:compare_empty_text", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<[^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via count_compare_items \\u2013 blocks unauthenticated/low-priv requests containing XSS payloads in compare_empty_text echoed without escaping in includes/compare.php:621", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-02": {"ajax_action": "wpr_woo_grid_filters_ajax", "conditions": [{"name": "ARGS:grid_settings[/\\\\w+/]", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<[^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_woo_grid_filters_ajax \\u2013 blocks unauthenticated requests injecting XSS in grid_settings array values rendered without escaping in wpr-templates-data.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27421-03": {"ajax_action": "wpr_load_more_tweets", "conditions": [{"name": "ARGS:wpr_load_more_settings[/\\\\w+/]", "type": "regex", "value": "~(?:<script|javascript\\\\s*:|<[^>]*on\\\\w+\\\\s*=)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-27421", "description": "Royal Elementor Addons Stored XSS via wpr_load_more_tweets \\u2013 blocks unauthenticated requests injecting XSS in wpr_load_more_settings array values rendered without escaping in wpr-load-more-tweets.php", "mode": "block", "severity": 6.5, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<1.7.1053"}, "RULE-CVE-2026-27984-01": {"ajax_action": "widgetopts_ajax_validate_expression", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:system|passthru|exec|shell_exec|popen|proc_open|pcntl_exec|eval|assert|preg_replace|create_function|call_user_func|call_user_func_array|file_get_contents|file_put_contents|fopen|fwrite|include|require|phpinfo|unlink|rmdir|mail|header|curl_exec|base64_decode)[ ]*[(]~i"}], "cve": "CVE-2026-27984", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27984", "description": "Widget Options <=4.1.3 authenticated code injection via widgetopts_ajax_validate_expression AJAX handler", "method": "POST", "mode": "block", "severity": 9.0, "slug": "widget-options", "tags": ["code-injection", "rce", "authenticated"], "target": "plugin", "versions": "<=4.1.3"}, "RULE-CVE-2026-27988-01": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-02": {"ajax_action": "equadio_ajax_get_posts", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_ajax_get_posts part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-03": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin skin parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-04": {"ajax_action": "equadio_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_download_skin file parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-05": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:slug", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin slug parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-27988-06": {"ajax_action": "equadio_switch_skin", "conditions": [{"name": "ARGS:part", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-27988", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-27988", "description": "Equadio Theme <=1.1.3 unauthenticated LFI via equadio_switch_skin part parameter", "mode": "block", "severity": 8.1, "slug": "equadio", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.1.3"}, "RULE-CVE-2026-28024-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28024-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28024", "description": "helion theme <= 1.1.12 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "helion", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.1.12"}, "RULE-CVE-2026-28030-01": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-02": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-03": {"ajax_action": "bonbon_download_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_download_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-04": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-05": {"ajax_action": "bonbon_switch_skin", "conditions": [{"name": "ARGS:theme", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_switch_skin AJAX handler (theme param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-06": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:product_id", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (product_id param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-07": {"ajax_action": "bonbon_buy_skin", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_buy_skin AJAX handler (url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-08": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-09": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (file param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28030-10": {"ajax_action": "bonbon_update_skin", "conditions": [{"name": "ARGS:skin_url", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:/etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-28030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28030", "description": "BonBon Theme <=1.6 local file inclusion via bonbon_update_skin AJAX handler (skin_url param)", "mode": "block", "severity": 8.1, "slug": "bonbon", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=1.6"}, "RULE-CVE-2026-28039-01": {"ajax_action": "wpdatatables_save_table_config", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via table config language/column type setting (require_once with unsanitized path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-02": {"ajax_action": "wpdatatables_save_plugin_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via plugin settings language parameter (require_once with unsanitized wdtInterfaceLanguage)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-03": {"ajax_action": "wpdatatable_save_chart_get_shortcode", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-04": {"ajax_action": "wpdatatable_show_chart_from_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 Local File Inclusion via chart show engine parameter (require_once with unsanitized engine value)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-05": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 unauthenticated SSRF/LFI via cache update file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "unauthenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28039-06": {"ajax_action": "wpdatatables_get_nested_json_roots", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]etc[\\\\\\\\/]|wp-config\\\\.php|\\\\.htaccess|\\\\.env|file://|php://|phar://|expect://|data://|glob://|zip://|compress\\\\.)~i"}], "cve": "CVE-2026-28039", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28039", "description": "wpDataTables <=6.5.0.1 SSRF/LFI via nested JSON roots file_get_contents with unrestricted URL scheme", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wpdatatables", "tags": ["local-file-inclusion", "ssrf", "authenticated"], "target": "plugin", "versions": "<=6.5.0.1"}, "RULE-CVE-2026-28041-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28041-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28041", "description": "grit theme <= 1.0.1 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "grit", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.0.1"}, "RULE-CVE-2026-28043-01": {"ajax_action": "healer_ajax_get_posts", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|data|expect|zip|phar)://|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|/proc/self)|\\\\.\\\\. %25(?:2[Ff]|5[Cc]))~i"}], "cve": "CVE-2026-28043", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28043", "description": "Healer theme <=1.0.0 unauthenticated local file inclusion via healer_ajax_get_posts AJAX handler", "mode": "block", "severity": 9.8, "slug": "healer", "tags": ["local-file-inclusion", "unauthenticated", "path-traversal", "php-stream-wrapper"], "target": "theme", "versions": "<=1.0.0"}, "RULE-CVE-2026-28048-01": {"action": "init", "conditions": [{"name": "ARGS:flashtemplate", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\/]|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-28048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28048", "description": "FlashMart Theme <=2.0.15 unauthenticated local file inclusion via template parameter", "mode": "block", "severity": 8.1, "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "core", "versions": ">=5.0"}, "RULE-CVE-2026-28049-01": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via template parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-02": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via page parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-03": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via file parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28049-04": {"ajax_action": "police_department_ajax_get_posts", "conditions": [{"name": "ARGS:include", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:php|phar):/|[/\\\\\\\\]wp-config\\\\.php|[/\\\\\\\\]etc[/\\\\\\\\]passwd)~i"}], "cve": "CVE-2026-28049", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28049", "description": "Police Department <=2.17 unauthenticated LFI via include parameter in ajax_get_posts callback", "mode": "block", "severity": 8.1, "slug": "police-department", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "theme", "versions": "<=2.17"}, "RULE-CVE-2026-28079-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28079-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28079", "description": "conquerors theme <= 1.2.13 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "conquerors", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.2.13"}, "RULE-CVE-2026-28117-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28117-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28117", "description": "smartSEO theme <= 2.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "smartseo", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.9"}, "RULE-CVE-2026-28118-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28118-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28118", "description": "welldone theme <= 2.4 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "welldone", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.4"}, "RULE-CVE-2026-28119-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "nir-vana", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28119-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28119", "description": "nir-vana theme <= 2.6 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "nir-vana", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=2.6"}, "RULE-CVE-2026-28121-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28121-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28121", "description": "andersonclinic theme <= 1.4.2 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "andersonclinic", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.4.2"}, "RULE-CVE-2026-28123-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28123-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28123", "description": "veil theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "veil", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28124-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28124", "description": "notarius theme <= 1.9 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "notarius", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.9"}, "RULE-CVE-2026-28125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file|data)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28125-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28125", "description": "midi theme <= 1.14 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "midi", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.14"}, "RULE-CVE-2026-28129-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:(?:\\\\.\\\\.|%2[eE]%2[eE])(?:[/\\\\\\\\]|%2[fF]|%5[cC])){2,}|(?:php|phar|expect|zip|compress\\\\.zlib|file)://|%70%68%70%3[aA]%2[fF]%2[fF]|(?:^|=)data:[a-zA-Z]~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 path traversal and PHP wrapper abuse in template selector parameters. AncoraThemes/axiomthemes trx_addons framework shared LFI pattern.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "path-traversal", "generic", "trx_addons"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28129-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:/wp-admin/|/wp-json/|\\\\?)~i"}, {"name": "ARGS:/^(type|layout|template|view|skin|style)$/", "type": "regex", "value": "~(?:wp-config|/etc/passwd|/proc/self/environ|/var/log/|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-28129", "description": "little-birdies theme <= 1.3.16 sensitive file detection in template parameters.", "mode": "block", "severity": 8.1, "slug": "little-birdies", "tags": ["lfi", "sensitive-file", "defense-in-depth"], "target": "theme", "versions": "<=1.3.16"}, "RULE-CVE-2026-28133-02": {"ajax_action": "upload_file", "conditions": [{"name": "ARGS:_chunkedd", "type": "regex", "value": "~<[?%](?:php|=)~i"}], "cve": "CVE-2026-28133", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28133", "description": "Filr Protection <=1.2.14 arbitrary file write via chunked upload (_chunkedd) in upload_file AJAX handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "filr-protection", "tags": ["arbitrary-file-upload", "arbitrary-file-write", "authenticated"], "target": "plugin", "versions": "<=1.2.14"}, "RULE-CVE-2026-2826-01": {"ajax_action": "kadence_import_process_pattern", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-2826", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2826", "description": "Kadence Blocks <=3.6.4 missing authorization on kadence_import_process_pattern allows authenticated users without upload_files capability to import arbitrary content", "mode": "block", "severity": 4.3, "slug": "kadence-blocks", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=3.6.4"}, "RULE-CVE-2026-2830-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (GET)", "method": "GET", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2830-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "pmxi-admin-import"}, {"name": "ARGS:filepath", "type": "regex", "value": "~(?:<[^>]+>|%3c[^%]*%3e|javascript:|on[a-z]+[ \\t]*=)~i"}], "cve": "CVE-2026-2830", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2830", "description": "WP All Import <=4.0.0 reflected XSS via filepath parameter on import wizard admin page (POST)", "method": "POST", "mode": "block", "severity": 6.1, "slug": "wp-all-import", "tags": ["xss", "reflected-xss", "admin-page"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-2831-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:logid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via logid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2831-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "mailarchiver-viewer"}, {"name": "ARGS:eventid", "type": "detectSQLi"}], "cve": "CVE-2026-2831", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2831", "description": "MailArchiver <=4.5.0 authenticated SQL injection via eventid parameter on events viewer admin page", "method": "GET", "mode": "block", "severity": 4.9, "slug": "mailarchiver", "tags": ["sql-injection", "authenticated", "admin-page"], "target": "plugin", "versions": "<=4.5.0"}, "RULE-CVE-2026-2837-01": {"ajax_action": "ric_plugin_save_settings", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2837", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2837", "description": "Ricerca Smart Search <=1.1.12 authenticated stored XSS via plugin settings in ric_plugin_save_settings", "mode": "block", "severity": 4.4, "slug": "ricerca-smart-search", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=1.1.12"}, "RULE-CVE-2026-2840-01": {"action": "init", "conditions": [{"name": "ARGS:eeb_mail", "type": "regex", "value": "~<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:~i"}], "cve": "CVE-2026-2840", "description": "Email Encoder Bundle <=2.4.4 reflected XSS via eeb_mail parameter in eeb_mailto shortcode", "mode": "block", "severity": 6.4, "slug": "email-encoder-bundle", "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-28557-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wpforo_synch_roles"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-28557", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28557", "description": "wpForo Forum >=2.4.0 <2.4.16 missing authorization on wpforo_synch_roles AJAX handler allows privilege escalation via bulk usergroup-to-role reassignment", "method": "POST", "mode": "block", "severity": 6.5, "slug": "wpforo", "tags": ["missing-authorization", "privilege-escalation", "broken-access-control", "role-remapping"], "target": "plugin", "versions": ">=2.4.0 <2.4.16"}, "RULE-CVE-2026-28562-01": {"action": "init", "conditions": [{"name": "ARGS:wpfob", "type": "detectSQLi"}], "cve": "CVE-2026-28562", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-28562", "description": "wpForo Forum >=2.4.0 <2.4.15 unauthenticated SQL injection via wpfob ORDER BY parameter", "method": "GET", "mode": "block", "severity": 9.8, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated", "order-by-injection"], "target": "plugin", "versions": ">=2.4.0 <2.4.15"}, "RULE-CVE-2026-2868-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|admin-ajax)\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\son[a-z]+\\\\s*=|<img[^>]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute persisted via classic post save / admin-ajax", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2868-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/~"}, {"name": "ARGS", "type": "regex", "value": "~separatorIconSVG[^a-zA-Z0-9_][\\\\s\\\\S]{0,400}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|animationend|animationstart|toggle|pointerenter|pointerover)\\\\s*=|javascript\\\\s*:|<svg[^>]*\\\\son[a-z]+\\\\s*=|<img[^>]*\\\\son[a-z]+\\\\s*=|%3[Cc]script|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-2868", "description": "Gutenverse <=3.5.3 contributor+ stored XSS via separatorIconSVG Breadcrumb block attribute through REST API post save", "mode": "block", "severity": 6.4, "slug": "gutenverse", "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2879-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/getgenie/v1/geniechat(?:/|\\\\?|&|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~^[1-9][0-9]*$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-2879", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2879", "description": "GetGenie <=4.3.2 authenticated (Author+) IDOR allows arbitrary post overwrite via id parameter in getgenie/v1/chat REST endpoint", "method": "POST", "mode": "block", "severity": 5.4, "slug": "getgenie", "tags": ["idor", "broken-access-control", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.2"}, "RULE-CVE-2026-2890-01": {"ajax_action": "frm_forms_preview", "conditions": [{"name": "ARGS", "type": "regex", "value": "~<[a-zA-Z][^>]*\\\\s+on[a-zA-Z]+=|<script[^>]*>|javascript\\\\s*:|<iframe[^>]*>|<object[^>]*>|<embed[^>]*>|<svg[^>]*\\\\s+on[a-zA-Z]+=~i"}], "cve": "CVE-2026-2890", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2890", "description": "Formidable Forms <=6.28 reflected/stored XSS via item_meta in form preview AJAX handler", "method": "POST", "mode": "block", "severity": 6.1, "slug": "formidable", "tags": ["xss", "unauthenticated", "reflected-xss"], "target": "plugin", "versions": "<=6.28"}, "RULE-CVE-2026-2918-01": {"ajax_action": "ha_condition_update", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[\\"\'] *on[a-z]+ *=~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2918", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2918", "description": "Happy Elementor Addons <=3.21.0 IDOR + Stored XSS via ha_condition_update AJAX action", "method": "POST", "mode": "block", "severity": 6.4, "slug": "happy-elementor-addons", "tags": ["idor", "stored-xss", "broken-access-control"], "target": "plugin", "versions": "<=3.21.0"}, "RULE-CVE-2026-2924-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>]|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in REST API post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2924-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~imageLoad[\\\\\\\\\\"\':=\\\\s]*(?:on(?:load|error|mouseover|click|focus|blur|mousedown|mouseup|keydown|keyup|input|change)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>]|<img[^>]+onerror)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-2924", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2924", "description": "Gutenverse <=3.4.6 authenticated (Contributor+) stored XSS via imageLoad block attribute in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["xss", "stored", "authenticated", "gutenberg-block"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-2936-03": {"ajax_action": "today_traffic_index", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*><script\\\\b|\'\\\\s*><script\\\\b|<script\\\\b[^>]*>.*?</script\\\\s*>|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in today_traffic_index AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2936-04": {"ajax_action": "visits_time_graph", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~i"}, {"name": "ARGS:fdt", "type": "regex", "value": "~(?:\\"\\\\s*><script\\\\b|\'\\\\s*><script\\\\b|<script\\\\b[^>]*>.*?</script\\\\s*>|<[^>]+\\\\s+on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-2936", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2936", "description": "Visitors Traffic Real Time Statistics <=8.4 reflected XSS via fdt parameter in visits_time_graph AJAX handler", "mode": "block", "severity": 7.2, "slug": "visitors-traffic-real-time-statistics", "tags": ["xss", "reflected", "authenticated", "ajax"], "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-2941-01": {"ajax_action": "linksy_search_and_replace_item_details", "conditions": [{"name": "ARGS:option", "type": "equals", "value": "set"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_item_details allowing subscriber+ arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-02": {"ajax_action": "linksy_search_and_replace_replace_db", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_replace_db allowing subscriber+ bulk arbitrary database update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "privilege-escalation", "arbitrary-db-update"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2941-03": {"ajax_action": "linksy_search_and_replace_fetch_db_list", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2941", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2941", "description": "Linksy Search and Replace <=1.0.4 missing authorization on linksy_search_and_replace_fetch_db_list allowing subscriber+ database table enumeration", "method": "POST", "mode": "block", "severity": 8.8, "slug": "linksy-search-and-replace", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-2942-01": {"ajax_action": "proSol_fileUploadProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2942-02": {"ajax_action": "proSol_fileUploadModalProcess", "conditions": [{"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\\\\\/])\\\\.ht(?:access|passwd)$~i"}], "cve": "CVE-2026-2942", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2942", "description": "ProSolution WP Client <=1.9.9 unauthenticated arbitrary file upload via proSol_fileUploadModalProcess AJAX handler", "method": "POST", "mode": "block", "severity": 9.8, "slug": "prosolution-wp-client", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-2948-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-client/v2/import/images(?:[/?&]|$)~"}, {"name": "ARGS:imageUrl", "type": "regex", "value": "~^(?:ftp|file|dict|gopher|ssh|smtp|news|telnet|nntp|irc|imap|mongo):|^(?:https?:)?//(?:localhost|127\\\\.0\\\\.0\\\\.1|10\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|192\\\\.168\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}|169\\\\.254\\\\.169\\\\.254|0\\\\.0\\\\.0\\\\.0|/|[a-zA-Z]:\\\\\\\\|[a-zA-Z0-9.-]+\\\\.internal)~i"}], "cve": "CVE-2026-2948", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2948", "description": "Gutenverse <=3.5.3 server-side request forgery via imageUrl in import_images REST endpoint", "method": "POST", "mode": "block", "severity": 6.4, "slug": "gutenverse", "tags": ["ssrf", "server-side-request-forgery", "authenticated"], "target": "plugin", "versions": "<=3.5.3"}, "RULE-CVE-2026-2951-01": {"ajax_action": "gutentor_deactivate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_deactivate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-02": {"ajax_action": "gutentor_activate_block", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_activate_block AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-03": {"ajax_action": "gutentor_bulk_activate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_activate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2951-04": {"ajax_action": "gutentor_bulk_deactivate_blocks", "conditions": [{"name": "ARGS:block_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"name": "", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-2951", "description": "Gutentor <=3.5.5 stored XSS via gutentor_bulk_deactivate_blocks AJAX handler", "mode": "block", "severity": 5.4, "slug": "gutentor", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-2987-01": {"action": "init", "conditions": [{"name": "ARGS:sac_text", "type": "exists"}, {"name": "ARGS:sac_text", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[\\\\s/][^>]*on[a-z]+=|<img[\\\\s/][^>]*on(?:error|load)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*=)~i"}], "cve": "CVE-2026-2987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2987", "description": "Simple Ajax Chat <=20260217 unauthenticated stored XSS via chat message", "method": "POST", "mode": "block", "severity": 6.1, "slug": "simple-ajax-chat", "tags": ["xss", "stored-xss", "unauthenticated"], "target": "plugin", "versions": "<=20260217"}, "RULE-CVE-2026-2993-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:table", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 missing authorization on waic_* AJAX actions allows unauthenticated access to getListForTbl data endpoint", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["missing-authorization", "sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via orderby parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-2993-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^waic_~i"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\'[^\']*\'\\\\s*=\\\\s*\'[^\']*\'|\\\\b(?:OR|AND)\\\\s+1\\\\s*=\\\\s*1)~i"}], "cve": "CVE-2026-2993", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-2993", "description": "AI Copilot Content Generator <1.4.18 SQL injection via search parameter in waic_* AJAX handler getListForTbl", "method": "POST", "mode": "block", "severity": 7.5, "slug": "ai-copilot-content-generator", "tags": ["sql-injection", "unauthenticated", "cwe-89"], "target": "plugin", "versions": ">=1.4.0 <1.4.18"}, "RULE-CVE-2026-3003-01": {"action": "admin_init", "conditions": [{"name": "ARGS:vagaro_command", "type": "regex", "value": "~^(?:Add|Update)$~i"}, {"name": "ARGS:vagaro_code", "type": "regex", "value": "~(?:<(?:script|svg|math|embed|object)[^>]*|&#(?:0*60|x0*3c);?(?:script|svg|math|embed|object)|on[a-z]{3,16}[[:space:]]*=|javascript[[:space:]]*:|&#(?:0*106|x0*6a);?&#(?:0*97|x0*61);?&#(?:0*118|x0*76);?&#(?:0*97|x0*61);?&#(?:0*115|x0*73);?&#(?:0*99|x0*63);?&#(?:0*114|x0*72);?&#(?:0*105|x0*69);?&#(?:0*112|x0*70);?&#(?:0*116|x0*74);?[[:space:]]*:)~i"}], "cve": "CVE-2026-3003", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3003", "description": "Vagaro Booking Widget <=0.3 unauthenticated stored XSS via vagaro_code on admin_init POST handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "vagaro-booking-widget", "tags": ["xss", "stored-xss", "unauthenticated", "admin-post"], "target": "plugin", "versions": "<=0.3"}, "RULE-CVE-2026-3018-01": {"ajax_action": "newsletters_api", "conditions": [{"name": "ARGS:wpmlsubscriber_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-3018", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3018", "description": "Newsletters <=4.13 unauthenticated time-based SQL injection via wpmlsubscriber_id parameter in newsletters_api AJAX handler", "mode": "block", "severity": 7.5, "slug": "newsletters-lite", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-3056-01": {"ajax_action": "seraph_accel_api", "conditions": [{"name": "ARGS:fn", "type": "equals", "value": "LogClear"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3056", "description": "Seraphinite Accelerator <=2.28.14 missing authorization on LogClear via seraph_accel_api AJAX handler", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3058-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "seraph_accel_api"}, {"name": "ARGS:fn", "type": "equals", "value": "GetData"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3058", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3058", "description": "Seraphinite Accelerator <=2.28.14 unauthenticated sensitive information exposure via admin-post.php nopriv route with fn=GetData", "mode": "block", "severity": 4.3, "slug": "seraphinite-accelerator", "tags": ["missing-authorization", "information-exposure", "unauthenticated"], "target": "plugin", "versions": "<=2.28.14"}, "RULE-CVE-2026-3090-01": {"ajax_action": "ps-get-email-logs", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<script|</script|<[^>]+on[a-zA-Z]+[[:space:]]*=|javascript[[:space:]]*:)~i"}], "cve": "CVE-2026-3090", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3090", "description": "Post SMTP <=3.8.0 stored XSS via unescaped event_type rendering in ps-get-email-logs AJAX response", "method": "POST", "mode": "block", "severity": 7.2, "slug": "post-smtp", "tags": ["xss", "stored-xss", "ajax", "email-logs"], "target": "plugin", "versions": "<=3.8.0"}, "RULE-CVE-2026-3098-01": {"ajax_action": "smart-slider3", "conditions": [{"name": "ARGS:nextendcontroller", "type": "regex", "value": "~^sliders?$~i"}, {"name": "ARGS:nextendaction", "type": "regex", "value": "~^export~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3098", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3098", "description": "Smart Slider 3 <=3.5.1.33 arbitrary file read via export \\u2014 restricts slider export to admins only (blocks subscriber/editor-level exploitation)", "method": "POST", "mode": "block", "severity": 6.5, "slug": "smart-slider-3", "tags": ["arbitrary-file-read", "lfi", "missing-authorization"], "target": "plugin", "versions": "<=3.5.1.33"}, "RULE-CVE-2026-3132-01": {"ajax_action": "jltma_widget_render_preview", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_render_preview AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-02": {"ajax_action": "jltma_widget_save_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) RCE via jltma_widget_save_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "remote-code-execution", "code-injection"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-03": {"ajax_action": "jltma_widget_get_data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized data access via jltma_widget_get_data AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-04": {"ajax_action": "jltma_widget_delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized widget deletion via jltma_widget_delete AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-05": {"ajax_action": "jltma_widget_update_category", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized category update via jltma_widget_update_category AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-06": {"ajax_action": "jltma_widget_get_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions read via jltma_widget_get_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3132-07": {"ajax_action": "jltma_widget_save_conditions", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3132", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3132", "description": "Master Addons for Elementor <=2.1.3 authenticated (Subscriber+) unauthorized conditions save via jltma_widget_save_conditions AJAX handler missing capability check", "method": "POST", "mode": "block", "severity": 8.8, "slug": "master-addons", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-3138-01": {"ajax_action": "delete", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3138", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3138", "description": "Product Filter for WooCommerce by WBW <=3.1.2 missing authorization on delete AJAX handler allows unauthenticated filter data deletion", "mode": "block", "severity": 6.5, "slug": "woo-product-filter", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.1.2"}, "RULE-CVE-2026-3143-01": {"ajax_action": "boldgrid_cli_cancel_rollback", "conditions": [{"type": "missing_capability", "value": "update_plugins"}], "cve": "CVE-2026-3143", "description": "Total Upkeep (boldgrid-backup) <=1.17.1 missing authorization on boldgrid_cli_cancel_rollback AJAX action allows unauthenticated rollback cancellation", "mode": "block", "severity": 5.3, "slug": "boldgrid-backup", "target": "plugin", "versions": "<=1.17.1"}, "RULE-CVE-2026-3178-01": {"action": "init", "conditions": [{"name": "ARGS:name_directory_name", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|&lt;|&gt;~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_name parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3178-02": {"action": "init", "conditions": [{"name": "ARGS:name_directory_description", "type": "regex", "value": "~<[a-zA-Z/!][^>]*>|&#(?:0*6[02]|x0*3[cCeE]);|&lt;|&gt;~i"}, {"name": "ARGS:directory", "type": "exists"}], "cve": "CVE-2026-3178", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3178", "description": "Name Directory <=1.32.1 unauthenticated stored XSS via name_directory_description parameter in public submission form", "method": "POST", "mode": "block", "severity": 7.2, "slug": "name-directory", "tags": ["xss", "stored-xss", "unauthenticated", "shortcode"], "target": "plugin", "versions": "<=1.32.1"}, "RULE-CVE-2026-3180-01": {"ajax_action": "post_cg1l_resend_unconfirmed_mail_frontend", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg1l_resend_unconfirmed_mail_frontend", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-02": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgl_mail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.4 unauthenticated SQL injection via cgl_mail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.4"}, "RULE-CVE-2026-3180-03": {"ajax_action": "post_cg_login", "conditions": [{"name": "ARGS:cgLostPasswordEmail", "type": "regex", "value": "~\'[ \\t]*(?:OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|HAVING|ORDER|GROUP)[ \\t]|\'[ \\t]*--|\'[ \\t]*/[*]|\'[ \\t]*#~i"}], "cve": "CVE-2026-3180", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3180", "description": "Contest Gallery <=28.1.3 unauthenticated SQL injection via cgLostPasswordEmail in post_cg_login", "method": "POST", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=28.1.3"}, "RULE-CVE-2026-31921-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcpr(?:update|settings_update)(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprupdate REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-31921-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcpr/api/wcprsettings_update(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-31921", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-31921", "description": "Product Rearrange for WooCommerce <=1.2.2 unauthenticated broken access control on wcprsettings_update REST route", "mode": "block", "severity": 8.2, "slug": "products-rearrange-woocommerce", "tags": ["missing-authorization", "broken-access-control", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-3222-01": {"ajax_action": "wpgmp_ajax_call", "conditions": [{"name": "ARGS:location_id", "type": "regex", "value": "~(?:UNION[^a-zA-Z]+(?:ALL[^a-zA-Z]+)?SELECT|(?:AND|OR)[^a-zA-Z]+(?:SLEEP|BENCHMARK|IF|CASE)[^a-zA-Z]*[(]|(?:AND|OR)[^a-zA-Z]+[0-9]+[^a-zA-Z]*=[^a-zA-Z]*[0-9]|SLEEP[^a-zA-Z]*[(]|BENCHMARK[^a-zA-Z]*[(])~i"}], "cve": "CVE-2026-3222", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3222", "description": "WP Maps <=4.9.1 unauthenticated time-based blind SQL injection via location_id parameter in wpgmp_ajax_call AJAX handler", "mode": "block", "severity": 7.5, "slug": "wp-google-map-plugin", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=4.9.1"}, "RULE-CVE-2026-3226-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lp/v1/send-email(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3226", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3226", "description": "LearnPress <=4.3.2.8 missing authorization on SendEmailAjax REST endpoints allows Subscriber+ to trigger arbitrary email notifications", "method": "POST", "mode": "block", "severity": 4.3, "slug": "learnpress", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-3228-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:snapFB", "type": "regex", "value": "~(?:<script[ />]|<svg[ />]|on(?:error|load|click|mouseover|focus)[ ]*=|javascript[ ]*:)~i"}], "cve": "CVE-2026-3228", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3228", "description": "NextScripts: Social Networks Auto-Poster <=4.4.6 Stored XSS via snapFB post meta parameter during post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "social-networks-auto-poster-facebook-twitter-g", "tags": ["xss", "stored-xss", "shortcode"], "target": "plugin", "versions": "<=4.4.6"}, "RULE-CVE-2026-32358-01": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_booking_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via date interval parameters in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-32358-02": {"ajax_action": "WPBC_AJX_BOOKING_LISTING", "conditions": [{"name": "ARGS:wh_modification_date", "type": "detectSQLi"}], "cve": "CVE-2026-32358", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32358", "description": "Booking Calendar <=10.14.15 blind SQL injection via modification date interval parameter in WPBC_AJX_BOOKING_LISTING AJAX handler", "method": "POST", "mode": "block", "severity": 7.6, "slug": "booking", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=10.14.15"}, "RULE-CVE-2026-3239-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in post editor", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-3239-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[testimonial_view\\\\b[^\\\\]]*(?:on[a-z]+\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|<[a-z][^>]*on[a-z]+\\\\s*=)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3239", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3239", "description": "Strong Testimonials <=3.2.21 stored XSS via testimonial_view shortcode attributes in REST API post creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "strong-testimonials", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=3.2.21"}, "RULE-CVE-2026-32399-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[s] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?i)(?:SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|EXTRACTVALUE[ ]*[(]|UPDATEXML[ ]*[(]|IF[ ]*[(]|[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[order] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32399-04": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[post_mime_type]", "type": "regex", "value": "~(?i)(?:[\'\\"` ][ ]*(?:OR|AND)[ ]+[\'\\"`0-9]|SELECT[ (]+.*FROM[ ]+|SLEEP[ ]*[(]|BENCHMARK[ ]*[(]|UNION[ ]+(?:ALL[ ]+)?SELECT[ ]+|/[*].*[*]/)~"}], "cve": "CVE-2026-32399", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32399", "description": "Media Library Assistant <=3.32 authenticated SQL injection via query[post_mime_type] in query-attachments AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=3.32"}, "RULE-CVE-2026-32413-01": {"ajax_action": "pm_get_uri_editor", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe)[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 reflected XSS via post_id parameter in pm_get_uri_editor Gutenberg endpoint", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-02": {"ajax_action": "pm_bulk_tools", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_bulk_tools allows subscriber+ privilege escalation", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32413-03": {"ajax_action": "pm_detect_duplicates", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32413", "description": "Permalink Manager <=2.5.2.4 missing authorization on pm_detect_duplicates allows subscriber+ data access", "mode": "block", "severity": 5.3, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.2.4"}, "RULE-CVE-2026-32414-01": {"ajax_action": "awl-getRuleGroup", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getRuleGroup AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-02": {"ajax_action": "awl-getSuboptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSuboptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-03": {"ajax_action": "awl-getSelectOptionValues", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-getSelectOptionValues AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-04": {"ajax_action": "awl-changeLabelStatus", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-changeLabelStatus AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32414-05": {"ajax_action": "awl-showCurrentHooks", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~(?:^|\\\\\\\\)(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|mail|wp_mail|update_option|delete_option|add_option|file_put_contents|file_get_contents|fopen|fwrite|unlink)$~i"}], "cve": "CVE-2026-32414", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32414", "description": "Advanced Woo Labels <=2.36 authenticated code injection via arbitrary callback in awl-showCurrentHooks AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "advanced-woo-labels", "tags": ["code-injection", "rce", "authenticated", "ajax"], "target": "plugin", "versions": "<=2.36"}, "RULE-CVE-2026-32423-01": {"ajax_action": "svg_get_attachment_url", "conditions": [{"name": "ARGS:attachmentID", "type": "regex", "value": "~^\\\\d+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32423", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32423", "description": "Admin Site Enhancements <=8.4.0 missing authorization on svg_get_attachment_url allows contributor+ access to arbitrary attachment URLs", "method": "POST", "mode": "block", "severity": 5.4, "slug": "admin-site-enhancements", "tags": ["missing-authorization", "broken-access-control", "information-disclosure"], "target": "plugin", "versions": "<=8.4.0"}, "RULE-CVE-2026-3243-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/amem/avatar/v1/crop(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via REST /amem/avatar/v1/crop leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "rest-api"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-3243-02": {"ajax_action": "amem_avatar_crop", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-3243", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3243", "description": "Advanced Members <=1.2.5 authenticated path traversal via amem_avatar_crop AJAX handler leading to arbitrary file deletion", "mode": "block", "severity": 8.8, "slug": "advanced-members", "tags": ["path-traversal", "arbitrary-file-deletion", "ajax"], "target": "plugin", "versions": "<=1.2.5"}, "RULE-CVE-2026-32441-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "export"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized comment export via catch_export_request on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32441-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "hw_cmt_csv_im_ex"}, {"name": "ARGS:action", "type": "equals", "value": "settings"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32441", "description": "Comments Import & Export <=2.4.9 authenticated (Subscriber+) unauthorized settings modification via catch_save_settings on init hook", "mode": "block", "severity": 7.7, "slug": "comments-import-export-woocommerce", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-32459-01": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:order_by", "type": "regex", "value": "~[^a-zA-Z0-9_-]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via order_by parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-02": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:limit", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via limit parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32459-03": {"ajax_action": "cuw_ajax", "conditions": [{"name": "ARGS:offset", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-32459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32459", "description": "UpsellWP <=2.2.4 SQL injection via offset parameter in cuw_ajax handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "checkout-upsell-and-order-bumps", "tags": ["sql-injection", "blind-sqli", "ajax"], "target": "plugin", "versions": "<=2.2.4"}, "RULE-CVE-2026-32461-01": {"ajax_action": "rsssl_force_confirm_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_force_confirm_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32461-02": {"ajax_action": "rsssl_resend_verification_email", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32461", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32461", "description": "Really Simple SSL <=9.5.7 missing authorization on rsssl_resend_verification_email AJAX handler", "mode": "block", "severity": 5.3, "slug": "really-simple-ssl", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=9.5.7"}, "RULE-CVE-2026-32484-03": {"ajax_action": "weforms_import_form", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)(?:wp-admin/admin-ajax\\\\.php)(?:\\\\?|$)~"}, {"name": "ARGS:file_content", "type": "regex", "value": "~(?:O|C):\\\\d+:[^;]{0,256}[{\\"]~"}], "cve": "CVE-2026-32484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32484", "description": "weForms <=1.6.26 authenticated PHP object injection via form import in weforms_import_form AJAX handler", "mode": "block", "severity": 8.8, "slug": "weforms", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=1.6.26"}, "RULE-CVE-2026-32485-01": {"ajax_action": "wpuf_draft_post", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32485", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32485", "description": "WP User Frontend <=4.2.8 unauthenticated broken access control allows modifying arbitrary draft posts via wpuf_draft_post AJAX action with post_id parameter", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-user-frontend", "tags": ["broken-access-control", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=4.2.8"}, "RULE-CVE-2026-32494-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|img|svg|details|math)[\\\\s/>])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via type parameter in admin notices", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32494-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^ays-slider~"}, {"name": "ARGS:slider", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|img|svg|details|math)[\\\\s/>])~i"}], "cve": "CVE-2026-32494", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32494", "description": "Image Slider by Ays <=2.7.1 reflected XSS via slider parameter in admin actions page", "method": "GET", "mode": "block", "severity": 7.1, "slug": "ays-slider", "tags": ["xss", "reflected", "admin-page"], "target": "plugin", "versions": "<=2.7.1"}, "RULE-CVE-2026-32498-01": {"ajax_action": "rm_options_default_payment_method", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32498", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32498", "description": "RegistrationMagic <=6.0.7.6 missing authorization on rm_options_default_payment_method AJAX handler allows authenticated users to modify payment settings", "mode": "block", "severity": 7.5, "slug": "custom-registration-form-builder-with-submission-manager", "tags": ["missing-authorization", "broken-access-control", "settings-change"], "target": "plugin", "versions": "<=6.0.7.6"}, "RULE-CVE-2026-32499-01": {"action": "init", "conditions": [{"name": "ARGS:qc_bot_str_fields", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via qc_bot_str_fields on init hook", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32499-02": {"ajax_action": "wpbo_search_site", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|(?:[\'\\"][0-9])\\\\s*AND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|SLEEP\\\\s*\\\\(\\\\s*[0-9]|BENCHMARK\\\\s*\\\\(\\\\s*[0-9]|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[a-zA-Z0-9_]+\\\\s*(?:--|#)\\\\s|[\'\\"]\\\\s*--\\\\s|[0-9]\\\\s*--\\\\s)~i"}], "cve": "CVE-2026-32499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32499", "description": "ChatBot <=7.7.9 unauthenticated blind SQL injection via s parameter in wpbo_search_site AJAX handler", "mode": "block", "severity": 9.3, "slug": "chatbot", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": "<=7.7.9"}, "RULE-CVE-2026-32513-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:\\"~"}], "cve": "CVE-2026-32513", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32513", "description": "JS Archive List <=6.1.7 PHP Object Injection via serialized included/excluded widget settings", "mode": "block", "severity": 8.8, "slug": "jquery-archive-list-widget", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.1.7"}, "RULE-CVE-2026-32517-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via s (search) parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "ARGS:paged", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via paged parameter on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "contact-manager-form"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via form-page parameters (id, name, description, etc.)", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32517-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^contact-manager-~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32517", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32517", "description": "Contact Manager <=9.1 reflected XSS via REQUEST_URI on admin pages", "method": "GET", "mode": "block", "severity": 7.1, "slug": "contact-manager", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=9.1"}, "RULE-CVE-2026-32520-01": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~(?:administrator|editor|author|shop_manager)~i"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member role parameter", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32520-02": {"ajax_action": "rewardswp_create_member", "conditions": [{"name": "ARGS_NAMES", "type": "regex", "value": "~wp_capabilities\\\\[~"}], "cve": "CVE-2026-32520", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32520", "description": "RewardsWP <=1.0.4 unauthenticated privilege escalation via rewardswp_create_member wp_capabilities array injection", "mode": "block", "severity": 9.8, "slug": "rewardswp", "tags": ["privilege-escalation", "incorrect-privilege-assignment", "unauthenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-32525-01": {"ajax_action": "jet_fb_ssr_validation_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:^|[\\\\s\\"\',=:])(?:(?:system|exec|passthru|eval|assert|include|include_once|require|require_once)\\\\s*\\\\(|(?:shell_exec|popen|proc_open|pcntl_exec|create_function|call_user_func|call_user_func_array|unserialize|maybe_unserialize|file_get_contents|file_put_contents|fwrite|fopen|curl_exec|preg_replace_callback|array_map|array_filter|array_reduce|usort|uasort|uksort|array_walk|array_walk_recursive)(?:[\\\\s\\"\',;(]|$))~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation AJAX handler", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32525-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/jet-form-builder/v1/validate-field(?:[/?]|$)~i"}, {"name": "ARGS:callable", "type": "regex", "value": "~^(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|assert|eval|create_function|call_user_func|call_user_func_array)$~i"}], "cve": "CVE-2026-32525", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32525", "description": "JetFormBuilder <=3.5.6.1 unauthenticated RCE via dangerous callback in SSR validation REST endpoint", "mode": "block", "severity": 9.9, "slug": "jetformbuilder", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.5.6.1"}, "RULE-CVE-2026-32530-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/courses(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API course endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/quiz(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API quiz endpoints", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32530-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/creator-lms/v1/migration(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32530", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32530", "description": "Creator LMS <=1.1.18 privilege escalation via missing authorization on REST API migration endpoint", "mode": "block", "severity": 8.8, "slug": "creatorlms", "tags": ["privilege-escalation", "missing-authorization", "rest-api"], "target": "plugin", "versions": "<=1.1.18"}, "RULE-CVE-2026-32532-01": {"ajax_action": "Save_Form_Data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<iframe[\\\\s/]|<embed[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-32532", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32532", "description": "Lead Form Builder <=2.0.1 unauthenticated stored XSS via Save_Form_Data form submission fields", "mode": "block", "severity": 7.1, "slug": "lead-form-builder", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.0.1"}, "RULE-CVE-2026-32533-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php$~"}, {"name": "ARGS:action", "type": "equals", "value": "latepoint_route_call"}, {"name": "ARGS:route_name", "type": "regex", "value": "~^(bookings|customers|agents|services|locations|transactions|coupons|settings|orders)(__|\\\\.)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-32533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32533", "description": "LatePoint <=5.2.6 IDOR via admin-post.php latepoint_route_call endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "latepoint", "tags": ["insecure-direct-object-reference", "missing-authorization"], "target": "plugin", "versions": "<=5.2.6"}, "RULE-CVE-2026-32537-01": {"ajax_action": "vp_dynamic_control_callback", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-32537", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32537", "description": "Visual Portfolio <=3.5.1 authenticated local file inclusion via path traversal in vp_dynamic_control_callback AJAX handler", "mode": "block", "severity": 7.5, "slug": "visual-portfolio", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=3.5.1"}, "RULE-CVE-2026-32539-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q list table s parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:post_author", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q post_author parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:post_status", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q post_status parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-q"}, {"name": "ARGS:ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-q ids parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-05": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-archive"}, {"name": "ARGS:s", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-archive s parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-06": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "revisionary-archive"}, {"name": "ARGS:origin_post_author", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via page=revisionary-archive origin_post_author parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32539-07": {"ajax_action": "get-revision-diffs", "conditions": [{"name": "ARGS:post_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]|CASE\\\\s+WHEN\\\\b.{1,50}?\\\\bTHEN\\\\b)~i"}], "cve": "CVE-2026-32539", "description": "Revisionary <=3.7.23 SQL injection via get-revision-diffs AJAX post_ids parameter", "mode": "block", "severity": 9.3, "slug": "revisionary", "target": "plugin", "versions": "<=3.7.23"}, "RULE-CVE-2026-32544-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/register/?(?:\\\\?|$)~"}, {"name": "ARGS:signup_username", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[^>]*onload\\\\s*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_username on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/register/?(?:\\\\?|$)~"}, {"name": "ARGS:signup_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg[^>]*onload\\\\s*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via BuddyPress signup_email on bp_signup_validate", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "buddypress"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:comment", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg(?:[\\\\s>/]|/)[^>]*onload(?:\\\\s|/)*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz comment field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:author", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg(?:[\\\\s>/]|/)[^>]*onload(?:\\\\s|/)*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz author field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32544-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-comments-post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:email", "type": "regex", "value": "~(?:<script[\\\\s/>]|<svg(?:[\\\\s>/]|/)[^>]*onload(?:\\\\s|/)*=|<img[^>]*onerror\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-32544", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32544", "description": "OOPSpam Anti-Spam <=1.2.62 stored XSS via wpDiscuz email field on wpdiscuz_before_comment_post", "method": "POST", "mode": "block", "severity": 7.1, "slug": "oopspam-anti-spam", "tags": ["xss", "stored", "unauthenticated", "wpdiscuz"], "target": "plugin", "versions": "<=1.2.62"}, "RULE-CVE-2026-32545-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script(?![\\\\s]+src\\\\s*=\\\\s*[\'\\"]https://)[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+\\\\bonerror\\\\b|<svg[^>]+\\\\bonload\\\\b|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-32545", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32545", "description": "Taboola Pixel <=1.1.4 unauthenticated reflected XSS via front-end query parameters", "mode": "block", "severity": 7.1, "slug": "taboola-pixel", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-32546-01": {"action": "init", "conditions": [{"name": "ARGS:rcp_action", "type": "equals", "value": "toggle_auto_renew_off"}, {"name": "ARGS:membership_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-32546", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32546", "description": "Restrict Content <=3.2.22 unauthenticated membership auto-renew toggle via rcp_action parameter", "mode": "block", "severity": 7.5, "slug": "restrict-content", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=3.2.22"}, "RULE-CVE-2026-32573-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/nab/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<\\\\?(?:php)?|\\\\b(?:eval|assert|system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec)\\\\s*\\\\(|\\\\b(?:include|require)(?:_once)?\\\\s*\\\\(|`[^`]+`)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-32573", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-32573", "description": "Nelio A/B Testing <=8.2.7 authenticated (Editor+) remote code execution via PHP snippet scope rules on non-PHP experiment types", "method": "POST", "mode": "block", "severity": 9.1, "slug": "nelio-ab-testing", "tags": ["remote-code-execution", "code-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-3296-01": {"ajax_action": "everest_forms_ajax_form_submission", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (AJAX path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3296-02": {"action": "init", "conditions": [{"name": "ARGS:everest_forms[form_id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:\\\\d+:[\\"\\\\{]~"}], "cve": "CVE-2026-3296", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3296", "description": "Everest Forms <=3.4.3 unauthenticated PHP object injection via serialized payload in form field submission (non-AJAX init path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["object-injection", "deserialization", "unauthenticated", "stored"], "target": "plugin", "versions": "<=3.4.3"}, "RULE-CVE-2026-3297-01": {"ajax_action": "pagelayer_save_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3297-02": {"ajax_action": "pagelayer_save_templ_content", "conditions": [{"name": "ARGS:pagelayer_content", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3297", "description": "Pagelayer <=2.0.9 stored XSS via Anchor block custom_anchor attribute in pagelayer_save_templ_content", "mode": "block", "severity": 6.4, "slug": "pagelayer", "target": "plugin", "versions": "<=2.0.9"}, "RULE-CVE-2026-3300-01": {"action": "wp", "conditions": [{"name": "ARGS:everest_forms[id]", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:[`]|\\\\$\\\\{|\\\\bsystem\\\\s*\\\\(|\\\\bexec\\\\s*\\\\(|\\\\bpassthru\\\\s*\\\\(|\\\\bshell_exec\\\\s*\\\\(|\\\\bpopen\\\\s*\\\\(|\\\\bproc_open\\\\s*\\\\(|\\\\beval\\\\s*\\\\(|\\\\bbase64_decode\\\\s*\\\\(|\\\\bfile_(?:get|put)_contents\\\\s*\\\\(|\\\\bcurl_exec\\\\s*\\\\()~i"}], "cve": "CVE-2026-3300", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3300", "description": "Everest Forms <=1.9.9 unauthenticated RCE via Calculation Addon process_filter() eval injection through form field values", "method": "POST", "mode": "block", "severity": 9.8, "slug": "everest-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated"], "target": "plugin", "versions": "<=1.9.9"}, "RULE-CVE-2026-3328-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[redirect]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[redirect] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_url]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_url] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[update_message]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[update_message] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3328-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:post_type", "type": "equals", "value": "admin_form"}, {"name": "ARGS:action", "type": "equals", "value": "editpost"}, {"name": "ARGS:form[custom_fields_save]", "type": "regex", "value": "~(?:^|;)(?:O|C|a):\\\\d+:[\\\\\\"{]~"}], "cve": "CVE-2026-3328", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3328", "description": "Frontend Admin by DynamiApps <=3.28.31 authenticated (Editor+) PHP Object Injection via form[custom_fields_save] in admin_form post save", "method": "POST", "mode": "block", "severity": 7.2, "slug": "acf-frontend-form-element", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=3.28.31"}, "RULE-CVE-2026-3352-01": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3352-02": {"action": "admin_init", "conditions": [{"name": "ARGS:easy_php_settings_wp_memory_settings[wp_max_memory_limit]", "type": "regex", "value": "~[\';$(){}]~"}], "cve": "CVE-2026-3352", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3352", "description": "Easy PHP Settings <=1.0.4 PHP code injection via wp_max_memory_limit in update_wp_memory_constants()", "method": "POST", "mode": "block", "severity": 7.2, "slug": "easy-php-settings", "tags": ["code-injection", "php-code-injection", "authenticated"], "target": "plugin", "versions": "<=1.0.4"}, "RULE-CVE-2026-3353-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/options\\\\.php(?:$|\\\\?)~"}, {"name": "ARGS:option_page", "type": "equals", "value": "csw-settings-group"}, {"name": "ARGS:csw_api_key", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|style|link|body|input|details|video|audio|source|math|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|submit|change|input|toggle|animationstart|animationend|animationiteration)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*[a-z]+/[a-z+.\\\\-]+\\\\s*;\\\\s*base64|[\\"\'][\\\\s/]*on[a-z]+\\\\s*=|[\\"\']\\\\s*>\\\\s*<)~i"}], "cve": "CVE-2026-3353", "description": "Comment SPAM Wiper <=1.2.1 authenticated (admin) stored XSS via csw_api_key option saved through WordPress Settings API", "mode": "block", "severity": 4.4, "slug": "comment-spam-wiper", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-3354-01": {"action": "admin_post_wikilookup_settings_form_response", "conditions": [{"name": "ARGS:popup_width", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-3354", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3354", "description": "WikiLookup <=1.1.5 stored XSS via Popup Width setting in admin panel", "mode": "block", "severity": 4.4, "slug": "wikilookup", "tags": ["xss", "stored-xss", "authenticated"], "target": "plugin", "versions": "<=1.1.5"}, "RULE-CVE-2026-3360-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:tutor_action", "type": "equals", "value": "pay_incomplete_order"}, {"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-3360", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3360", "description": "Tutor LMS <=3.9.7 unauthenticated IDOR billing profile overwrite via pay_incomplete_order", "method": "POST", "mode": "block", "severity": 7.5, "slug": "tutor", "tags": ["missing-authorization", "idor", "unauthenticated", "data-tampering"], "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-3454-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/generateblocks/v1/dynamic-tag-replacements(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\{\\\\{\\\\s*(?:post_meta|post_title|post_excerpt|post_content|post_date|post_author|post_status|author_email)\\\\s[^}]*\\\\bid\\\\s*:\\\\s*[0-9]~i"}], "cve": "CVE-2026-3454", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3454", "description": "GenerateBlocks <=2.2.0 IDOR information disclosure via dynamic tag id parameter in REST endpoint", "mode": "block", "severity": 6.5, "slug": "generateblocks", "tags": ["idor", "information-disclosure", "authenticated", "rest-api"], "target": "plugin", "versions": "<=2.2.0"}, "RULE-CVE-2026-3456-01": {"ajax_action": "geekybot_ajax", "conditions": [{"name": "ARGS:attributekey", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\s+WHEN\\\\b)~i"}], "cve": "CVE-2026-3456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3456", "description": "GeekyBot <=1.2.0 unauthenticated SQL injection via attributekey in geekybot_ajax", "mode": "block", "severity": 7.5, "slug": "geeky-bot", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-3456-02": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "ARGS:attributekey", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s*\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\s+WHEN\\\\b)~i"}], "cve": "CVE-2026-3456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3456", "description": "GeekyBot <=1.2.0 unauthenticated SQL injection via attributekey in geekybot_frontendajax", "mode": "block", "severity": 7.5, "slug": "geeky-bot", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.2.0"}, "RULE-CVE-2026-3459-01": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~[*]~"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file upload via wildcard supported_type parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-upload", "unauthenticated", "file-type-validation"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3459-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "ARGS:supported_type", "type": "regex", "value": "~(?:^|,|[|])\\\\s*\\\\.?(?:ph(?:p[0-9]?|s|tml?|t|ar)|shtml?|cgi|asp|aspx|jsp|jspx)\\\\s*(?:,|[|]|$)~i"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file upload via dangerous extensions in supported_type", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-upload", "unauthenticated", "file-type-validation"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3459-03": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|/etc/passwd|(?:^|[\\\\/])(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log)$)~i"}], "cve": "CVE-2026-3459", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3459", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.5 unauthenticated arbitrary file deletion via path traversal in delete handler", "method": "POST", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["arbitrary-file-deletion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.5"}, "RULE-CVE-2026-3464-01": {"ajax_action": "cuar_attach_file", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:/|\\\\\\\\)etc(?:/|\\\\\\\\)passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-3464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3464", "description": "WP Customer Area <=8.3.4 authenticated arbitrary file read/deletion via path traversal in cuar_attach_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "customer-area", "tags": ["path-traversal", "arbitrary-file-read", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2026-3464-02": {"ajax_action": "cuar_remove_attached_file", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:/|\\\\\\\\)etc(?:/|\\\\\\\\)passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-3464", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3464", "description": "WP Customer Area <=8.3.4 authenticated arbitrary file deletion via path traversal in cuar_remove_attached_file AJAX handler", "mode": "block", "severity": 8.8, "slug": "customer-area", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=8.3.4"}, "RULE-CVE-2026-3488-01": {"ajax_action": "wp_statistics_getPrivacyStatus", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3488", "description": "WP Statistics <=14.16.4 missing authorization on getPrivacyStatus AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-3488-02": {"ajax_action": "wp_statistics_updatePrivacyStatus", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3488", "description": "WP Statistics <=14.16.4 missing authorization on updatePrivacyStatus AJAX handler", "mode": "block", "severity": 6.5, "slug": "wp-statistics", "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-34885-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[s]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|--\\\\s*$|[\'\\")0-9]\\\\s*#[\\\\s\\\\S]*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[s] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34885-02": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[mla_search_value]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|[\'\\")0-9]\\\\s*(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[mla_search_value] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34885-03": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "query-attachments"}, {"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT[\\\\s/\\\\*]+|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE)[\\\\s/\\\\*]+|,[\\\\s/\\\\*]*\\\\([\\\\s/\\\\*]*SELECT[\\\\s/\\\\*]+|\\\\b(?:OR|AND)[\\\\s/\\\\*]+[\'\\"]?[0-9]+[\'\\"]?[\\\\s/\\\\*]*=[\\\\s/\\\\*]*[\'\\"]?[0-9]+|/\\\\*[\\\\S\\\\s]*?\\\\*/|[\'\\")0-9]\\\\s*(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-34885", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34885", "description": "Media Library Assistant <=3.34 authenticated SQL injection via query[orderby] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "tags": ["sql-injection", "authenticated", "media-library"], "target": "plugin", "versions": "<=3.34"}, "RULE-CVE-2026-34886-01": {"ajax_action": "swpm_process_pp_smart_checkout", "conditions": [{"name": "ARGS:button_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 unauthenticated broken access control on PayPal smart checkout AJAX handler", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-34886-02": {"ajax_action": "swpm_stripe_sca_create_checkout_session", "conditions": [{"name": "ARGS:button_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 unauthenticated broken access control on Stripe SCA checkout session AJAX handler", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-34886-03": {"ajax_action": "swpm_reset_log_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34886", "description": "Simple Membership <=4.7.1 missing authorization on log reset AJAX handler allows subscriber+ log deletion", "mode": "block", "severity": 7.5, "slug": "simple-membership", "target": "plugin", "versions": "<=4.7.1"}, "RULE-CVE-2026-3489-01": {"ajax_action": "directorypress_handler_request", "conditions": [{"name": "ARGS:packages", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-3489", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3489", "description": "DirectoryPress <=3.6.26 unauthenticated SQL injection via packages parameter in handler_request AJAX handler", "mode": "block", "severity": 7.5, "slug": "directorypress", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.6.26"}, "RULE-CVE-2026-34896-01": {"action": "admin_init", "conditions": [{"name": "ARGS:ucmm-review-dismiss", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34896", "description": "Under Construction, Coming Soon & Maintenance Mode <=2.1.1 CSRF via ucmm-review-dismiss parameter on admin_init \\u2014 blocks non-admin exploitation only (CSRF against admin victims is not WAF-coverable without header inspection)", "mode": "block", "severity": 7.5, "slug": "under-construction-maintenance-mode", "tags": ["csrf", "cross-site-request-forgery", "state-change"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-34900-01": {"action": "init", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?(?:iframe|object|embed|svg|body|img|input|form|details|marquee|isindex|meta)\\\\b[^>]*(?:on[a-z]+=|src\\\\s*=\\\\s*[\\"\']?javascript))~i"}], "cve": "CVE-2026-34900", "description": "GiveWP <=4.14.2 unauthenticated reflected XSS via search parameter in donation_history shortcode", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.2"}, "RULE-CVE-2026-34902-01": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-34902", "description": "WooCommerce Product Table Lite <=4.6.3 unauthenticated reflected XSS via id parameter in wcpt_ajax", "mode": "block", "severity": 7.1, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-34902-02": {"ajax_action": "wcpt_ajax", "conditions": [{"name": "ARGS:s", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/]|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-34902", "description": "WooCommerce Product Table Lite <=4.6.3 unauthenticated reflected XSS via search parameter s in wcpt_ajax", "mode": "block", "severity": 7.1, "slug": "wc-product-table-lite", "target": "plugin", "versions": "<=4.6.3"}, "RULE-CVE-2026-34903-01": {"ajax_action": "oceanwp_cp_save_panel_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_panel_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-02": {"ajax_action": "oceanwp_cp_save_customizer_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_customizer_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-03": {"ajax_action": "oceanwp_cp_save_integrations_settings", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_integrations_settings AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-04": {"ajax_action": "oceanwp_cp_save_single_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_save_single_option AJAX handler allows subscriber+ settings write", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-05": {"ajax_action": "oceanwp_cp_customizer_reset", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_reset AJAX handler allows subscriber+ theme customizer settings reset", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-06": {"ajax_action": "oceanwp_cp_customizer_export", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_export AJAX handler allows subscriber+ theme customizer data export", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-07": {"ajax_action": "oceanwp_cp_customizer_import", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_customizer_import AJAX handler allows subscriber+ theme customizer data import via file parameter", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-08": {"ajax_action": "oceanwp_cp_child_theme_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_child_theme_install AJAX handler allows subscriber+ arbitrary file write via child theme install", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated", "file-write"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34903-09": {"ajax_action": "oceanwp_cp_system_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34903", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34903", "description": "Ocean Extra <=2.5.3 missing authorization on oceanwp_cp_system_status AJAX handler allows subscriber+ system information disclosure", "mode": "block", "severity": 5.4, "slug": "ocean-extra", "tags": ["missing-authorization", "broken-access-control", "authenticated", "information-disclosure"], "target": "plugin", "versions": "<=2.5.3"}, "RULE-CVE-2026-34904-01": {"action": "admin_init", "conditions": [{"name": "ARGS:set_option_name", "type": "exists"}, {"name": "ARGS:option_value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug set_option allows arbitrary options update", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "options-update", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-34904-02": {"action": "admin_init", "conditions": [{"name": "ARGS:load_option_name", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug load_option allows arbitrary options read", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "information-disclosure", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-34904-03": {"action": "admin_init", "conditions": [{"name": "ARGS:wpb_clear_api_cache", "type": "equals", "value": "true"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-34904", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-34904", "description": "Simple Social Media Share Buttons <=6.2.0 CSRF on wpb-debug clear_cache allows unauthorized cache clearing", "method": "POST", "mode": "block", "severity": 7.5, "slug": "simple-social-buttons", "tags": ["csrf", "broken-access-control"], "target": "plugin", "versions": "<=6.2.0"}, "RULE-CVE-2026-3498-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:blockart/(?:post-template|query-loop)[\\\\s\\\\S]{0,4000}?[\\"\\\\\\\\]clientId[\\"\\\\\\\\]\\\\s*:\\\\s*[\\"\\\\\\\\][^\\"\\\\\\\\]{0,2000}?(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|\\\\\\\\u003[cCeE]|&#x?(?:3[cCeE]|60|62);)~i"}], "cve": "CVE-2026-3498", "description": "BlockArt Blocks <=2.2.15 Author+ stored XSS via clientId attribute in blockart/post-template and blockart/query-loop blocks saved through WP core REST posts/pages endpoints", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "target": "plugin", "versions": "<=2.2.15"}, "RULE-CVE-2026-3498-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:blockart/(?:post-template|query-loop)[\\\\s\\\\S]{0,4000}?[\\"\\\\\\\\]clientId[\\"\\\\\\\\]\\\\s*:\\\\s*[\\"\\\\\\\\][^\\"\\\\\\\\]{0,2000}?(?:<[a-zA-Z/!]|on[a-zA-Z]+\\\\s*=|javascript\\\\s*:|\\\\\\\\u003[cCeE]|&#x?(?:3[cCeE]|60|62);)~i"}], "cve": "CVE-2026-3498", "description": "BlockArt Blocks <=2.2.15 Author+ stored XSS via clientId attribute submitted through classic editor admin-post path", "mode": "block", "severity": 6.4, "slug": "blockart-blocks", "target": "plugin", "versions": "<=2.2.15"}, "RULE-CVE-2026-3499-01": {"ajax_action": "adt_migrate_to_custom_post_type", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3499", "description": "Product Feed PRO for WooCommerce >=13.4.6 <=13.5.2.1 CSRF on adt_migrate_to_custom_post_type AJAX handler", "mode": "block", "severity": 8.8, "slug": "woo-product-feed-pro", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": ">=13.4.6 <=13.5.2.1"}, "RULE-CVE-2026-3499-02": {"ajax_action": "adt_clear_custom_attributes_product_meta_keys", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3499", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3499", "description": "Product Feed PRO for WooCommerce >=13.4.6 <=13.5.2.1 CSRF on adt_clear_custom_attributes_product_meta_keys AJAX handler", "mode": "block", "severity": 8.8, "slug": "woo-product-feed-pro", "tags": ["csrf", "missing-nonce", "state-change"], "target": "plugin", "versions": ">=13.4.6 <=13.5.2.1"}, "RULE-CVE-2026-3533-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "import_popup_action"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3533", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3533", "description": "JupiterX Core <=4.11.0 missing authorization on admin_action_import_popup_action allows low-privilege users to import arbitrary popup templates", "method": "POST", "mode": "block", "severity": 8.8, "slug": "jupiterx-core", "tags": ["arbitrary-file-upload", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=4.11.0"}, "RULE-CVE-2026-3550-04": {"ajax_action": "rockpress_check_services", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3550", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3550", "description": "FT RockPress <=1.0.17 missing authorization on rockpress_check_services AJAX handler allows subscriber+ to perform system connection checks", "mode": "block", "severity": 5.3, "slug": "ft-rockpress", "tags": ["missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.0.17"}, "RULE-CVE-2026-3577-01": {"ajax_action": "update_kbd_bkup_alias", "conditions": [{"name": "ARGS:val", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:iframe|embed|object)[\\\\s/>])~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3577", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3577", "description": "Keep Backup Daily <=2.1.2 authenticated stored XSS via val parameter in update_kbd_bkup_alias AJAX handler", "mode": "block", "severity": 4.4, "slug": "keep-backup-daily", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.2"}, "RULE-CVE-2026-3584-01": {"ajax_action": "kaliforms_form_process", "conditions": [{"name": "ARGS:data[{entryCounter}]", "type": "regex", "value": "~^\\\\\\\\?(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|assert|create_function|call_user_func|call_user_func_array|phpinfo|file_put_contents|file_get_contents|unlink|rmdir|mail|header|preg_replace)$~i"}], "cve": "CVE-2026-3584", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3584", "description": "Kali Forms <=2.4.9 unauthenticated RCE via placeholder overwrite in kaliforms_form_process using {entryCounter}", "method": "POST", "mode": "block", "severity": 9.8, "slug": "kali-forms", "tags": ["code-injection", "remote-code-execution", "unauthenticated", "callable-injection"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-3585-01": {"ajax_action": "tribe_aggregator_create_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|file\\\\s*://)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3585", "description": "The Events Calendar <=6.15.17 authenticated (Author+) arbitrary file read via path traversal in tribe_aggregator_create_import AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.15.17"}, "RULE-CVE-2026-3585-02": {"ajax_action": "tribe_aggregator_create_import", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|(?:^|[\\\\\\\\/])\\\\.env(?:$|[^a-zA-Z0-9])|debug\\\\.log|(?:^|[\\\\\\\\/])error_log(?:$|[^a-zA-Z0-9]))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3585", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3585", "description": "The Events Calendar <=6.15.17 authenticated (Author+) arbitrary file read via sensitive file path in tribe_aggregator_create_import AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "the-events-calendar", "tags": ["path-traversal", "arbitrary-file-read", "authenticated"], "target": "plugin", "versions": "<=6.15.17"}, "RULE-CVE-2026-3589-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wc/store/v1/batch([/?&]|$)~i"}, {"name": "ARGS:requests[/\\\\d+/][path]", "type": "regex", "value": "~^/(?!wc/store[/?])~i"}], "cve": "CVE-2026-3589", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3589", "description": "WooCommerce >=5.4.0 <=10.5.2 CSRF via Store API batch endpoint routing sub-requests to arbitrary non-Store REST endpoints. Covers both form-urlencoded and JSON body (application/json) POST variants via transparent JSON body parsing.", "method": "POST", "mode": "block", "severity": 7.5, "slug": "woocommerce", "tags": ["csrf", "broken-access-control", "rest-api", "batch-route-hijack"], "target": "plugin", "versions": ">=5.4.0 <=10.5.2"}, "RULE-CVE-2026-3614-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:ctrl", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3614", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3614", "description": "AcyMailing 9.11.0-10.8.1 privilege escalation via acymailing_router AJAX to admin controller dispatch", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "ajax"], "target": "plugin", "versions": ">=9.11.0 <=10.8.1"}, "RULE-CVE-2026-3629-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 unauthenticated privilege escalation via wp_capabilities parameter during registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:wp_capabilities", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 authenticated privilege escalation via wp_capabilities parameter during profile update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:wp_capabilities[administrator]", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 privilege escalation via wp_capabilities bracket notation during registration", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "unauthenticated", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3629-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:wp_capabilities[administrator]", "type": "exists"}], "cve": "CVE-2026-3629", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3629", "description": "Import and export users and customers <=1.29.7 privilege escalation via wp_capabilities bracket notation during profile update", "method": "POST", "mode": "block", "severity": 8.1, "slug": "import-users-from-csv-with-meta", "tags": ["privilege-escalation", "improper-privilege-management"], "target": "plugin", "versions": "<=1.29.7"}, "RULE-CVE-2026-3643-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/otm-ac/v1/update-widget-options(?:[/?]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3643", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3643", "description": "Accessibly <=3.0.3 unauthenticated stored XSS via REST API update-widget-options endpoint", "method": "POST", "mode": "block", "severity": 7.2, "slug": "otm-accessibly", "tags": ["xss", "stored", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=3.0.3"}, "RULE-CVE-2026-3655-01": {"ajax_action": "lwp_ajax_register", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "lwp_ajax_register"}, {"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:idToken", "type": "regex", "value": "/^eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.[A-Za-z0-9_\\\\-]{10,}$/"}], "cve": "CVE-2026-3655", "description": "Login With Phone Number >=1.8.50 <=1.8.60 unauthenticated authentication bypass via lwp_ajax_register Firebase phone binding flaw", "mode": "block", "severity": 9.8, "slug": "login-with-phone-number", "target": "plugin", "versions": ">=1.8.50 <=1.8.60"}, "RULE-CVE-2026-3655-02": {"ajax_action": "lwp_ajax_login", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "lwp_ajax_login"}, {"name": "ARGS:phone", "type": "exists"}, {"name": "ARGS:idToken", "type": "regex", "value": "/^eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.eyJ[A-Za-z0-9_\\\\-]{10,}\\\\.[A-Za-z0-9_\\\\-]{10,}$/"}], "cve": "CVE-2026-3655", "description": "Login With Phone Number >=1.8.50 <=1.8.60 unauthenticated authentication bypass via lwp_ajax_login Firebase phone binding flaw", "mode": "block", "severity": 9.8, "slug": "login-with-phone-number", "target": "plugin", "versions": ">=1.8.50 <=1.8.60"}, "RULE-CVE-2026-3657-01": {"ajax_action": "stickymenu_contact_lead_form", "conditions": [{"name": "ARGS:save_form_lead", "type": "exists"}, {"name": "ARGS:/.*(?:`|\'|\\"|[(]|;|--).*/", "type": "exists"}], "cve": "CVE-2026-3657", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3657", "description": "myStickymenu <=2.8.6 unauthenticated SQL injection via crafted POST parameter names in stickymenu_contact_lead_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.5, "slug": "mystickymenu", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.8.6"}, "RULE-CVE-2026-3658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via orderby parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via order parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via search parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3658-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS:filter", "type": "regex", "value": "~(?:UNION[\\\\s/\\\\*]+(?:ALL[\\\\s/\\\\*]+)?SELECT|;[\\\\s/\\\\*]*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--\\\\s|/\\\\*)[\\\\s\\\\S])~i"}], "cve": "CVE-2026-3658", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3658", "description": "Simply Schedule Appointments <=1.6.10.0 unauthenticated SQL injection via filter parameter on REST appointments endpoint", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.10.0"}, "RULE-CVE-2026-3718-01": {"action": "init", "conditions": [{"name": "REQUEST_HEADERS:MWP-Key-Name", "type": "regex", "value": "~(?:<script[^>]*>|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:|svg\\\\s*onload|body\\\\s*onload)~i"}], "cve": "CVE-2026-3718", "description": "Worker <=4.9.31 stored XSS via MWP-Key-Name HTTP header", "mode": "block", "severity": 7.2, "slug": "worker", "target": "plugin", "versions": "<=4.9.31"}, "RULE-CVE-2026-3722-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:_wp_attachment_image_alt", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via _wp_attachment_image_alt on attachment edit", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3722-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via post_title on attachment edit", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3722-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media(?:/|\\\\?|$)~"}, {"name": "ARGS:alt_text", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3722", "description": "Auto Image Attributes From Filename With Bulk Updater <=4.9 stored XSS via REST API alt_text on media update", "mode": "block", "severity": 6.4, "slug": "auto-image-attributes-from-filename-with-bulk-updater", "target": "plugin", "versions": "<=4.9"}, "RULE-CVE-2026-3772-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/plugins\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^wpeditor_plugin$~i"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:^|/)(?:wp-content/plugins/[^?&#]+\\\\.php|[^/]+\\\\.php)$~i"}, {"name": "ARGS:new-content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|base64_decode|assert)\\\\s*\\\\()~i"}], "cve": "CVE-2026-3772", "description": "WP Editor <=1.2.9.2 CSRF in add_plugins_page allows unauthenticated attackers to overwrite plugin PHP files via forged request", "mode": "block", "severity": 8.8, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9.2"}, "RULE-CVE-2026-3772-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/themes\\\\.php~"}, {"name": "ARGS:page", "type": "regex", "value": "~^wpeditor_themes$~i"}, {"name": "ARGS:submit", "type": "exists"}, {"name": "ARGS:file", "type": "regex", "value": "~(?:^|/)(?:wp-content/themes/[^?&#]+\\\\.php|[^/]+\\\\.php)$~i"}, {"name": "ARGS:new-content", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|pcntl_exec|eval|base64_decode|assert)\\\\s*\\\\()~i"}], "cve": "CVE-2026-3772", "description": "WP Editor <=1.2.9.2 CSRF in add_themes_page allows unauthenticated attackers to overwrite theme PHP files via forged request", "mode": "block", "severity": 8.8, "slug": "wp-editor", "target": "plugin", "versions": "<=1.2.9.2"}, "RULE-CVE-2026-3844-01": {"ajax_action": "save_settings_tab_basic", "conditions": [{"name": "ARGS:breeze-store-gravatars-locally", "type": "equals", "value": "1"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block enabling \'Host Files Locally Gravatars\' setting (defense in depth; prevents activating the vulnerable code path)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "configuration-block"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3844-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:wp-comments-post\\\\.php(?:\\\\?|$)|(?:index\\\\.php\\\\?rest_route=/)?wp(?:-json)?/wp/v2/comments(?:/|\\\\?|$))~"}, {"name": "ARGS:/^(?:author|email|url|author_name|author_email|author_url|comment_author(?:_email|_url)?)$/", "type": "regex", "value": "~\\\\bsrc(?:set)?\\\\s*=\\\\s*[\\"\']?\\\\s*https?://[^\\\\s\\"\'<>]{1,500}\\\\.(?:php[3-8s]?|phtml|phar|pht|inc|phps|jsp|aspx?|cgi|pl|py|rb|sh|exe|htaccess)(?:[?#/\\\\s\\"\'&]|$)~i"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block comment submission carrying src/srcset payload pointing to executable extension (Stage 1; attacker seeds malicious gravatar URL via author fields, which Breeze\'s loose regex extracts and fetches)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "server-side-fetch"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3844-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/(?:wp-comments-post\\\\.php(?:\\\\?|$)|(?:index\\\\.php\\\\?rest_route=/)?wp(?:-json)?/wp/v2/comments(?:/|\\\\?|$))~"}, {"name": "ARGS:srcset", "type": "regex", "value": "~^\\\\s*https?://~i"}], "cve": "CVE-2026-3844", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3844", "description": "Breeze Cache <=2.4.4 - block a structurally-suspicious standalone POST\\nfield carrying an http(s):// URL on comment-submission endpoints. Native\\nWordPress comment forms do not POST this field, so its presence with a\\nURL value is consistent only with attacker-driven URL injection aimed at\\ncircumventing RULE-02\'s named-field allowlist. The plugin\'s URL extractor\\nscans the entire POST array, so this rule covers fields outside RULE-02\'s\\nsource set.\\n", "method": "POST", "mode": "block", "severity": 9.8, "slug": "breeze", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "server-side-fetch", "bypass-fix"], "target": "plugin", "versions": "<=2.4.4"}, "RULE-CVE-2026-3875-01": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[betterdocs_feedback_form\\\\s[^\\\\]]*(?:on(?:error|load|mouseover|click|focus|blur)\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:|\\\\\\"\\\\s*>\\\\s*<)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3875", "description": "BetterDocs <=4.3.8 contributor+ stored XSS via betterdocs_feedback_form shortcode attributes", "mode": "block", "slug": "betterdocs", "target": "plugin", "versions": "<=4.3.8"}, "RULE-CVE-2026-3876-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-comments-post\\\\.php~"}, {"name": "ARGS:comment", "type": "regex", "value": "~\\\\[prismatic_encoded\\\\b[^\\\\]]*(?:on(?:mouse(?:over|out|down|up|move|enter|leave)|error|load|focus|blur|click|dblclick|key(?:down|up|press)|change|submit|reset|select|abort|unload|resize|scroll|beforeunload|hashchange|pointerover|pointerenter|animationend|transitionend)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}], "cve": "CVE-2026-3876", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3876", "description": "Prismatic <=3.7.3 unauthenticated stored XSS via prismatic_encoded pseudo-shortcode in comment body", "method": "POST", "mode": "block", "severity": 7.2, "slug": "prismatic", "tags": ["xss", "stored", "unauthenticated", "comment-injection"], "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39432-01": {"ajax_action": "dismiss_woocommerce_notice", "conditions": [{"name": "ARGS:notice_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39432", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39432", "description": "Timetics <=1.0.53 broken access control on dismiss_woocommerce_notice allows subscriber+ users to dismiss admin notices", "method": "POST", "mode": "block", "severity": 8.2, "slug": "timetics", "tags": ["broken-access-control", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.53"}, "RULE-CVE-2026-39432-02": {"ajax_action": "wpmet-notices", "conditions": [{"name": "ARGS:notice_key", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39432", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39432", "description": "Timetics <=1.0.53 broken access control on wpmet-notices allows authenticated users to dismiss plugin notices", "method": "POST", "mode": "block", "severity": 8.2, "slug": "timetics", "tags": ["broken-access-control", "missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.0.53"}, "RULE-CVE-2026-39437-01": {"ajax_action": "alg_wc_pq_update_price_by_qty", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_price_by_qty AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39437-02": {"ajax_action": "alg_wc_pq_update_get_dropdown_options", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_get_dropdown_options AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39437-03": {"ajax_action": "alg_wc_pq_update_get_input_options", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur|submit|keyup|keydown)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39437", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39437", "description": "Min Max Step Quantity Limits Manager for WooCommerce <=5.2.2 unauthenticated reflected XSS via alg_wc_pq_update_get_input_options AJAX handler - unsanitized parameter reflected in response without escaping", "mode": "block", "severity": 7.1, "slug": "product-quantity-for-woocommerce", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=5.2.2"}, "RULE-CVE-2026-39441-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:feed[=/]kuantokusta(?:[/?]|$)|[?&]feed=kuantokusta(?:&|$))~i"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:(?:%20|\\\\+|%2520)(?:UNION|SELECT|FROM|WHERE|INSERT|UPDATE|DELETE|DROP|ALTER)(?:%20|\\\\+|%2520)|UNION%20SELECT|UNION\\\\+SELECT|--|%2D%2D|%252D%252D|information_schema|wp_users|0x[0-9a-fA-F]+)~i"}], "cve": "CVE-2026-39441", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39441", "description": "Feed KuantoKusta for WooCommerce <=5.3 unauthenticated SQL injection via public kuantokusta product feed endpoint", "mode": "block", "severity": 9.3, "slug": "feed-kuantokusta-for-woocommerce", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=5.3"}, "RULE-CVE-2026-39450-01": {"ajax_action": "bwfan_update_automation", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_update_automation AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39450-02": {"ajax_action": "bwfan_toggle_automation_state", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_toggle_automation_state AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39450-03": {"ajax_action": "bwfan_automation_submit", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39450", "description": "Blocks unauthorized access to bwfan_automation_submit AJAX handler (CWE-862/CWE-288: Missing Authorization, Subscriber+)", "mode": "block", "severity": 7.1, "slug": "wp-marketing-automations", "target": "plugin", "versions": "<=3.7.3"}, "RULE-CVE-2026-39464-01": {"ajax_action": "seedprod_lite_v2_import_theme_request", "conditions": [{"name": "ARGS:theme_url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.)|^https?://(?:0\\\\.)|^https?://(?:10\\\\.)|^https?://(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|^https?://(?:192\\\\.168\\\\.)|^https?://(?:169\\\\.254\\\\.)|^https?://localhost\\\\b|^https?://\\\\[::1\\\\]|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2026-39464", "description": "SeedProd Coming Soon <=6.19.8 authenticated SSRF via theme_url in seedprod_lite_v2_import_theme_request", "mode": "block", "severity": 5.5, "slug": "coming-soon", "target": "plugin", "versions": "<=6.19.8"}, "RULE-CVE-2026-39464-02": {"ajax_action": "seedprod_lite_v2_import_theme_by_url", "conditions": [{"name": "ARGS:theme_url", "type": "regex", "value": "~(?:^https?://(?:127\\\\.)|^https?://(?:0\\\\.)|^https?://(?:10\\\\.)|^https?://(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|^https?://(?:192\\\\.168\\\\.)|^https?://(?:169\\\\.254\\\\.)|^https?://localhost\\\\b|^https?://\\\\[::1\\\\]|^(?:file|gopher|dict|ftp)://)~i"}], "cve": "CVE-2026-39464", "description": "SeedProd Coming Soon <=6.19.8 authenticated SSRF via theme_url in seedprod_lite_v2_import_theme_by_url", "mode": "block", "severity": 5.5, "slug": "coming-soon", "target": "plugin", "versions": "<=6.19.8"}, "RULE-CVE-2026-39466-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "blc_local"}, {"name": "ARGS:filter_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via filter_id parameter on links page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39466-02": {"ajax_action": "blc_link_details", "conditions": [{"name": "ARGS:link_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via link_id in blc_link_details AJAX handler", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39466-03": {"ajax_action": "blc_discard", "conditions": [{"name": "ARGS:link_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\'|\\\\\\\\|--\\\\s)~i"}], "cve": "CVE-2026-39466", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39466", "description": "Broken Link Checker <=2.4.7 authenticated blind SQL injection via link_id in blc_discard AJAX handler", "mode": "block", "severity": 7.6, "slug": "broken-link-checker", "tags": ["sql-injection", "blind-sqli", "authenticated"], "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-39468-01": {"ajax_action": "rwmb_delete_file", "conditions": [{"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39468", "description": "Meta Box <=5.11.1 contributor+ arbitrary file deletion via rwmb_delete_file AJAX handler (missing authorization + path traversal)", "mode": "block", "severity": 6.8, "slug": "meta-box", "target": "plugin", "versions": "<=5.11.1"}, "RULE-CVE-2026-39470-01": {"ajax_action": "cart_abandonment_install_plugin", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39470", "description": "Block unauthenticated/low-privilege plugin installation via cart_abandonment_install_plugin AJAX handler (CWE-266 Privilege Escalation)", "mode": "block", "severity": 7.2, "slug": "woo-cart-abandonment-recovery", "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2026-39470-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "admin-post.php"}, {"name": "ARGS:action", "type": "equals", "value": "wcar_rollback"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39470", "description": "Block unauthenticated/low-privilege rollback via admin_post_wcar_rollback (CWE-266 Privilege Escalation)", "mode": "block", "severity": 7.2, "slug": "woo-cart-abandonment-recovery", "target": "plugin", "versions": "<2.1.0"}, "RULE-CVE-2026-39475-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via orderby parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SELECT\\\\s.*\\\\sFROM\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via order parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39475-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/userfeedback/v1/results(?:[/?&]|$)~"}, {"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d|\'\\\\s*(?:OR|AND)\\\\s+\\\\(?SELECT\\\\b)~i"}], "cve": "CVE-2026-39475", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39475", "description": "UserFeedback <=1.10.1 authenticated (Editor+) blind SQL injection via search parameter in REST results endpoint", "mode": "block", "severity": 7.6, "slug": "userfeedback-lite", "tags": ["sql-injection", "blind-sqli", "rest-api", "authenticated"], "target": "plugin", "versions": "<=1.10.1"}, "RULE-CVE-2026-39479-01": {"action": "admin_init", "conditions": [{"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via status_filter parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-02": {"action": "admin_init", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b)~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via orderby parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39479-03": {"action": "admin_init", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\(\\\\s*SELECT\\\\b|[^A-Z](?:ASC|DESC)[^A-Z].*(?:ASC|DESC|SELECT|SLEEP|BENCHMARK))~i"}, {"name": "ARGS:page", "type": "regex", "value": "~suretriggers~"}], "cve": "CVE-2026-39479", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39479", "description": "OttoKit (SureTriggers) <=1.1.20 authenticated (admin+) blind SQL injection via order parameter in outgoing requests admin page", "method": "GET", "mode": "block", "severity": 7.6, "slug": "suretriggers", "tags": ["sql-injection", "blind-sqli", "authenticated", "admin-page"], "target": "plugin", "versions": "<=1.1.20"}, "RULE-CVE-2026-39480-01": {"ajax_action": "bmip_auth_handshake", "conditions": [{"name": "ARGS:challenge", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39480", "description": "Backup Migration <=2.1.1 unauthenticated sensitive data exposure via bmip_auth_handshake AJAX endpoint", "mode": "block", "severity": 7.5, "slug": "backup-backup", "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-39481-01": {"ajax_action": "modula_add_images_ids", "conditions": [{"name": "ARGS:modula_images", "type": "exists"}, {"name": "ARGS:modula_images", "type": "regex", "value": "~(?:O:\\\\d+:\\"|s:\\\\d+:\\\\\\\\?\\"|a:\\\\d+:\\\\{|C:\\\\d+:\\"|r:\\\\d+;)~"}, {"type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-39481", "description": "Block PHP Object Injection via modula_images parameter in Modula Image Gallery AJAX import handler for users lacking upload_files capability", "mode": "block", "severity": 7.2, "slug": "modula-best-grid-gallery", "target": "plugin", "versions": "<=2.14.18"}, "RULE-CVE-2026-39486-01": {"ajax_action": "dlm_db_log_entries", "conditions": [{"name": "ARGS:dlm_log_orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_db_log_entries AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-02": {"ajax_action": "dlm_alter_download_log", "conditions": [{"name": "ARGS:dlm_upgrade_db", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via dlm_alter_download_log AJAX handler", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39486-03": {"ajax_action": "download_monitor_list_files", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "config": {}, "cve": "CVE-2026-39486", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39486", "description": "Download Monitor <=5.1.8 authenticated SQL injection via download_monitor_list_files orderby parameter", "method": "POST", "mode": "block", "severity": 8.5, "slug": "download-monitor", "tags": ["sql-injection", "authenticated", "ajax"], "target": "plugin", "versions": "<=5.1.8"}, "RULE-CVE-2026-39491-01": {"ajax_action": "jupiterx_custom_snippets", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_custom_snippets AJAX handler (title/content/snippet_code)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-02": {"ajax_action": "jupiterx_layout_builder", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 subscriber+ stored XSS via jupiterx_layout_builder AJAX handler (title/layout_data/conditions)", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39491-03": {"ajax_action": "raven_form_frontend", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\.?s\\\\s*c\\\\s*r\\\\s*i\\\\s*p\\\\s*t[\\\\s>/]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|enter))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-39491", "description": "JupiterX Core <=4.14.1 stored XSS via raven_form_frontend AJAX handler (fields) - also nopriv", "mode": "block", "severity": 6.5, "slug": "jupiterx-core", "target": "plugin", "versions": "<=4.14.1"}, "RULE-CVE-2026-39493-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|CONCAT\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-39493", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39493", "description": "Simply Schedule Appointments <=1.6.9.27 unauthenticated SQL injection via ssa/v1 REST API", "mode": "block", "severity": 9.3, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39495-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39495", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39495", "description": "Simply Schedule Appointments <=1.6.9.27 authenticated (Contributor+) SQL injection via REST API", "mode": "block", "severity": 8.5, "slug": "simply-schedule-appointments", "tags": ["sql-injection", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.6.9.27"}, "RULE-CVE-2026-39497-01": {"ajax_action": "woocs_recalculate_order_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_order_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-02": {"ajax_action": "woocs_recalculate_orders_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_recalculate_orders_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-03": {"ajax_action": "woocs_update_order_rate", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_update_order_rate AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-04": {"ajax_action": "woocs_all_order_ids", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_all_order_ids AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39497-05": {"ajax_action": "woocs_stat_redraw", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39497", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39497", "description": "FOX <=1.4.5 authenticated blind SQL injection via woocs_stat_redraw AJAX handler", "mode": "block", "severity": 7.6, "slug": "woocommerce-currency-switcher", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-39498-01": {"ajax_action": "yaymail_import_templates", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_templates AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import templates endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39498-02": {"ajax_action": "yaymail_import_state", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~(?:^|[\\"\';\\\\s])O:\\\\d+:\\"[^\\"]+\\":\\\\d+:\\\\{~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39498", "description": "Block PHP Object Injection via yaymail_import_state AJAX handler in YayMail <= 4.3.3 (CWE-502). Detects PHP serialized object notation in the data parameter sent to the import state endpoint.", "mode": "block", "severity": 7.2, "slug": "yaymail", "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-39499-01": {"ajax_action": "wapf_search_products", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\\\\\{]~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-39499", "description": "Advanced Product Fields for WooCommerce <=1.6.19 authenticated (Shop Manager+) PHP Object Injection via q parameter in wapf_search_products AJAX handler", "mode": "block", "severity": 7.2, "slug": "advanced-product-fields-for-woocommerce", "target": "plugin", "versions": "<=1.6.19"}, "RULE-CVE-2026-39511-01": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-album", "type": "regex", "value": "~[^0-9\\\\-]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-album parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-02": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-page", "type": "regex", "value": "~[^0-9]~"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-page parameter (non-integer injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-03": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-tag", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-tag parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39511-04": {"ajax_action": "wppa", "conditions": [{"name": "ARGS:wppa-search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|information_schema|sleep\\\\s*\\\\(|benchmark\\\\s*\\\\(|--\\\\s*(?:#|$)|;\\\\s*--|load_file\\\\s*\\\\(|into\\\\s+(?:outfile|dumpfile))~i"}], "cve": "CVE-2026-39511", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39511", "description": "WP Photo Album Plus <=9.1.08.001 unauthenticated SQLi via wppa-search parameter (SQL keyword injection)", "mode": "block", "severity": 9.3, "slug": "wp-photo-album-plus", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=9.1.08.001"}, "RULE-CVE-2026-39531-01": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_ne", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_ne parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-02": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS:rectangle_sw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via rectangle_sw parameter", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39531-03": {"ajax_action": "wdk_public_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\\\\bEXTRACTVALUE\\\\s*\\\\(|\\\\bUPDATEXML\\\\s*\\\\(|(?:SELECT|IF)\\\\s*\\\\()~i"}], "cve": "CVE-2026-39531", "description": "WP Directory Kit <=1.5.0 unauthenticated blind SQL injection via dynamic search field parameters", "mode": "block", "severity": 9.3, "slug": "wpdirectorykit", "target": "plugin", "versions": "<=1.5.0"}, "RULE-CVE-2026-39533-01": {"ajax_action": "awpcp_create_empty_listing", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing creation via awpcp_create_empty_listing AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-02": {"ajax_action": "awpcp_save_listing_information", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing modification via awpcp_save_listing_information AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-03": {"ajax_action": "awpcp_update_listing_order", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing order update via awpcp_update_listing_order AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39533-04": {"ajax_action": "awpcp_update_submit_listing_sections", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39533", "description": "AWP Classifieds <=4.4.4 unauthenticated listing section update via awpcp_update_submit_listing_sections AJAX handler (CWE-862)", "mode": "block", "severity": 7.5, "slug": "another-wordpress-classifieds-plugin", "target": "plugin", "versions": "<=4.4.4"}, "RULE-CVE-2026-39579-01": {"ajax_action": "bblocks_api_keys", "conditions": [{"name": "ARGS:value", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-39579", "description": "B Blocks <=2.0.31 contributor+ privilege escalation via bblocks_api_keys AJAX handler missing capability check", "mode": "block", "severity": 8.8, "slug": "b-blocks", "target": "plugin", "versions": "<=2.0.31"}, "RULE-CVE-2026-39581-01": {"ajax_action": "activitytime_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-02": {"ajax_action": "activitytime_mvc_action", "conditions": [{"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in activitytime_mvc_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39581-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitytime/v1/action(?:/|\\\\?|$)~"}, {"name": "ARGS:activitytime_mvc_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|(?:--|#)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-39581", "description": "WP Sessions Time Monitoring Full Automatic <=1.1.4 SQL injection via activitytime_mvc_action parameter in REST API activitytime/v1/action endpoint", "mode": "block", "severity": 8.5, "slug": "activitytime", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-39587-01": {"ajax_action": "app_ajax_register", "conditions": [{"name": "ARGS:role", "type": "exists"}, {"name": "ARGS:role", "type": "regex", "value": "~^(?!subscriber$).+~i"}], "cve": "CVE-2026-39587", "description": "Block unauthenticated privilege escalation via app_ajax_register AJAX action in WP BASE Booking plugin <= 5.9.0. Attacker can register a user with an arbitrary role (e.g., administrator) through the unprotected registration handler.", "mode": "block", "severity": 8.1, "slug": "wp-base-booking-of-appointments-services-and-events", "target": "plugin", "versions": "<=5.9.0"}, "RULE-CVE-2026-39591-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via upload.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/uploadFile\\\\.php~i"}, {"name": "FILES:file:name", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9]?|s|tml?|t|ar)|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|(?:^|[\\\\/])\\\\.htaccess$~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ arbitrary file upload via uploadFile.php helper", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["arbitrary-file-upload", "unauthenticated", "direct-endpoint"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39591-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~wp-businessdirectory/site/helpers/upload(?:File)?\\\\.php~i"}, {"name": "ARGS:_target", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|[\\\\/]etc[\\\\/]|wp-config\\\\.php)~i"}], "cve": "CVE-2026-39591", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39591", "description": "WP-BusinessDirectory <=4.0.0 subscriber+ path traversal via _target parameter in upload helpers", "mode": "block", "severity": 9.9, "slug": "wp-businessdirectory", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=4.0.0"}, "RULE-CVE-2026-39597-01": {"ajax_action": "wpz_posts_grid_load_more", "conditions": [{"name": "ARGS:posts_data", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 unauthenticated reflected XSS via posts_data JSON blob in wpz_posts_grid_load_more AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-02": {"ajax_action": "get_content_from_elementor_export_file", "conditions": [{"name": "ARGS:filename", "type": "regex", "value": "~(?:<script[\\\\s/>]|on\\\\w+\\\\s*=|javascript\\\\s*:|data\\\\s*:|vbscript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via filename parameter (javascript protocol bypass) in get_content_from_elementor_export_file AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39597-03": {"ajax_action": "get_wpzoom_preview", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:[\'\\"]\\\\s*(?:on(?:error|load|mouseover|click|focus)\\\\s*=|style\\\\s*=)|<script[\\\\s/>]|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39597", "description": "WPZOOM Addons for Elementor <=1.3.4 authenticated reflected XSS via url parameter attribute breakout in get_wpzoom_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-elementor-addons", "target": "plugin", "versions": "<=1.3.4"}, "RULE-CVE-2026-39619-01": {"ajax_action": "busiprof_install_activate_plugin", "conditions": [{"name": "ARGS:plugin_url", "type": "exists"}, {"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-39619", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-39619", "description": "Busiprof <=2.5.2 CSRF to arbitrary plugin install/web shell upload via busiprof_install_activate_plugin AJAX handler", "mode": "block", "severity": 9.6, "slug": "busiprof", "tags": ["csrf", "arbitrary-file-upload", "web-shell", "missing-authorization"], "target": "theme", "versions": "<=2.5.2"}, "RULE-CVE-2026-39656-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_direct_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_direct_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_reverse_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_reverse_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_settlement_change"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_settlement_change", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39656-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "rzp_payment_transfer"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-39656", "description": "Razorpay for WooCommerce <=4.8.4 missing authorization on admin-post action rzp_payment_transfer", "mode": "block", "severity": 5.3, "slug": "woo-razorpay", "target": "plugin", "versions": "<=4.8.4"}, "RULE-CVE-2026-39665-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php\\\\?page=sfi_settings~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(<script[ />]|<[^>]+[^a-zA-Z0-9_]on[a-zA-Z0-9_]+ *=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-39665", "description": "SEO Image <=3.0.5 reflected XSS via REQUEST_URI in admin settings page", "mode": "block", "severity": 6.5, "slug": "seo-image", "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-3985-01": {"ajax_action": "ce4wp_abandoned_checkouts_capture_guest_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3985-02": {"ajax_action": "ce4wp_abandoned_checkouts_no_consent_checkout", "conditions": [{"name": "ARGS:checkout_uuid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-3985", "description": "Creative Mail by Constant Contact unauthenticated SQL injection via checkout_uuid", "mode": "block", "severity": 7.5, "slug": "creative-mail-by-constant-contact", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-3986-01": {"action": "admin_init", "conditions": [{"name": "ARGS:form_structure", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-3986", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-3986", "description": "Calculated Fields Form <=5.4.5.0 authenticated (Contributor+) stored XSS via form_structure parameter containing unsanitized fcontent in fhtml field types", "method": "POST", "mode": "block", "severity": 6.4, "slug": "calculated-fields-form", "tags": ["xss", "stored", "authenticated", "insufficient-sanitization"], "target": "plugin", "versions": "<=5.4.5.0"}, "RULE-CVE-2026-4021-01": {"ajax_action": "post_cg1l_login_user_by_key", "conditions": [{"name": "ARGS:cglKey", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4021", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4021", "description": "Contest Gallery <=28.1.5 unauthenticated account takeover via post_cg1l_login_user_by_key AJAX action (key-based login after type-confusion activation key overwrite)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "contest-gallery", "tags": ["authentication-bypass", "privilege-escalation", "unauthenticated"], "target": "plugin", "versions": "<=28.1.5"}, "RULE-CVE-2026-4024-01": {"ajax_action": "wpr_update_form_action_meta", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4024", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4024", "description": "Royal Elementor Addons <= 1.7.1056 - Unauthenticated Missing Authorization via wpr_update_form_action_meta (post-meta write with publicly-exposed nonce)", "mode": "block", "severity": 5.3, "slug": "royal-elementor-addons", "tags": ["missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-4029-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "wp-db-backup"}, {"name": "ARGS:action", "type": "equals", "value": "backup"}, {"type": "missing_capability", "value": "import"}], "cve": "CVE-2026-4029", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4029", "description": "WP-DB-Backup <=2.5.2 unauthenticated backup export via admin menu in Multisite", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-01": {"ajax_action": "save_backup_time", "conditions": [{"name": "ARGS:location", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows arbitrary file deletion via location parameter path traversal", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4030-02": {"action": "init", "conditions": [{"name": "ARGS:via", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env|etc/passwd)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4030", "description": "WP-DB-Backup <=2.5.2 missing authorization on init hook allows arbitrary file read via via parameter path traversal in Multisite", "mode": "block", "severity": 8.1, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4031-02": {"ajax_action": "save_backup_time", "conditions": [{"type": "missing_capability", "value": "manage_options"}, {"name": "ARGS:backup-time", "type": "exists"}], "cve": "CVE-2026-4031", "description": "WP-DB-Backup <=2.5.2 missing authorization on wp_ajax_save_backup_time allows subscriber+ schedule manipulation", "mode": "block", "severity": 7.5, "slug": "wp-db-backup", "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4056-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/user-registration/v1/content-access-rules(?:/|\\\\?|&|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4056", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4056", "description": "User Registration & Membership <=5.1.4 missing authorization on Content Access Rules REST API allows Contributor+ to create/read/update/delete/toggle/duplicate content restriction rules", "mode": "block", "severity": 5.4, "slug": "user-registration", "tags": ["missing-authorization", "broken-access-control", "rest-api"], "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-4059-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~\\\\[woolentor_quickview_button[^\\\\]]*button_text\\\\s*=\\\\s*(?:\\"|&quot;|&#34;|\')[^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4059", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4059", "description": "ShopLentor <=3.3.5 Contributor+ stored XSS via woolentor_quickview_button shortcode button_text attribute", "mode": "block", "severity": 6.4, "slug": "woolentor-addons", "tags": ["xss", "stored", "authenticated", "shortcode"], "target": "plugin", "versions": "<=3.3.5"}, "RULE-CVE-2026-4060-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via sort parameter in AJAX query", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4060-02": {"action": "init", "conditions": [{"name": "ARGS:gm_sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|BENCHMARK\\\\s*\\\\(|SLEEP\\\\s*\\\\()~i"}], "cve": "CVE-2026-4060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4060", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via gm_sort front-end parameter", "method": "GET", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based-blind"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4061-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:map_post_type", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}], "cve": "CVE-2026-4061", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4061", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via map_post_type parameter in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "ajax"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-01": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:exclude_object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via exclude_object_ids in geo_mashup_query AJAX handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4062-03": {"action": "template_redirect", "conditions": [{"name": "ARGS:object_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY\\\\s|DROP\\\\s+(?:TABLE|DATABASE)|DELETE\\\\s+FROM|INSERT\\\\s+INTO|UPDATE\\\\s+.*SET|;\\\\s*--)~i"}], "cve": "CVE-2026-4062", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4062", "description": "Geo Mashup <=1.13.18 unauthenticated SQL injection via object_ids query var in template_redirect handler", "mode": "block", "severity": 7.5, "slug": "geo-mashup", "tags": ["sql-injection", "unauthenticated", "time-based"], "target": "plugin", "versions": "<=1.13.18"}, "RULE-CVE-2026-4066-01": {"ajax_action": "smart-cf-relational-posts-search", "conditions": [{"name": "ARGS:post_types", "type": "exists"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-4066", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4066", "description": "Smart Custom Fields <=5.0.6 missing per-post authorization in relational posts search allows authenticated users with read capability to enumerate private and draft posts", "mode": "block", "severity": 4.3, "slug": "smart-custom-fields", "tags": ["missing-authorization", "information-disclosure", "ajax"], "target": "plugin", "versions": "<=5.0.6"}, "RULE-CVE-2026-40727-01": {"ajax_action": "bulk_action_listener", "conditions": [{"name": "ARGS:action", "type": "exists"}, {"name": "ARGS:imported", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40727", "description": "Groundhogg <= 4.4 \\u2014 Missing Authorization on Imported File Deletion via bulk_action_listener AJAX (CWE-862)", "mode": "block", "severity": 7.7, "slug": "groundhogg", "target": "plugin", "versions": "<4.4.1"}, "RULE-CVE-2026-40744-01": {"ajax_action": "fl_builder_export_templates_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-40744", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40744", "description": "Beaver Builder <=2.10.1.2 authenticated SQL injection via fl_builder_export_templates_data AJAX handler", "mode": "block", "severity": 8.5, "slug": "beaver-builder-lite-version", "tags": ["sql-injection", "authenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=2.10.1.2"}, "RULE-CVE-2026-40745-01": {"ajax_action": "elementpack_dynamic_select_input_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|/\\\\*[!+]|\'\\\\s*(?:OR|AND)\\\\s+[\'\\"\']?\\\\d)~i"}, {"type": "missing_capability", "value": "edit_others_posts"}], "cve": "CVE-2026-40745", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40745", "description": "Element Pack Elementor Addons <=8.4.2 authenticated blind SQL injection via elementpack_dynamic_select_input_data AJAX handler", "mode": "block", "severity": 7.6, "slug": "bdthemes-element-pack-lite", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-4075-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in REST API post/page creation", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-4075-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[baf_sbox\\\\s[^\\\\]]*(?:sbox_id|sbox_class|placeholder|highlight_color|highlight_bg|cont_ext_class)\\\\s*=\\\\s*[\\\\\\"\'][^\\\\\\"\']*(?:on[a-z]+=|javascript\\\\s*:|<script[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4075", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4075", "description": "BWL Advanced FAQ Manager Lite <=1.1.1 authenticated (Contributor+) stored XSS via baf_sbox shortcode attributes in classic editor post save", "method": "POST", "mode": "block", "severity": 6.4, "slug": "bwl-advanced-faq-manager-lite", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=1.1.1"}, "RULE-CVE-2026-40764-01": {"ajax_action": "wpforms_admin_forms_overview_save_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on save_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-02": {"ajax_action": "wpforms_admin_forms_overview_delete_tags", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on delete_tags AJAX handler \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-03": {"ajax_action": "wpforms_update_lite_connect_enabled_setting", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on update_lite_connect_enabled_setting \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-04": {"ajax_action": "wpforms_lite_connect_finalize", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 CSRF on lite_connect_finalize \\u2014 missing nonce and capability check", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40764-05": {"ajax_action": "wpforms_lite_settings_upgrade", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40764", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40764", "description": "WPForms Lite <=1.10.0.2 missing capability check on lite_settings_upgrade AJAX handler", "mode": "block", "severity": 8.1, "slug": "wpforms-lite", "tags": ["csrf", "missing-authorization", "broken-access-control"], "target": "plugin", "versions": "<=1.10.0.2"}, "RULE-CVE-2026-40765-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-40765", "description": "Collect.chat <=2.4.9 reflected XSS via REQUEST_URI in admin notice (esc_url bypass)", "mode": "block", "severity": 7.1, "slug": "collectchat", "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-40768-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:fix_booking_id", "type": "regex", "value": "~^[0-9]+$~"}, {"name": "ARGS:new_status", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-40768", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40768", "description": "Salon Booking System <=10.30.24 unauthenticated IDOR booking modification via fix_booking_id + new_status on wp_ajax_nopriv_salon (CWE-639)", "mode": "block", "severity": 7.3, "slug": "salon-booking-system", "tags": ["idor", "missing-authorization", "unauthenticated"], "target": "plugin", "versions": "<=10.30.24"}, "RULE-CVE-2026-40769-01": {"ajax_action": "cfefd_remove_file", "conditions": [{"name": "ARGS:file_name", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|^/|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|wp-settings\\\\.php|debug\\\\.log))~i"}], "cve": "CVE-2026-40769", "description": "Contact Form Extender for Divi <=1.0.6 unauthenticated arbitrary file deletion via path traversal in file_name parameter", "mode": "block", "severity": 8.6, "slug": "contact-form-extender-for-divi-builder", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-40771-01": {"ajax_action": "post_cg_galleries_show_cg_gallery", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_galleries_show_cg_gallery AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40771-02": {"ajax_action": "post_cg_load_v10", "conditions": [{"name": "ARGS:cg-search-gallery-id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-40771", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via cg-search-gallery-id in post_cg_load_v10 AJAX handler", "mode": "block", "severity": 9.3, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-40779-01": {"action": "save_link_library_moderate", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40779", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40779", "description": "Link Library <=7.8.8 contributor+ arbitrary file deletion via admin_post_save_link_library_moderate (missing capability check on moderation handler)", "mode": "block", "severity": 7.7, "slug": "link-library", "tags": ["missing-authorization", "arbitrary-file-deletion", "path-traversal"], "target": "plugin", "versions": "<=7.8.8"}, "RULE-CVE-2026-40780-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/bookit/v[0-9]+/(?:[^/]*(?:password|reset|recover|forgot|auth)[^/]*)(?:/|\\\\?|$)~i"}, {"name": "ARGS:email", "type": "regex", "value": "~.+@.+~"}], "cve": "CVE-2026-40780", "description": "BookIt <2.5.4.1 unauthenticated authentication bypass via REST API password recovery exploitation", "mode": "block", "severity": 7.5, "slug": "bookit", "target": "plugin", "versions": "<2.5.4.1"}, "RULE-CVE-2026-40784-01": {"ajax_action": "fluentform_fluent_board_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40784", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40784", "description": "FluentBoards <=1.91.2 IDOR via fluentform_fluent_board_config AJAX handler missing authorization", "mode": "block", "severity": 8.1, "slug": "fluent-boards", "tags": ["missing-authorization", "idor", "broken-access-control"], "target": "plugin", "versions": "<=1.91.2"}, "RULE-CVE-2026-40787-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quiz-survey-master/v1/quiz/(?:save_quiz|create_quiz)~"}, {"name": "ARGS:quiz_name", "type": "exists"}, {"name": "ARGS:quiz_name", "type": "regex", "value": "~(?:<[a-z/!?]|[\\"\']\\\\s*(?:on[a-z]+=|style\\\\s*=|xmlns)|javascript\\\\s*:|data\\\\s*:[^,]*;base64)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-40787", "description": "Stored XSS in Quiz And Survey Master <= 11.0.0 via quiz name/description fields in REST API save_quiz/create_quiz endpoints \\u2014 blocks HTML/script injection patterns in quiz_name parameter for users lacking manage_options", "mode": "block", "severity": 7.1, "slug": "quiz-master-next", "target": "plugin", "versions": "<=11.0.0"}, "RULE-CVE-2026-40791-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:from_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via from_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40791-02": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"name": "ARGS:test_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|body|div|a)[\\\\s/>])~i"}], "cve": "CVE-2026-40791", "description": "WP Time Slots Booking Form <=1.2.46 authenticated reflected XSS via test_email in email diagnostic AJAX handler", "mode": "block", "severity": 7.1, "slug": "wp-time-slots-booking-form", "target": "plugin", "versions": "<=1.2.46"}, "RULE-CVE-2026-40797-01": {"ajax_action": "date_change_on_no", "conditions": [{"name": "ARGS:wi_webinar_id_resend_mail", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via wi_webinar_id_resend_mail in date_change_on_no AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-02": {"ajax_action": "webinarignition_broadcast_msg_poll", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via id in webinarignition_broadcast_msg_poll AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40797-03": {"ajax_action": "webinarignition_send_email_verification_code", "conditions": [{"name": "ARGS:email", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)|/\\\\*.*\\\\*/|(?:--|#)\\\\s)\\\\S*~i"}], "cve": "CVE-2026-40797", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40797", "description": "WebinarIgnition <=4.08.253 unauthenticated SQL injection via email in webinarignition_send_email_verification_code AJAX handler", "mode": "block", "severity": 9.3, "slug": "webinar-ignition", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=4.08.253"}, "RULE-CVE-2026-40798-01": {"ajax_action": "wpforo_tag_search", "conditions": [{"name": "ARGS:q", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|ALTER)\\\\s|\'\\\\s*(?:AND|OR)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:--|#)\\\\s|/\\\\*[!+]|\'\\\\s*(?:AND|OR)\\\\s+.*(?:SELECT|UNION|CONCAT|VERSION|DATABASE))~i"}], "cve": "CVE-2026-40798", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-40798", "description": "wpForo Forum <=3.0.4 unauthenticated SQL injection via q parameter in wpforo_tag_search AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpforo", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=3.0.4"}, "RULE-CVE-2026-4094-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woocs_reset", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4094", "description": "FOX Currency Switcher <=1.4.5 missing authorization allows authenticated users to delete plugin configuration via woocs_reset parameter on admin pages", "mode": "block", "severity": 8.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.5"}, "RULE-CVE-2026-4100-02": {"ajax_action": "pmpro_stripe_delete_webhook", "conditions": [{"name": "ARGS:action", "type": "regex", "value": "~^pmpro_stripe_delete_webhook$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4100", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4100", "description": "Paid Memberships Pro <=3.6.5 missing authorization on pmpro_stripe_delete_webhook allows authenticated Subscriber+ users to delete Stripe webhooks and disrupt payment processing", "mode": "block", "severity": 7.1, "slug": "paid-memberships-pro", "tags": ["missing-authorization", "service-disruption"], "target": "plugin", "versions": "<=3.6.5"}, "RULE-CVE-2026-4127-01": {"ajax_action": "speedup01_enabled", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_enabled allows subscriber+ to toggle optimization settings", "method": "POST", "mode": "block", "severity": 8.8, "slug": "speedup-optimization", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4127-02": {"ajax_action": "speedup01_purge_all", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4127", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4127", "description": "Speedup Optimization <=1.5.9 missing authorization on speedup01_purge_all allows subscriber+ to purge all cache files", "method": "POST", "mode": "block", "severity": 7.5, "slug": "speedup-optimization", "tags": ["missing-authorization", "cache-purge", "authenticated"], "target": "plugin", "versions": "<=1.5.9"}, "RULE-CVE-2026-4143-01": {"ajax_action": "fakturama", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4143", "description": "Neos Connector for Fakturama <=0.0.14 fully unprotected AJAX handler allows CSRF via wp_ajax_fakturama", "mode": "block", "severity": 4.3, "slug": "neos-connector-for-fakturama", "target": "plugin", "versions": "<=0.0.14"}, "RULE-CVE-2026-4146-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]page=loco-version(?:&|$)~"}, {"name": "ARGS:update_href", "type": "regex", "value": "~(?:javascript\\\\s*:|data\\\\s*:[^,]*(?:text/html|base64)|[\\"\'><]|on(?:error|load|click|mouseover|focus)\\\\s*=|%(?:22|27|3[CEce]))~i"}], "cve": "CVE-2026-4146", "description": "Loco Translate <=2.8.2 reflected XSS via update_href parameter on admin version page", "mode": "block", "severity": 6.1, "slug": "loco-translate", "target": "plugin", "versions": "<=2.8.2"}, "RULE-CVE-2026-42379-04": {"ajax_action": "templately_save_conditions", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:action", "type": "equals", "value": "templately_save_conditions"}, {"name": "ARGS:conditions", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42379", "description": "Templately <=3.6.1 unauthorized condition saving via templately_save_conditions AJAX handler missing capability check", "mode": "block", "severity": 7.7, "slug": "templately", "tags": ["missing-authorization", "sensitive-data-exposure"], "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-42384-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ssa/v1/(?:debug|logs?)(?:/|\\\\?|$)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42384", "description": "Simply Schedule Appointments <1.6.11.2 unauthenticated debug log exposure via REST API (ssa/v1 debug endpoint)", "mode": "block", "severity": 7.5, "slug": "simply-schedule-appointments", "target": "plugin", "versions": "<1.6.11.2"}, "RULE-CVE-2026-4248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\{usermeta:[^}]*(?:password_reset_link|user_pass|session_tokens|user_activation_key)[^}]*\\\\}~i"}], "cve": "CVE-2026-4248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4248", "description": "Ultimate Member <=2.11.2 authenticated (Contributor+) sensitive usermeta disclosure via {usermeta:} placeholder in post content", "method": "POST", "mode": "block", "severity": 8.0, "slug": "ultimate-member", "tags": ["insecure-direct-object-reference", "sensitive-data-exposure", "stored-content"], "target": "plugin", "versions": "<=2.11.2"}, "RULE-CVE-2026-4261-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:profile|user-edit)\\\\.php~"}, {"name": "ARGS:on_expire_default_to_role", "type": "regex", "value": "~^(?i)(?:administrator|editor|author|contributor)$~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4261", "description": "Expire Users <=1.2.2 authenticated privilege escalation via profile on_expire_default_to_role parameter", "mode": "block", "severity": 8.8, "slug": "expire-users", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-42649-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "favicon-rotator"}, {"name": "REQUEST_URI", "type": "regex", "value": "~(?:%3[Cc](?:script|svg|img|iframe|object|embed|body)|(?:^|[^a-z])on(?:error|load|focus|click|mouseover|blur)(?:%3[Dd]|\\\\s*=)|javascript(?:%3[Aa]|\\\\s*:)|<(?:script|svg|img|iframe|object|embed|body)[\\\\s/>])~i"}], "cve": "CVE-2026-42649", "description": "Favicon Rotator <=1.2.11 unauthenticated reflected XSS via unsanitized REQUEST_URI on admin settings page", "mode": "block", "severity": 7.1, "slug": "favicon-rotator", "target": "plugin", "versions": "<=1.2.11"}, "RULE-CVE-2026-42650-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order parameter in admin list table search box", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-03": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via orderby in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42650-04": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|%3cscript|%22\\\\s*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-42650", "description": "AutomatorWP <=5.6.7 reflected XSS via order in ct_ajax_list_table_request AJAX handler", "mode": "block", "severity": 7.2, "slug": "automatorwp", "target": "plugin", "versions": "<=5.6.7"}, "RULE-CVE-2026-42652-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "user-registration-membership-payment-history"}, {"name": "ARGS:action", "type": "regex", "value": "~(?:<script[\\\\s/>]|<[^>]+[^a-zA-Z0-9_]on(?:cl|er|lo|fo|pu)\\\\w*\\\\s*=|[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]\\\\s*:)~i"}], "cve": "CVE-2026-42652", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42652", "description": "User Registration <=5.1.5 reflected XSS via action parameter on payment history admin page", "mode": "block", "severity": 7.1, "slug": "user-registration", "tags": ["xss", "reflected", "authenticated"], "target": "plugin", "versions": "<=5.1.5"}, "RULE-CVE-2026-42665-01": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via order parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-02": {"ajax_action": "wpda_datatables", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via orderby parameter in wpda_datatables AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42665-03": {"ajax_action": "wpda_autocomplete", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ORDER\\\\s+BY\\\\s+)?IF\\\\s*\\\\(|CASE\\\\s+WHEN\\\\s+.+?\\\\s+THEN\\\\s|(?:ELT|FIELD|MAKE_SET)\\\\s*\\\\()~i"}], "cve": "CVE-2026-42665", "description": "WP Data Access <=5.5.70 unauthenticated SQL injection via wpda_autocomplete AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-data-access", "target": "plugin", "versions": "<=5.5.70"}, "RULE-CVE-2026-42667-01": {"ajax_action": "bookly_speed_up_update_addons", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42667", "description": "Bookly <=27.4 unauthenticated sensitive data exposure via bookly_speed_up_update_addons AJAX handler", "mode": "block", "severity": 7.5, "slug": "bookly-responsive-appointment-booking-tool", "target": "plugin", "versions": "<=27.4"}, "RULE-CVE-2026-42668-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/connect(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST connect endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/disconnect-current-site(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST disconnect endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42668-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/omnisend-api/v1/omnisend-settings(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42668", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42668", "description": "Omnisend for WooCommerce <=1.18.0 unauthenticated broken authentication on REST settings endpoint", "mode": "block", "severity": 7.5, "slug": "omnisend-connect", "tags": ["broken-authentication", "missing-authorization", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.18.0"}, "RULE-CVE-2026-42678-01": {"ajax_action": "give_get_content_by_ajax", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|</?iframe[\\\\s>]|<svg[\\\\s/]|<img[^>]+onerror)~i"}], "cve": "CVE-2026-42678", "description": "GiveWP <=4.14.5 authenticated reflected XSS via url parameter in give_get_content_by_ajax AJAX handler", "mode": "block", "severity": 7.1, "slug": "give", "target": "plugin", "versions": "<=4.14.5"}, "RULE-CVE-2026-42684-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-03": {"ajax_action": "wpjobportal_ajax_popup_action", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_ajax_popup_action AJAX handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42684-04": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bAND\\\\s+(?:SLEEP\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42684", "description": "WP Job Portal <=2.5.1 unauthenticated blind SQL injection via wpjobportal_loginwith_ajax social login handler", "mode": "block", "severity": 9.3, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42685-01": {"ajax_action": "wpjobportal_loginwith_ajax", "conditions": [{"name": "ARGS:wpjobportal-social/[a-z]+/", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-42685", "description": "WP Job Portal <=2.5.1 unauthenticated reflected XSS via social login parameters in wpjobportal_loginwith_ajax", "mode": "block", "severity": 7.1, "slug": "wp-job-portal", "target": "plugin", "versions": "<=2.5.1"}, "RULE-CVE-2026-42687-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\\\\\{]~"}], "cve": "CVE-2026-42687", "description": "EventPrime <=4.3.2.1 unauthenticated PHP Object Injection via unserialize of raw request body in eventprime_api AJAX handler", "mode": "block", "severity": 8.1, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.2.1"}, "RULE-CVE-2026-42727-01": {"ajax_action": "woot_get_table_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_table_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-02": {"ajax_action": "woot_get_columns_data", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 subscriber+ blind SQL injection via table_html_id in woot_get_columns_data", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42727-03": {"ajax_action": "woot_get_smth", "conditions": [{"name": "ARGS:table_html_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|(?:AND|OR)[\\\\s(]+(?:SLEEP|BENCHMARK|(?:SELECT|IF)\\\\s*\\\\(|\\\\d+\\\\s*=\\\\s*\\\\d+)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-42727", "description": "Active Products Tables for WooCommerce <=1.0.8 unauthenticated blind SQL injection via table_html_id in woot_get_smth", "mode": "block", "severity": 9.3, "slug": "profit-products-tables-for-woocommerce", "target": "plugin", "versions": "<=1.0.8"}, "RULE-CVE-2026-42734-01": {"ajax_action": "geo_mashup_kml_attachments", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_kml_attachments", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42734-02": {"ajax_action": "geo_mashup_query", "conditions": [{"name": "ARGS:callback", "type": "regex", "value": "~[^a-zA-Z0-9_.$]~"}], "cve": "CVE-2026-42734", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42734", "description": "Geo Mashup <=1.13.19 reflected XSS via unsanitized JSONP callback in geo_mashup_query", "mode": "block", "severity": 7.1, "slug": "geo-mashup", "tags": ["xss", "reflected-xss", "jsonp-injection", "unauthenticated"], "target": "plugin", "versions": "<=1.13.19"}, "RULE-CVE-2026-42742-01": {"ajax_action": "_review_action", "conditions": [{"name": "ARGS:view_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[0-9]+\\\\s*=\\\\s*[0-9]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|WAITFOR\\\\s+DELAY|\\\\bIF\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\s+)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-42742", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-42742", "description": "Views for WPForms Lite <=3.4.6 authenticated blind SQL injection via view_id in _review_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "views-for-wpforms-lite", "tags": ["sql-injection", "blind-sql", "missing-authorization"], "target": "plugin", "versions": "<=3.4.6"}, "RULE-CVE-2026-42756-01": {"ajax_action": "undo_single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in undo_single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-02": {"ajax_action": "single_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in single_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42756-03": {"ajax_action": "image_optimizition_ajax", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:\\\\.\\\\.%2[Ff]){2,}|(?:%2[Ee]%2[Ee][\\\\\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-42756", "description": "QuickWebP <=3.2.7 authenticated (Contributor+) arbitrary file deletion via path traversal in image_optimizition_ajax", "mode": "block", "severity": 9.9, "slug": "quickwebp", "target": "plugin", "versions": "<=3.2.7"}, "RULE-CVE-2026-42775-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via orderby parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-42775-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "automatorwp"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|\\\\s+on\\\\w+\\\\s*=))~i"}], "cve": "CVE-2026-42775", "description": "AutomatorWP <=5.7.2 unauthenticated reflected XSS via order parameter in CT_List_Table::search_box()", "mode": "block", "severity": 7.1, "slug": "automatorwp", "target": "plugin", "versions": "<=5.7.2"}, "RULE-CVE-2026-4283-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "super-unsubscribe"}, {"name": "ARGS:process_now", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4283", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4283", "description": "WP DSGVO Tools (GDPR) <=3.1.38 unauthenticated account destruction via super-unsubscribe process_now branch", "mode": "block", "severity": 9.1, "slug": "shapepress-dsgvo", "tags": ["missing-authorization", "business-logic-abuse", "unauthenticated", "account-destruction"], "target": "plugin", "versions": "<=3.1.38"}, "RULE-CVE-2026-4300-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php~"}, {"name": "ARGS:page", "type": "equals", "value": "rbs_gallery_options_loading"}, {"name": "ARGS:rsg_LoadingWord", "type": "regex", "value": "~(?:<\\\\s*(?:script|svg|img|body|iframe|object|embed|div|input|form|style|link|meta|audio|video|source|details|marquee)[\\\\s/>]|<[^>]+\\\\son[a-z]+\\\\s*=|javascript\\\\s*:|%3[Cc]\\\\s*(?:script|svg|img|body|iframe|div|input))~i"}], "cve": "CVE-2026-4300", "description": "Robo Gallery <=5.1.3 authenticated stored XSS via rsg_LoadingWord on rbs_gallery_options_loading settings page", "mode": "block", "severity": 6.4, "slug": "robo-gallery", "target": "plugin", "versions": "<=5.1.3"}, "RULE-CVE-2026-4302-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/optn/v1/integration-action(/|\\\\?|$)~"}, {"name": "ARGS:link", "type": "regex", "value": "~(?:^(?:https?://)?(?:127\\\\.|10\\\\.|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|0[.]|0x|\\\\[[:0-9a-fA-F]|localhost))|(?:^(?:gopher|file|dict|ftp|telnet|ldap)://)~i"}], "cve": "CVE-2026-4302", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4302", "description": "Optin (optin) <=1.4.29 unauthenticated SSRF via REST API optn/v1/integration-action link parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "optin", "tags": ["ssrf", "unauthenticated", "rest-api", "cwe-918"], "target": "plugin", "versions": "<=1.4.29"}, "RULE-CVE-2026-4303-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through post editor", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4303-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:[/?&]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[wsm_showDayStatsGraph\\\\b[^\\\\]]*\\\\bheight\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#)~i"}], "cve": "CVE-2026-4303", "description": "WP Visitor Statistics (wp-stats-manager) <=8.4 stored XSS via height attribute in wsm_showDayStatsGraph shortcode injected through REST API posts endpoint", "mode": "block", "severity": 6.4, "slug": "wp-stats-manager", "target": "plugin", "versions": "<=8.4"}, "RULE-CVE-2026-4306-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS:task", "type": "equals", "value": "getNextJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:AND|OR)\\\\s+\\\\d+=\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4306-02": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "REQUEST_URI", "type": "contains", "value": "/wp-admin/admin-ajax.php"}, {"name": "ARGS:task", "type": "equals", "value": "getNextTemplateJobs"}, {"name": "ARGS:radius", "type": "regex", "value": "~(?:\\\\bUNION\\\\b\\\\s+(?:\\\\bALL\\\\b\\\\s+)?\\\\bSELECT\\\\b|\\\\b(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|\\\\b(?:AND|OR)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|/\\\\*[^*]*\\\\*+(?:[^/*][^*]*\\\\*+)*/|(?:--|#)\\\\s*$)~i"}], "cve": "CVE-2026-4306", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4306", "description": "WP Job Portal <=2.4.8 unauthenticated SQL injection via radius parameter in getNextTemplateJobs AJAX task", "method": "POST", "mode": "block", "severity": 7.5, "slug": "wp-job-portal", "tags": ["sql-injection", "unauthenticated"], "target": "plugin", "versions": "<=2.4.8"}, "RULE-CVE-2026-4326-01": {"ajax_action": "afeb_activate_required_plugins", "conditions": [{"type": "missing_capability", "value": "install_plugins"}], "cve": "CVE-2026-4326", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4326", "description": "Vertex Addons for Elementor <=1.6.4 missing authorization on afeb_activate_required_plugins allows subscriber+ arbitrary plugin installation", "mode": "block", "severity": 8.8, "slug": "addons-for-elementor-builder", "tags": ["missing-authorization", "arbitrary-plugin-installation", "privilege-escalation"], "target": "plugin", "versions": "<=1.6.4"}, "RULE-CVE-2026-4328-01": {"ajax_action": "demo_download_and_unzip", "conditions": [{"name": "ARGS:demo_file_type", "type": "equals", "value": "url"}, {"name": "ARGS:demo_file", "type": "regex", "value": "~(?:^(?:gopher|dict|file|ftp|ldap|ssh2?|telnet|tftp|expect|glob|phar|php|zip|rar|data|ogg|compress\\\\.zlib)\\\\s*:|(?:^|//|@)(?:localhost|127\\\\.0\\\\.0\\\\.[0-9]|10\\\\.[0-9]|172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.|169\\\\.254\\\\.|0\\\\.0\\\\.0\\\\.0|\\\\[?::1\\\\]?|0177\\\\.|0x7f)(?:[:/]|$))~i"}], "cve": "CVE-2026-4328", "description": "Advanced Import <=1.4.6 authenticated SSRF via demo_file parameter in demo_download_and_unzip AJAX handler", "mode": "block", "severity": 6.4, "slug": "advanced-import", "target": "plugin", "versions": "<=1.4.6"}, "RULE-CVE-2026-4329-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4329", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4329", "description": "Blackhole Bad Bots <=3.8 stored XSS via unescaped bot log data on admin settings page", "mode": "block", "severity": 7.2, "slug": "blackhole-bad-bots", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=3.8"}, "RULE-CVE-2026-4331-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "b2s_reset_social_meta_tags"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4331", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4331", "description": "Blog2Social <=8.8.2 missing authorization on b2s_reset_social_meta_tags allows subscriber+ deletion of all social meta data", "mode": "block", "severity": 4.3, "slug": "blog2social", "tags": ["missing-authorization", "data-deletion", "authenticated"], "target": "plugin", "versions": "<=8.8.2"}, "RULE-CVE-2026-4333-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|<script|<img|<iframe|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4333", "description": "LearnPress <=4.3.3 Stored XSS via learn_press_courses shortcode skin attribute in post content (post editor)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-4333-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[learn_press_courses\\\\b[^\\\\]]*skin\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:on[a-zA-Z]+\\\\s*=|<script|<img|<iframe|javascript\\\\s*:)[^\\"\']*[\\"\']~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4333", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4333", "description": "LearnPress <=4.3.3 Stored XSS via learn_press_courses shortcode skin attribute in post content (REST API)", "method": "POST", "mode": "block", "severity": 6.4, "slug": "learnpress", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=4.3.3"}, "RULE-CVE-2026-4335-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/media/[0-9]+~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter|move)|load|error|keydown|keyup|change|input|submit|reset|drag|drop|pointer(?:down|up|enter|leave))\\\\s*=|<script[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4335", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4335", "description": "ShortPixel Image Optimizer <=6.4.3 Author+ stored XSS via attachment post_title rendered unescaped in AI editor popup", "method": "POST", "mode": "block", "severity": 5.4, "slug": "shortpixel-image-optimiser", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=6.4.3"}, "RULE-CVE-2026-4336-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/ufaq(?:$|[/?]|\\\\?.*)~"}, {"name": "ARGS:content", "type": "regex", "value": "~<(?:script\\\\b[^>]*>.*?</script\\\\s*>|[^>]+\\\\bon(?:click|load|error|mouseover|focus|blur)\\\\s*=|a\\\\b[^>]+\\\\bhref\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:|img\\\\b[^>]+\\\\bsrc\\\\s*=\\\\s*[\\"\']?\\\\s*javascript\\\\s*:)~is"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ content submitted to REST API /wp/v2/ufaq", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4336-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post(?:-new)?\\\\.php~"}, {"name": "ARGS:post_type", "type": "equals", "value": "ufaq"}, {"name": "ARGS:content", "type": "regex", "value": "~<script[ />]|<[^>]+on(?:click|load|error|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&lt;script|&lt;[^&]*on(?:click|load|error|mouseover|focus|blur)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4336", "description": "Ultimate FAQS <= 2.4.7 stored XSS via FAQ post_content submitted through wp-admin/post.php editor", "mode": "block", "severity": 6.4, "slug": "ultimate-faqs", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-4338-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/activitypub/1\\\\.0/outbox(?:[/?]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4338", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4338", "description": "ActivityPub <8.0.2 unauthenticated information disclosure of draft/scheduled/pending posts via site-level outbox REST endpoint", "method": "GET", "mode": "block", "severity": 7.5, "slug": "activitypub", "tags": ["information-disclosure", "rest-api", "unauthenticated", "improper-access-control"], "target": "plugin", "versions": "<8.0.2"}, "RULE-CVE-2026-4341-01": {"action": "init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "save_builder"}, {"name": "ARGS:actions", "type": "regex", "value": "~follow_us_text[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor AJAX save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4341-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/elementor/v1/document/[0-9]+(?:[/?&]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~follow_us_text[^}]*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4341", "description": "Prime Slider <=4.1.10 stored XSS via follow_us_text in Mount widget (Elementor REST save)", "mode": "block", "severity": 6.4, "slug": "bdthemes-prime-slider-lite", "target": "plugin", "versions": "<=4.1.10"}, "RULE-CVE-2026-4347-01": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via file upload move flow (generate_user_filepath / move_temp_file_to_upload_dir)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4347-02": {"action": "template_redirect", "conditions": [{"name": "ARGS:MWF_file", "type": "regex", "value": "~\\\\.(?:ph(?:p[0-9s]?|tml?|t|ar)|phs|s?html?|cgi|asp|aspx|jsp|jspx|cfm|user\\\\.ini)$|[\\\\\\\\/]\\\\.htaccess$|[\\\\\\\\/]\\\\.htpasswd$~i"}, {"name": "ARGS:_mw_wp_form_token", "type": "exists"}], "cve": "CVE-2026-4347", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4347", "description": "MW WP Form <=5.1.0 unauthenticated path traversal via crafted uploaded filename in file field", "method": "POST", "mode": "block", "severity": 8.1, "slug": "mw-wp-form", "tags": ["path-traversal", "arbitrary-file-upload", "unauthenticated"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4365-01": {"action": "init", "conditions": [{"name": "ARGS:lp-ajax", "type": "equals", "value": "delete_question_answer"}, {"type": "missing_capability", "value": "edit_lp_courses"}], "cve": "CVE-2026-4365", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4365", "description": "LearnPress <=4.3.2.8 unauthenticated arbitrary quiz answer deletion via lp-ajax delete_question_answer", "method": "POST", "mode": "block", "severity": 9.1, "slug": "learnpress", "tags": ["missing-authorization", "data-deletion", "unauthenticated"], "target": "plugin", "versions": "<=4.3.2.8"}, "RULE-CVE-2026-4373-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-02": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (AJAX path)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-03": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"(?:[^\\"]*(?:\\\\.\\\\.[\\\\\\\\/])|/(?:etc|proc|var/log)[\\\\\\\\/])~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via path traversal in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4373-04": {"action": "wp_loaded", "conditions": [{"name": "ARGS:_jfb_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"file\\"\\\\s*:\\\\s*\\"[^\\"]*(?:wp-config\\\\.php|\\\\.htaccess|\\\\.env(?![a-z])|debug\\\\.log|error_log(?![a-z]))~i"}], "cve": "CVE-2026-4373", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4373", "description": "JetFormBuilder <=3.5.6.2 unauthenticated arbitrary file read via sensitive file path in Media Field JSON preset (non-AJAX form submission)", "method": "POST", "mode": "block", "severity": 7.5, "slug": "jetformbuilder", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated"], "target": "plugin", "versions": "<=3.5.6.2"}, "RULE-CVE-2026-4379-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in post.php", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4379-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[gallery\\\\s[^\\\\]]*group\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s+on[a-z]+=|[\\"\']>)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4379", "description": "WP jQuery Lightbox <=2.3.4 Contributor+ Stored XSS via gallery shortcode group attribute in REST API", "method": "POST", "mode": "block", "severity": 6.4, "slug": "wp-jquery-lightbox", "tags": ["xss", "stored", "shortcode", "rest-api", "authenticated"], "target": "plugin", "versions": "<=2.3.4"}, "RULE-CVE-2026-4388-01": {"ajax_action": "fm_submit_form", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in fm_submit_form AJAX handler", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4388-02": {"action": "init", "conditions": [{"name": "ARGS:fm_form_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~\\"\\\\s*(?:on(?:focus|blur|click|dblclick|mouse(?:over|out|down|up|move|enter|leave)|key(?:down|up|press)|load|error|submit|reset|change|input|select|abort|resize|scroll|unload|beforeunload|hashchange|pointerdown|pointerup|pointermove|pointerover|pointerout|touchstart|touchend|touchmove|drag|dragstart|dragend|dragover|dragenter|dragleave|drop|animationstart|animationend|transitionend|contextmenu|wheel|copy|cut|paste)\\\\s*=|style\\\\s*=\\\\s*[\\"\']?[^\\"\'>]*(?:expression|url)\\\\s*\\\\()~i"}], "cve": "CVE-2026-4388", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4388", "description": "Form Maker by 10Web <=1.15.40 unauthenticated stored XSS via Matrix field attribute-context injection in non-AJAX form submission", "method": "POST", "mode": "block", "severity": 7.2, "slug": "form-maker", "tags": ["xss", "stored", "unauthenticated", "attribute-injection"], "target": "plugin", "versions": "<=1.15.40"}, "RULE-CVE-2026-4429-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/(?:post|post-new)\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4429-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|[a-z0-9_-]+)(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[osm_map_v3\\\\b[^\\\\]]*\\\\b(?:marker_name|file_color_list)\\\\s*=\\\\s*[\'\\\\\\"][^\'\\\\\\"\\\\]]*(?:<[a-z!/]|on[a-z]+\\\\s*=|javascript\\\\s*:|&#|%3[Cc])~i"}], "cve": "CVE-2026-4429", "description": "OSM <=6.1.15 authenticated (Contributor+) stored XSS via [osm_map_v3] shortcode marker_name/file_color_list attributes saved through REST API wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "osm", "target": "plugin", "versions": "<=6.1.15"}, "RULE-CVE-2026-4484-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/masteriyo/v1/users/instructors/[0-9]+(?:[/?]|$)~"}, {"name": "ARGS:roles", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4484", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4484", "description": "Masteriyo LMS <=2.1.6 authenticated (Student+) privilege escalation to administrator via roles parameter in instructors REST endpoint", "mode": "block", "severity": 9.8, "slug": "learning-management-system", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=2.1.6"}, "RULE-CVE-2026-45218-01": {"action": "wp_ajax_nopriv_wp_travel_update_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_update_trip unauthenticated endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-02": {"action": "wp_ajax_nopriv_wp_travel_get_trip", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_trip without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-03": {"action": "wp_ajax_wp_travel_get_pricings", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_pricings without nonce/capability check", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-04": {"action": "wp_ajax_nopriv_wptravel_save_user_enquiry", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wptravel_save_user_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-05": {"action": "wp_ajax_nopriv_wp_travel_add_to_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_add_to_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-06": {"action": "wp_ajax_nopriv_wp_travel_get_cart", "conditions": [{"name": "ARGS:trip_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via wp_travel_get_cart endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45218-07": {"action": "wp_ajax_delete_itinerary_enquiry", "conditions": [{"name": "ARGS:enquiry_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/[*].*[*]/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+)~i"}, {"name": "missing_capability", "type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-45218", "description": "WP Travel <=11.4.0 SQL injection via delete_itinerary_enquiry endpoint", "mode": "block", "severity": 7.7, "slug": "wp-travel", "target": "plugin", "versions": "<=11.4.0"}, "RULE-CVE-2026-45437-01": {"ajax_action": "eszlwcf_filter_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_filter_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45437-02": {"ajax_action": "eszlwcf_load_more_products", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<\\\\s*(?:img|svg|iframe|object|embed|details|math)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-45437", "description": "Product Filter Widget for Elementor <=1.0.6 unauthenticated reflected XSS via eszlwcf_load_more_products AJAX handler", "mode": "block", "severity": 7.1, "slug": "product-filter-widget-for-elementor", "target": "plugin", "versions": "<=1.0.6"}, "RULE-CVE-2026-45439-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:import)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API import endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-45439-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/idx_api/v1(?:update)(?:_json)?/~i"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|\\\\bOR\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|\\\\bAND\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]|(?:%27|\')\\\\s*(?:UNION|OR|AND|SELECT)\\\\b)~i"}], "cve": "CVE-2026-45439", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-45439", "description": "Realtyna Organic IDX plugin <=5.1.0 unauthenticated SQL injection via IDX REST API update endpoint (token path + query parameters)", "mode": "block", "severity": 9.3, "slug": "real-estate-listing-realtyna-wpl", "tags": ["sql-injection", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.1.0"}, "RULE-CVE-2026-4655-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:options", "type": "regex", "value": "~bdt-svg-image~i"}, {"name": "ARGS:options", "type": "regex", "value": "~(?:%3C|<)\\\\s*script[\\\\s/>]|on(?:error|load|click|mouseover|focus)\\\\s*(?:=|%3D)|javascript\\\\s*(?::|%3A)|%253[Cc]script~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4655", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4655", "description": "Element Pack Lite <=8.4.2 contributor+ stored XSS via SVG Image widget svg_source on elementor_ajax", "mode": "block", "severity": 6.4, "slug": "bdthemes-element-pack-lite", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=8.4.2"}, "RULE-CVE-2026-4658-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block class attributes (REST post save - className)", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4658-02": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~wp:essential-blocks/add-to-cart[\\\\s\\\\S]{0,500}?(?:className|classHook|blockId)[\\\\s\\\\S]{0,200}?(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|&quot;javascript)~i"}], "cve": "CVE-2026-4658", "description": "Essential Blocks <=6.0.4 stored XSS via AddToCart block markup in any request body", "method": "POST", "mode": "block", "severity": 6.4, "slug": "essential-blocks", "target": "plugin", "versions": "<=6.0.4"}, "RULE-CVE-2026-4659-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]+){2,}|/etc/passwd|[/\\\\\\\\](?:wp-config\\\\.php|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-4659", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4659", "description": "Unlimited Elements for Elementor <=2.0.6 authenticated contributor+ arbitrary file read via path traversal in Repeater JSON/CSV URL within Elementor widget settings", "mode": "block", "severity": 7.5, "slug": "unlimited-elements-for-elementor", "tags": ["path-traversal", "arbitrary-file-read", "authenticated", "elementor"], "target": "plugin", "versions": "<=2.0.6"}, "RULE-CVE-2026-4664-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ivole/v1/review(?:[/?&]|$)~"}, {"name": "ARGS:key", "type": "regex", "value": "~^\\\\s*$~"}], "cve": "CVE-2026-4664", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4664", "description": "Customer Reviews for WooCommerce <=5.103.0 unauthenticated authentication bypass on POST /ivole/v1/review via empty key parameter against ivole_secret_key meta", "method": "POST", "mode": "block", "severity": 5.3, "slug": "customer-reviews-woocommerce", "tags": ["authentication-bypass", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=5.103.0"}, "RULE-CVE-2026-4758-01": {"ajax_action": "wpjobportal_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4758-02": {"ajax_action": "wpjobportal_ajax_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:$|[^a-zA-Z0-9_])))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4758", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4758", "description": "WP Job Portal <=2.4.9 authenticated arbitrary file deletion via path traversal in wpjobportal_ajax_popup", "mode": "block", "severity": 8.8, "slug": "wp-job-portal", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=2.4.9"}, "RULE-CVE-2026-4785-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (post.php save)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-02": {"ajax_action": "heartbeat", "conditions": [{"name": "ARGS", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (heartbeat autosave)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4785-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[latepoint_resources\\\\b[^\\\\]]*button_caption\\\\s*=\\\\s*(?:\\"[^\\"]*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=)|\'[^\']*(?:<[a-zA-Z/!]|javascript:|on[a-zA-Z]+\\\\s*=))~i"}], "cve": "CVE-2026-4785", "description": "LatePoint <=5.3.0 stored XSS via button_caption parameter in [latepoint_resources] shortcode (REST API)", "mode": "block", "severity": 6.4, "slug": "latepoint", "target": "plugin", "versions": "<=5.3.0"}, "RULE-CVE-2026-4790-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~i"}, {"name": "ARGS:custom_svg", "type": "regex", "value": "~(?:<script[\\\\s/>]|\\\\son(?:load|error|click|mouseover|focus|animationstart|animationend)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-4790", "description": "Premium Addons for Elementor <=4.11.70 contributor+ stored XSS via custom_svg parameter (CWE-79)", "mode": "block", "severity": 5.4, "slug": "premium-addons-for-elementor", "target": "plugin", "versions": "<=4.11.70"}, "RULE-CVE-2026-4801-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?(?:icalFeedUrl|eventsTitle|eventsDescription|eventsLocation)[\\\\s\\\\S]*?<[^>]+(?:on(?:error|load|click|mouseover|focus|blur)\\\\s*=|javascript\\\\s*:|<script[\\\\s/>])~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed attributes in Gutenberg REST API", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4801-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:pages|posts)(/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~coblocks/events[\\\\s\\\\S]*?icalFeedUrl[\\\\s\\\\S]*?(?:javascript\\\\s*:|<[^>]+on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-4801", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4801", "description": "CoBlocks <=3.1.16 stored XSS via Events block iCal feed URL attribute", "mode": "block", "severity": 6.4, "slug": "coblocks", "tags": ["xss", "stored", "authenticated", "gutenberg"], "target": "plugin", "versions": "<=3.1.16"}, "RULE-CVE-2026-4812-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/post_object/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated post_object enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/relationship/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated relationship enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/page_link/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated page_link enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/user/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated user enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-05": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/select/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated select enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4812-06": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php(?:\\\\?|$)~"}, {"name": "ARGS:action", "type": "equals", "value": "acf/fields/taxonomy/query"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-4812", "description": "Advanced Custom Fields <=6.7.0 unauthenticated taxonomy enumeration", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.7.0"}, "RULE-CVE-2026-4817-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/lms/stm-lms/order/items(?:/|\\\\?|$)~"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s+(?:UNION|SELECT|DROP|DELETE|INSERT|UPDATE|TABLE|INTO|VALUES|FROM|WHERE|version)\\\\s)~i"}], "cve": "CVE-2026-4817", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4817", "description": "MasterStudy LMS <=3.7.25 SQL injection via orderby parameter in stm-lms/order/items REST endpoint", "method": "POST", "mode": "block", "severity": 6.5, "slug": "masterstudy-lms-learning-management-system", "tags": ["sql-injection", "rest-api", "authenticated"], "target": "plugin", "versions": "<=3.7.25"}, "RULE-CVE-2026-4880-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "barcodeScannerConfigs"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX action (GET or POST)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-02": {"ajax_action": "setUserMeta", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via setUserMeta AJAX action (wp_capabilities)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]action=barcodeScannerConfigs(?:&|$)~"}, {"name": "ARGS:token", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner <=1.11.0 unauthenticated token leak via barcodeScannerConfigs AJAX GET request (REQUEST_URI detection)", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "authentication-bypass", "unauthenticated", "token-leak"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-4880-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[/\\\\\\\\]barcode-scanner-lite-pos-to-manage-products-inventory-and-orders[/\\\\\\\\]request\\\\.php~"}, {"name": "ARGS:route", "type": "equals", "value": "setUserMeta"}, {"name": "ARGS", "type": "regex", "value": "~(?:wp_capabilities|wp_user_level)~"}], "cve": "CVE-2026-4880", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4880", "description": "Barcode Scanner and Inventory manager <=1.11.0 unauthenticated privilege escalation via direct request.php setUserMeta endpoint (wp_capabilities)", "method": "POST", "mode": "block", "severity": 9.8, "slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders", "tags": ["privilege-escalation", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=1.11.0"}, "RULE-CVE-2026-48835-01": {"ajax_action": "wpforms_connect_process", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48835", "description": "WPForms Lite <=1.10.0.4 unauthenticated broken access control via wpforms_connect_process AJAX handler", "mode": "block", "severity": 7.5, "slug": "wpforms-lite", "target": "plugin", "versions": "<=1.10.0.4"}, "RULE-CVE-2026-48874-01": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via orderby in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48874-02": {"ajax_action": "ct_ajax_list_table_request", "conditions": [{"name": "ARGS:query_args[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|CASE\\\\s+WHEN\\\\s.*\\\\s+THEN\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48874", "description": "GamiPress <=7.8.7 subscriber+ SQL injection via order in ct_ajax_list_table_request", "mode": "block", "severity": 8.5, "slug": "gamipress", "target": "plugin", "versions": "<=7.8.7"}, "RULE-CVE-2026-48882-01": {"ajax_action": "wpts_run_email_diagnostic", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-48882", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-48882", "description": "WP Time Slots Booking Form <=1.2.50 subscriber+ SQL injection via wpts_run_email_diagnostic AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-time-slots-booking-form", "tags": ["sql-injection", "missing-authorization", "authenticated"], "target": "plugin", "versions": "<=1.2.50"}, "RULE-CVE-2026-4896-01": {"ajax_action": "delete_wcfm_product", "conditions": [{"name": "ARGS:proid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_product allows authenticated users to delete arbitrary products without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-02": {"ajax_action": "delete_wcfm_article", "conditions": [{"name": "ARGS:articleid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on delete_wcfm_article allows authenticated users to delete arbitrary articles without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-4896-03": {"ajax_action": "wcfm_modify_order_status", "conditions": [{"name": "ARGS:orderid", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4896", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4896", "description": "WC Frontend Manager <=6.7.25 IDOR on wcfm_modify_order_status allows authenticated users to modify status of arbitrary orders without ownership validation", "mode": "block", "severity": 8.1, "slug": "wc-frontend-manager", "tags": ["idor", "missing-authorization", "broken-object-ownership", "authenticated"], "target": "plugin", "versions": "<=6.7.25"}, "RULE-CVE-2026-48964-01": {"ajax_action": "eh_crm_settings_initiate_ticket", "conditions": [{"name": "ARGS:start_number", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\(|ORDER\\\\s+BY\\\\s+\\\\d+\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-48964", "description": "ELEX WordPress HelpDesk & Customer Ticketing System <=3.3.6 authenticated SQL injection via start_number in eh_crm_settings_initiate_ticket AJAX handler", "mode": "block", "severity": 8.5, "slug": "elex-helpdesk-customer-support-ticket-system", "target": "plugin", "versions": "<=3.3.6"}, "RULE-CVE-2026-48968-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_params in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via slider_id in preview view", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via orderby in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-48968-04": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-48968", "description": "Master Slider <=3.10.8 Contributor+ reflected XSS via order in list table", "mode": "block", "severity": 6.5, "slug": "master-slider", "target": "plugin", "versions": "<=3.10.8"}, "RULE-CVE-2026-49044-01": {"action": "admin_init", "conditions": [{"name": "ARGS:option_page", "type": "equals", "value": "acffa_settings"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-49044", "description": "Advanced Custom Fields: Font Awesome Field <=5.0.2 authenticated stored XSS via acffa_settings option values", "mode": "block", "severity": 6.5, "slug": "advanced-custom-fields-font-awesome", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-49055-01": {"ajax_action": "dnd_codedropz_upload_delete", "conditions": [{"name": "ARGS:path", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]*\\\\bsrc\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated reflected XSS via path parameter in dnd_codedropz_upload_delete", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "reflected-xss", "unauthenticated"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49055-02": {"ajax_action": "dnd_codedropz_upload", "conditions": [{"name": "FILES:upload-file:name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]*\\\\bsrc\\\\s*=|<svg[\\\\s/>]|<iframe[\\\\s/>])~i"}], "cve": "CVE-2026-49055", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49055", "description": "Drag and Drop Multiple File Upload CF7 <=1.3.9.7 unauthenticated stored XSS via uploaded filename in dnd_codedropz_upload", "mode": "block", "severity": 7.1, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["xss", "stored-xss", "unauthenticated", "file-upload"], "target": "plugin", "versions": "<=1.3.9.7"}, "RULE-CVE-2026-49063-01": {"ajax_action": "lsd_register", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_register (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-02": {"ajax_action": "lsd_login", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Unauthenticated Privilege Escalation via lsd_login (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49063-03": {"ajax_action": "lsd_activation", "conditions": [{"name": "ARGS:lsd_role", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49063", "description": "Listdom <= 5.5.0 - Authenticated Privilege Escalation via lsd_activation (role injection)", "mode": "block", "severity": 7.3, "slug": "listdom", "target": "plugin", "versions": "<=5.5.0"}, "RULE-CVE-2026-49067-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "regex", "value": "~^yydev[_-]redirect~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-49067", "description": "Advanced 301 and 302 Redirect <=1.6.9 unauthenticated SQL injection via id parameter on admin page endpoint", "mode": "block", "severity": 9.3, "slug": "advanced-301-and-302-redirect", "target": "plugin", "versions": "<=1.6.9"}, "RULE-CVE-2026-49069-01": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via taxonomy parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-02": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:term", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via term parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-03": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via orderby parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49069-04": {"ajax_action": "wpzoom_load_more_items", "conditions": [{"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+(?:src\\\\s*=\\\\s*[\'\\"]?(?:javascript|data):|onerror\\\\s*=)|<svg[\\\\s/]|<iframe[\\\\s/]|<object[\\\\s/])~i"}], "cve": "CVE-2026-49069", "description": "WPZOOM Portfolio <=1.4.21 unauthenticated reflected XSS via order parameter in wpzoom_load_more_items AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpzoom-portfolio", "target": "plugin", "versions": "<=1.4.21"}, "RULE-CVE-2026-49085-01": {"action": "init", "conditions": [{"name": "ARGS:data", "type": "regex", "value": "~Tzo|Qzo~"}], "cve": "CVE-2026-49085", "description": "WP Insightly for CF7 <=1.1.4 unauthenticated PHP object injection via base64-encoded data parameter", "mode": "block", "severity": 9.8, "slug": "cf7-insightly", "target": "plugin", "versions": "<=1.1.4"}, "RULE-CVE-2026-49104-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:/|\\\\\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\\\\\"\\\\{]~"}], "cve": "CVE-2026-49104", "description": "Integration for Keap/Infusionsoft and Contact Form 7 <=1.2.1 unauthenticated PHP object injection via CF7 form field deserialization", "mode": "block", "severity": 9.8, "slug": "cf7-infusionsoft", "target": "plugin", "versions": "<=1.2.1"}, "RULE-CVE-2026-49106-01": {"ajax_action": "get_objects_9658", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49106", "description": "Integration for Contact Form 7 and Constant Contact <=1.1.6 missing authorization on get_objects_9658 AJAX handler allows subscriber+ PHP Object Injection via stored feed meta", "mode": "block", "severity": 9.8, "slug": "cf7-constant-contact", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-49106-02": {"ajax_action": "get_field_map_9658", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49106", "description": "Integration for Contact Form 7 and Constant Contact <=1.1.6 missing authorization on get_field_map_9658 AJAX handler allows subscriber+ PHP Object Injection via stored feed meta", "mode": "block", "severity": 9.8, "slug": "cf7-constant-contact", "target": "plugin", "versions": "<=1.1.6"}, "RULE-CVE-2026-49112-01": {"action": "init", "conditions": [{"name": "ARGS:_sf_file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}], "cve": "CVE-2026-49112", "description": "Shared Files <=1.7.64 unauthenticated path traversal via _sf_file query var leading to arbitrary file read", "mode": "block", "severity": 7.5, "slug": "shared-files", "target": "plugin", "versions": "<=1.7.64"}, "RULE-CVE-2026-49112-02": {"action": "init", "conditions": [{"name": "ARGS:_SF_GOTO", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|https?://(?!(?:[a-z0-9-]+\\\\.)*(?:wordpress\\\\.org|w\\\\.org)(?:[/?#]|$)))~i"}], "cve": "CVE-2026-49112", "description": "Shared Files <=1.7.64 unauthenticated path traversal/open redirect via _SF_GOTO query var", "mode": "block", "severity": 7.5, "slug": "shared-files", "target": "plugin", "versions": "<=1.7.64"}, "RULE-CVE-2026-4935-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "suretriggers-status"}, {"name": "ARGS:status_filter", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-4935", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4935", "description": "SureTriggers <=1.1.22 authenticated SQL injection via status_filter parameter", "mode": "block", "severity": 8.6, "slug": "suretriggers", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=1.1.22"}, "RULE-CVE-2026-49763-01": {"action": "init", "conditions": [{"name": "ARGS:code", "type": "exists"}, {"name": "ARGS:state", "type": "regex", "value": "~(?:%(?:4[Ff]|6[Ff]|43|63|61|41)|[OCa])(?:%3[Aa]|:)[0-9]~i"}], "cve": "CVE-2026-49763", "description": "Integration for Contact Form 7 HubSpot <=1.3.7 unauthenticated PHP Object Injection via state parameter in OAuth callback", "mode": "block", "severity": 9.8, "slug": "cf7-hubspot", "target": "plugin", "versions": "<=1.3.7"}, "RULE-CVE-2026-49764-01": {"ajax_action": "rm_activate_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49764", "description": "Block unauthenticated access to rm_activate_user AJAX handler (CWE-288 Authentication Bypass) in RegistrationMagic <= 6.0.8.6", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.8.6"}, "RULE-CVE-2026-49764-02": {"ajax_action": "rm_login_social_user", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-49764", "description": "Block unauthenticated access to rm_login_social_user AJAX handler (CWE-288 Authentication Bypass) in RegistrationMagic <= 6.0.8.6", "mode": "block", "severity": 9.8, "slug": "custom-registration-form-builder-with-submission-manager", "target": "plugin", "versions": "<=6.0.8.6"}, "RULE-CVE-2026-49765-01": {"action": "init", "conditions": [{"name": "ARGS:vx_data", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2026-49765", "description": "Integration for Mailchimp and CF7 <=1.1.8 - PHP Object Injection via vx_data on init hook (unauthenticated)", "mode": "block", "severity": 9.8, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-49765-02": {"ajax_action": "update_feed_mc", "conditions": [{"name": "ARGS:vx_data", "type": "regex", "value": "~[OCa]:[0-9]+:~"}], "cve": "CVE-2026-49765", "description": "Integration for Mailchimp and CF7 <=1.1.8 - Authenticated PHP Object Injection via vx_data in update_feed_mc AJAX handler", "mode": "block", "severity": 9.8, "slug": "cf7-mailchimp", "target": "plugin", "versions": "<=1.1.8"}, "RULE-CVE-2026-49766-01": {"action": "init", "conditions": [{"name": "ARGS:current_user_avatar", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-49766", "description": "WP User Manager <=2.9.16 subscriber+ arbitrary file deletion via path traversal in current_user_avatar", "mode": "block", "severity": 9.9, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.16"}, "RULE-CVE-2026-49766-02": {"action": "init", "conditions": [{"name": "ARGS:current_user_cover", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env))~i"}], "cve": "CVE-2026-49766", "description": "WP User Manager <=2.9.16 subscriber+ arbitrary file deletion via path traversal in current_user_cover", "mode": "block", "severity": 9.9, "slug": "wp-user-manager", "target": "plugin", "versions": "<=2.9.16"}, "RULE-CVE-2026-49767-01": {"ajax_action": "wpforo_confirm_current_user_password", "conditions": [{"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-49767", "description": "wpForo Forum <=3.1.0 unauthenticated broken authentication via wpforo_confirm_current_user_password AJAX handler", "mode": "block", "severity": 9.8, "slug": "wpforo", "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-49769-01": {"action": "init", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49769", "description": "wpForo Forum <=3.1.0 unauthenticated PHP Object Injection via serialized parameter", "mode": "block", "severity": 9.8, "slug": "wpforo", "target": "plugin", "versions": "<=3.1.0"}, "RULE-CVE-2026-49770-01": {"ajax_action": "wte_onboard_dynamic_recommendation", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wte_onboard_dynamic_recommendation AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-02": {"ajax_action": "email_test", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via email_test AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-03": {"ajax_action": "wte_fxn_clone_trip_data", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wte_fxn_clone_trip_data AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49770-04": {"ajax_action": "wptravelengine_send_test_email", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49770", "description": "WP Travel Engine <=6.7.12 unauthenticated PHP object injection via wptravelengine_send_test_email AJAX handler", "mode": "block", "severity": 9.8, "slug": "wp-travel-engine", "target": "plugin", "versions": "<=6.7.12"}, "RULE-CVE-2026-49771-01": {"ajax_action": "bwg_frontend_data", "conditions": [{"name": "ARGS:sortImagesByValue_/[0-9]+/", "type": "regex", "value": "~(?:(?:\\\\bAND\\\\b|\\\\bOR\\\\b)\\\\s+[\\\\d\'\\"(]|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bWAITFOR\\\\b|--\\\\s*[-#]|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\s)~i"}], "cve": "CVE-2026-49771", "description": "Photo Gallery by 10Web <=1.8.41 blind SQL injection via sortImagesByValue parameter in bwg_frontend_data AJAX handler (unauthenticated)", "mode": "block", "severity": 7.6, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.41"}, "RULE-CVE-2026-49771-02": {"ajax_action": "GalleryBox", "conditions": [{"name": "ARGS:sortImagesByValue_/[0-9]+/", "type": "regex", "value": "~(?:(?:\\\\bAND\\\\b|\\\\bOR\\\\b)\\\\s+[\\\\d\'\\"(]|\\\\bUNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\b|\\\\bSLEEP\\\\s*\\\\(|\\\\bWAITFOR\\\\b|--\\\\s*[-#]|;\\\\s*(?:SELECT|DROP|INSERT|UPDATE|DELETE)\\\\s)~i"}], "cve": "CVE-2026-49771", "description": "Photo Gallery by 10Web <=1.8.41 blind SQL injection via sortImagesByValue parameter in GalleryBox AJAX handler (unauthenticated)", "mode": "block", "severity": 7.6, "slug": "photo-gallery", "target": "plugin", "versions": "<=1.8.41"}, "RULE-CVE-2026-49772-01": {"action": "init", "conditions": [{"name": "ARGS:event_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 unauthenticated blind SQL injection via event_ids parameter on attendee registration page", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "unauthenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49772-02": {"ajax_action": "tec_qr_code_modal", "conditions": [{"name": "ARGS:post_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?[0-9]+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?[0-9]+|SLEEP\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|/\\\\*[^*]*\\\\*/|\\\\bCASE\\\\s+WHEN\\\\b|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-49772", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-49772", "description": "The Events Calendar >=6.15.12 <=6.16.2 authenticated blind SQL injection via post_id in tec_qr_code_modal AJAX handler", "mode": "block", "severity": 9.3, "slug": "the-events-calendar", "tags": ["sql-injection", "authenticated", "blind-sqli"], "target": "plugin", "versions": ">=6.15.12 <=6.16.2"}, "RULE-CVE-2026-49776-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|MAKE_SET|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}], "cve": "CVE-2026-49776", "description": "GPTranslate <=2.32.6 unauthenticated SQL injection via id parameter in gptranslate/v1/request REST endpoint", "mode": "block", "severity": 9.3, "slug": "gptranslate", "target": "plugin", "versions": "<=2.32.6"}, "RULE-CVE-2026-49781-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/suretriggers/v1/~"}, {"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:[\\"\\\\{]~"}], "cve": "CVE-2026-49781", "description": "OttoKit (SureTriggers) <=1.1.27 unauthenticated PHP object injection via REST API", "mode": "block", "severity": 9.8, "slug": "suretriggers", "target": "plugin", "versions": "<=1.1.27"}, "RULE-CVE-2026-4987-01": {"ajax_action": "srfm_create_payment_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_payment_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-4987-02": {"ajax_action": "srfm_create_subscription_intent", "conditions": [{"name": "ARGS:form_id", "type": "regex", "value": "~^(?![1-9][0-9]*$)~"}], "cve": "CVE-2026-4987", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-4987", "description": "SureForms <=2.5.2 unauthenticated payment amount validation bypass via invalid form_id in srfm_create_subscription_intent", "mode": "block", "severity": 7.5, "slug": "sureforms", "tags": ["improper-input-validation", "payment-bypass", "unauthenticated"], "target": "plugin", "versions": "<=2.5.2"}, "RULE-CVE-2026-5127-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "wpuf_submit_post"}, {"name": "ARGS:wpuf_files", "type": "regex", "value": "~(?:^|[^a-zA-Z0-9])(?:O|C|a):[0-9]+:(?:\\"|%22|%2522)~i"}], "cve": "CVE-2026-5127", "description": "WP User Frontend <=4.3.1 PHP object injection via wpuf_files parameter on admin-ajax.php action=wpuf_submit_post", "mode": "block", "severity": 8.8, "slug": "wp-user-frontend", "target": "plugin", "versions": "<=4.3.1"}, "RULE-CVE-2026-5149-01": {"ajax_action": "get_submission_content", "conditions": [{"name": "ARGS:entries_id", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5149", "description": "RTMKit <=2.0.7 missing authorization on get_submission_content allows contributor+ to view arbitrary form submissions via entries_id IDOR", "mode": "block", "severity": 6.5, "slug": "rometheme-for-elementor", "target": "plugin", "versions": "<=2.0.7"}, "RULE-CVE-2026-5162-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "elementor_ajax"}, {"name": "ARGS:elementor_data", "type": "regex", "value": "~instagram_follow_text[^}]{0,4000}?(?:<(?:\\\\\\\\?/?)?(?:script[\\\\s/>]|iframe|object|embed|applet|svg|img\\\\b)|on(?:error|load|click|mouseover|mouseout|focus|blur|change|submit)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5162", "description": "Royal Elementor Addons <=1.7.1056 stored XSS via instagram_follow_text in Instagram Feed widget", "mode": "block", "severity": 6.4, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1056"}, "RULE-CVE-2026-5192-01": {"ajax_action": "forminator_submit_form_cform", "conditions": [{"name": "ARGS:upload-1[file][file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via upload-1[file][file_path] in form submit AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5192-02": {"ajax_action": "forminator_multiple_file_upload", "conditions": [{"name": "ARGS:file_data[file_path]", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)~i"}], "cve": "CVE-2026-5192", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5192", "description": "Forminator <=1.52.1 unauthenticated path traversal via file_data[file_path] in multiple file upload AJAX handler", "mode": "block", "severity": 7.5, "slug": "forminator", "tags": ["path-traversal", "file-upload", "unauthenticated"], "target": "plugin", "versions": "<=1.52.1"}, "RULE-CVE-2026-5200-01": {"ajax_action": "acymailing_router", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "acymailing_router"}, {"name": "ARGS:task", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5200", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5200", "description": "AcyMailing <=10.8.2 missing authorization on acymailing_router allows authenticated subscriber+ privilege escalation", "mode": "block", "severity": 8.8, "slug": "acymailing", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=10.8.2"}, "RULE-CVE-2026-5207-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~admin-ajax\\\\.php~"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (AJAX vector)", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5207-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "llms-reporting"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|IF\\\\s*\\\\(|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/)~i"}], "cve": "CVE-2026-5207", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5207", "description": "LifterLMS <=9.2.1 authenticated SQL injection via order parameter in quiz non-attempts reporting (admin page vector)", "method": "GET", "mode": "block", "severity": 6.5, "slug": "lifterlms", "tags": ["sql-injection", "authenticated", "reporting"], "target": "plugin", "versions": "<=9.2.1"}, "RULE-CVE-2026-5229-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/form-notify/v1/callback(?:[/?]|$)~"}, {"name": "REQUEST_COOKIES:form_notify_line_email", "type": "exists"}], "cve": "CVE-2026-5229", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5229", "description": "Form Notify <=1.1.10 unauthenticated authentication bypass via form_notify_line_email cookie on LINE OAuth callback", "mode": "block", "severity": 9.8, "slug": "form-notify", "tags": ["authentication-bypass", "improper-authentication", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.1.10"}, "RULE-CVE-2026-5231-01": {"action": "admin_init", "conditions": [{"name": "ARGS:tab", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img[^>]+on[a-z]+=|<iframe[\\\\s/>]|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-5231", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5231", "description": "WP Statistics <=14.16.4 reflected XSS via unsanitized tab parameter in admin template", "mode": "block", "severity": 7.2, "slug": "wp-statistics", "tags": ["xss", "reflected", "admin-template"], "target": "plugin", "versions": "<=14.16.4"}, "RULE-CVE-2026-52693-01": {"ajax_action": "get_viariation_details", "conditions": [{"name": "ARGS:cart_content[/\\\\d+/]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via cart_content in get_viariation_details AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52693-02": {"ajax_action": "shopping_cart_products", "conditions": [{"name": "ARGS:raw", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d|[\'\\"]\\\\s*(?:OR|AND)\\\\s+[\'\\"]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:SELECT|CONCAT)\\\\s*\\\\(.*FROM|INFORMATION_SCHEMA|LOAD_FILE\\\\s*\\\\()~i"}], "cve": "CVE-2026-52693", "description": "eCommerce Product Catalog <=3.5.5 unauthenticated SQL injection via raw parameter in shopping_cart_products AJAX handler", "mode": "block", "severity": 9.3, "slug": "ecommerce-product-catalog", "target": "plugin", "versions": "<=3.5.5"}, "RULE-CVE-2026-52694-01": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:invitation", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}, {"name": "REQUEST_URI", "type": "regex", "value": "~^(?!/wp-admin/)~i"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive data exposure via document and invitation parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-02": {"action": "init", "conditions": [{"name": "ARGS:document", "type": "exists"}, {"name": "ARGS:download", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 unauthenticated sensitive document download via document and download parameters", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52694-03": {"ajax_action": "esig_create_order_agreement", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52694", "description": "Signature Add-On for WooCommerce <=2.0 missing authorization on esig_create_order_agreement AJAX handler", "mode": "block", "severity": 7.5, "slug": "woocommerce-digital-signature", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-52697-01": {"ajax_action": "wppm_filter_autocomplete", "conditions": [{"name": "ARGS:project_search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_search in wppm_filter_autocomplete AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-02": {"ajax_action": "wppm_get_project_list", "conditions": [{"name": "ARGS:project_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via project_id in wppm_get_project_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-03": {"ajax_action": "wppm_get_task_list", "conditions": [{"name": "ARGS:task_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via task_id in wppm_get_task_list AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-04": {"ajax_action": "wppm_edit_task_status", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via id parameter in wppm_edit_task_status AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-05": {"ajax_action": "wppm_get_task_list_card_view", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via page_no in wppm_get_task_list_card_view AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52697-06": {"ajax_action": "wppm_drag_and_drop_card", "conditions": [{"name": "ARGS:proj_ids", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-52697", "description": "Taskbuilder <=5.0.7 authenticated SQL injection via proj_ids in wppm_drag_and_drop_card AJAX handler", "mode": "block", "severity": 8.5, "slug": "taskbuilder", "target": "plugin", "versions": "<=5.0.7"}, "RULE-CVE-2026-52702-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "seo-redirection.php"}, {"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|%3Cscript|%3[Ee]|<img[^>]+on[a-z]+=)~i"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 unauthenticated reflected XSS via redirect_from parameter on admin page", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52702-02": {"ajax_action": "customAddUpdate", "conditions": [{"name": "ARGS:redirect_from", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:\'|%27)\\\\s*(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52702", "description": "SEO Redirection <=9.17 authenticated SQL injection via redirect_from in customAddUpdate AJAX handler", "mode": "block", "severity": 7.1, "slug": "seo-redirection", "target": "plugin", "versions": "<=9.17"}, "RULE-CVE-2026-52703-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/download(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/download REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/packages/view-log(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via packages/view-log REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-52703-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/njt-fastdup/v1/template/directory-tree(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-52703", "description": "FastDup <=2.7.2 unauthenticated path traversal via template/directory-tree REST endpoint", "mode": "block", "severity": 9.6, "slug": "fastdup", "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5294-01": {"ajax_action": "geekybot_frontendajax", "conditions": [{"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5294", "description": "Geeky Bot <=1.2.2 unauthenticated arbitrary plugin installation via geekybot_frontendajax AJAX handler", "mode": "block", "severity": 9.8, "slug": "geeky-bot", "target": "plugin", "versions": "<=1.2.2"}, "RULE-CVE-2026-5324-01": {"ajax_action": "brizy_form_submit", "conditions": [{"name": "ARGS:data[fields][FileUpload]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5324", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5324", "description": "Brizy \\u2013 Page Builder <=2.8.11 unauthenticated stored XSS via form submission FileUpload field value", "mode": "block", "severity": 7.2, "slug": "brizy", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.8.11"}, "RULE-CVE-2026-5364-01": {"ajax_action": "cf7_file_uploads", "conditions": [{"name": "ARGS:type", "type": "regex", "value": "~(?:^|\\\\|)\\\\s*(?:ph(?:p[2-9s]?|tml?|ar)|s?html?|cgi|aspx?|jspx?|cfm|htaccess|user\\\\.ini)\\\\s*(?:\\\\||$)~i"}], "cve": "CVE-2026-5364", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5364", "description": "Drag and Drop File Upload for Contact Form 7 <=1.1.3 unauthenticated arbitrary PHP file upload via extension validation bypass in cf7_file_uploads AJAX handler", "mode": "block", "severity": 8.1, "slug": "drag-and-drop-file-upload-for-contact-form-7", "tags": ["arbitrary-file-upload", "remote-code-execution", "unauthenticated", "extension-bypass"], "target": "plugin", "versions": "<=1.1.3"}, "RULE-CVE-2026-5371-01": {"ajax_action": "monsterinsights_ads_get_token", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google OAuth access tokens via monsterinsights_ads_get_token AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "oauth-token-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-02": {"ajax_action": "monsterinsights_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized reset of Google Ads integration via monsterinsights_ads_reset_experience AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "privilege-escalation", "integration-reset"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-5371-03": {"ajax_action": "monsterinsights_ads_get_settings", "conditions": [{"type": "missing_capability", "value": "monsterinsights_save_settings"}], "cve": "CVE-2026-5371", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5371", "description": "MonsterInsights Google Analytics for WordPress <=10.1.2 Subscriber+ unauthorized access to Google Ads settings via monsterinsights_ads_get_settings AJAX handler", "mode": "block", "severity": 7.1, "slug": "google-analytics-for-wordpress", "tags": ["missing-authorization", "information-disclosure", "settings-exposure"], "target": "plugin", "versions": "<=10.1.2"}, "RULE-CVE-2026-54191-01": {"ajax_action": "pq_loadpod", "conditions": [{"name": "ARGS:pod", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on[a-z]+=|<svg[\\\\s/>]|<object[\\\\s/>]|<embed[\\\\s/>])~i"}], "cve": "CVE-2026-54191", "description": "Pods <=3.3.8 reflected XSS via pod parameter in pq_loadpod AJAX handler", "mode": "block", "severity": 7.1, "slug": "pods", "target": "plugin", "versions": "<=3.3.8"}, "RULE-CVE-2026-54196-01": {"ajax_action": "jet_form_builder_submit", "conditions": [{"name": "ARGS:_jf_form_id", "type": "exists"}, {"name": "ARGS:role", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-54196", "description": "JetFormBuilder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation via Update User Action", "mode": "block", "severity": 6.8, "slug": "jetformbuilder", "target": "plugin", "versions": "<=3.6.1"}, "RULE-CVE-2026-5425-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/trustindex-feed-instagram/v1/webhook(?:[/?]|$)~"}, {"name": "ARGS:data[feed_data]", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-5425", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5425", "description": "Social Photo Feed Widget <=1.7.9 unauthenticated stored XSS via REST webhook feed_data injection", "method": "POST", "mode": "block", "severity": 7.2, "slug": "social-photo-feed-widget", "tags": ["xss", "stored", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.7.9"}, "RULE-CVE-2026-5427-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages|templates|template-parts)(?:/[0-9]+)?(?:[/?]|$)~i"}, {"name": "ARGS:content", "type": "regex", "value": "~\\"kubio\\"[\\\\s\\\\S]{0,1000}?\\\\bhttps?://~i"}, {"name": "", "type": "missing_capability", "value": "upload_files"}], "cve": "CVE-2026-5427", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5427", "description": "Kubio AI Page Builder <=2.7.2 missing authorization on rest_pre_insert allows contributor-level arbitrary remote file import via kubio block attribute URL", "mode": "block", "severity": 5.3, "slug": "kubio", "tags": ["missing-authorization", "arbitrary-file-upload", "authenticated"], "target": "plugin", "versions": "<=2.7.2"}, "RULE-CVE-2026-5465-01": {"ajax_action": "wpamelia_api", "conditions": [{"name": "ARGS:call", "type": "regex", "value": "~users/providers/~i"}, {"name": "ARGS:externalId", "type": "exists"}, {"name": "ARGS:password", "type": "exists"}], "cve": "CVE-2026-5465", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5465", "description": "Amelia Booking <=2.1.3 IDOR account takeover via externalId in provider profile update (wpamelia_api)", "method": "POST", "mode": "block", "severity": 8.8, "slug": "ameliabooking", "tags": ["idor", "account-takeover", "insecure-direct-object-reference", "authenticated"], "target": "plugin", "versions": "<=2.1.3"}, "RULE-CVE-2026-5478-01": {"action": "init", "conditions": [{"name": "ARGS:everest_forms", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\\\\\/]){2,}(?:.*(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))?~i"}], "cve": "CVE-2026-5478", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5478", "description": "Everest Forms <=3.4.4 unauthenticated arbitrary file read and deletion via path traversal in old_files parameter", "method": "POST", "mode": "block", "severity": 8.1, "slug": "everest-forms", "tags": ["path-traversal", "local-file-inclusion", "arbitrary-file-deletion", "unauthenticated"], "target": "plugin", "versions": "<=3.4.4"}, "RULE-CVE-2026-54802-01": {"ajax_action": "process_campaign", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54802", "description": "Block unauthenticated access to process_campaign AJAX action (CWE-862 Missing Authorization)", "mode": "block", "severity": 7.5, "slug": "sms-alert", "target": "plugin", "versions": "<=3.9.3"}, "RULE-CVE-2026-54810-01": {"ajax_action": "build_payment_payload", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on build_payment_payload AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-02": {"ajax_action": "apple_pay_validate_merchant", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on apple_pay_validate_merchant AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-03": {"ajax_action": "validate_checkout_form", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on validate_checkout_form AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54810-04": {"ajax_action": "get_build_fields", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54810", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54810", "description": "Nexi XPay <=8.3.1 missing authorization on get_build_fields AJAX handler allows unauthenticated DoS", "mode": "block", "severity": 7.5, "slug": "cartasi-x-pay", "tags": ["missing-authorization", "broken-access-control", "unauthenticated"], "target": "plugin", "versions": "<=8.3.1"}, "RULE-CVE-2026-54813-01": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-02": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:login", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via login parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-03": {"ajax_action": "suredash_lost_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_lost_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54813-04": {"ajax_action": "suredash_reset_password", "conditions": [{"name": "ARGS:key", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|(?:SLEEP|BENCHMARK|WAITFOR)\\\\s*\\\\(|(?:\'|\\"|\\\\.\\\\.)\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54813", "description": "SureDash <=1.8.0 blind SQL injection via key parameter in suredash_reset_password AJAX handler", "mode": "block", "severity": 8.5, "slug": "suredash", "target": "plugin", "versions": "<=1.8.0"}, "RULE-CVE-2026-54814-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"name": "ARGS:template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 unauthenticated local file inclusion via template parameter in mvl_motors_starter_template AJAX handler", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["local-file-inclusion", "path-traversal", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54814-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54814", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54814", "description": "Motors <=1.4.109 missing authorization on mvl_motors_starter_demo_install allows unauthenticated file write/delete", "mode": "block", "severity": 8.1, "slug": "motors-car-dealership-classified-listings", "tags": ["missing-authorization", "arbitrary-file-write", "unauthenticated"], "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54818-01": {"ajax_action": "slimstat_load_report", "conditions": [{"name": "ARGS:pageview_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|\\\\b(?:AND|OR)\\\\s+(?:\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\()|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54818", "description": "Slimstat Analytics <=5.4.11 authenticated (Subscriber+) blind SQL injection via pageview_id in slimstat_load_report AJAX handler", "mode": "block", "severity": 8.5, "slug": "wp-slimstat", "target": "plugin", "versions": "<=5.4.11"}, "RULE-CVE-2026-54819-01": {"ajax_action": "lsd_accordion_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in accordion sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-02": {"ajax_action": "lsd_grid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in grid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-03": {"ajax_action": "lsd_list_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in list sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-04": {"ajax_action": "lsd_gallery_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in gallery sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-05": {"ajax_action": "lsd_halfmap_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in halfmap sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-06": {"ajax_action": "lsd_masonry_load_more", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in masonry load_more AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-07": {"ajax_action": "lsd_mosaic_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in mosaic sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-08": {"ajax_action": "lsd_listgrid_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in listgrid sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-09": {"ajax_action": "lsd_side_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in side sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-10": {"ajax_action": "lsd_table_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in table sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54819-11": {"ajax_action": "lsd_timeline_sort", "conditions": [{"name": "ARGS:sort", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\\"\']+\\\\s*=\\\\s*[\\\\d\\"\']|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:ELT|FIELD|IF|CASE\\\\s+WHEN)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54819", "description": "Listdom <=5.4.0 unauthenticated blind SQL injection via sort parameter in timeline sort AJAX handler", "mode": "block", "severity": 9.3, "slug": "listdom", "target": "plugin", "versions": "<=5.4.0"}, "RULE-CVE-2026-54821-01": {"ajax_action": "vlp_get_template", "conditions": [{"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54821", "description": "Visual Link Preview <=2.3.1 subscriber+ sensitive data exposure via vlp_get_template AJAX handler missing capability check", "mode": "block", "severity": 7.4, "slug": "visual-link-preview", "target": "plugin", "versions": "<=2.3.1"}, "RULE-CVE-2026-54822-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/salesmanago/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+\\\\b|\\\\bAND\\\\s+(?:SLEEP|BENCHMARK)\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|/\\\\*[!+]|(?:--|#)\\\\s)~i"}, {"name": "", "type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54822", "description": "SALESmanago & Leadoo <=3.11.2 subscriber+ SQL injection via REST API endpoint", "mode": "block", "severity": 8.5, "slug": "salesmanago", "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-54825-01": {"ajax_action": "wdtable_update_cache", "conditions": [{"name": "ARGS:table_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\(|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-54825", "description": "wpDataTables <=7.4 unauthenticated SQL injection via table_id in wdtable_update_cache AJAX handler", "mode": "block", "severity": 9.3, "slug": "wpdatatables", "target": "plugin", "versions": "<=7.4"}, "RULE-CVE-2026-54828-01": {"ajax_action": "mvl_motors_starter_template", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_template AJAX handler (LFI via include sink)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54828-02": {"ajax_action": "mvl_motors_starter_demo_install", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54828", "description": "Block unauthenticated access to mvl_motors_starter_demo_install AJAX handler (file_put_contents/unlink sinks)", "mode": "block", "severity": 7.5, "slug": "motors-car-dealership-classified-listings", "target": "plugin", "versions": "<=1.4.109"}, "RULE-CVE-2026-54831-01": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_order in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-02": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:package_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via package_id in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54831-03": {"ajax_action": "geodir_get_sort_options", "conditions": [{"name": "ARGS:sort_by", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EX|EXTRAC)TRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|(?:IF|CASE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-54831", "description": "GeoDirectory <=2.8.162 unauthenticated SQL injection via sort_by in geodir_get_sort_options AJAX handler", "mode": "block", "severity": 9.3, "slug": "geodirectory", "target": "plugin", "versions": "<=2.8.162"}, "RULE-CVE-2026-54832-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-essence/v1/gutenverse-essence-proxy~"}, {"type": "missing_capability", "value": "edit_theme_options"}], "cve": "CVE-2026-54832", "description": "Block unauthenticated access to gutenverse-essence REST proxy route (missing authorization \\u2013 permission_callback was __return_true in <=2.5.0)", "mode": "block", "severity": 7.5, "slug": "gutenverse-companion", "target": "plugin", "versions": "<=2.5.0"}, "RULE-CVE-2026-54840-01": {"ajax_action": "newsletters_forms_createform", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_createform AJAX handler allows subscriber+ form creation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-02": {"ajax_action": "newsletters_forms_addfield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_addfield AJAX handler allows subscriber+ form field addition", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-03": {"ajax_action": "newsletters_forms_deletefield", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_forms_deletefield AJAX handler allows subscriber+ form field deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-04": {"ajax_action": "newsletters_admin_mode", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_admin_mode AJAX handler allows subscriber+ admin mode toggle", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-05": {"ajax_action": "newsletters_change_themefolder", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_change_themefolder AJAX handler allows subscriber+ theme folder change", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-06": {"ajax_action": "newsletters_delete_option", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_delete_option AJAX handler allows subscriber+ option deletion", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54840-07": {"ajax_action": "newsletters_pause_queue", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54840", "description": "Newsletters <=4.13 missing authorization on newsletters_pause_queue AJAX handler allows subscriber+ queue manipulation", "mode": "block", "severity": 7.3, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-54841-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/apbd-vtpos/v1/(?:current-user|get-logged-user|cashier-details|cash-drawer-info|cash-drawer-list|all-outlet-list|all-categories|all-taxes|heart-bit|list|details|end-of-day-data|categories|countries|attributes|getStock|close-cash-drawer|logout|email)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54841", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-54841", "description": "VitePOS Lite <=3.4.2 unauthenticated sensitive data exposure via REST API endpoints missing permission callbacks", "mode": "block", "severity": 7.5, "slug": "vitepos-lite", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=3.4.2"}, "RULE-CVE-2026-54842-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/royal-mcp/v1/messages(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-54842", "description": "Royal MCP <=1.4.25 missing authorization on royal-mcp/v1/messages REST endpoint allows subscriber+ access to privileged integration handlers", "mode": "block", "severity": 8.1, "slug": "royal-mcp", "target": "plugin", "versions": "<=1.4.25"}, "RULE-CVE-2026-54844-01": {"ajax_action": "checkview_get_status", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview_get_status AJAX action (CWE-862: Missing Authorization). Patch removes both wp_ajax_nopriv_checkview_get_status and wp_ajax_checkview_get_status hooks entirely.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54844-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/checkview/v1/checkview-status(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-54844", "description": "Block unauthenticated/unauthorized access to checkview/v1/checkview-status REST route (CWE-862: Missing Authorization). Patch adds permission_callback with current_user_can(\'manage_options\') and nonce verification.", "mode": "block", "severity": 7.5, "slug": "checkview", "target": "plugin", "versions": "<=2.1.0"}, "RULE-CVE-2026-54849-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/premmerce/wishlist/~i"}, {"name": "ARGS:wishlist_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via wishlist_id in REST API wishlist endpoints", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-54849-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]wc-ajax=premmerce_wishlist_popup~"}, {"name": "ARGS:productId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\\\\bOR\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bAND\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-54849", "description": "Premmerce Wishlist for WooCommerce <=1.1.11 unauthenticated SQL injection via productId in WC AJAX wishlist popup handler", "mode": "block", "severity": 9.3, "slug": "premmerce-woocommerce-wishlist", "target": "plugin", "versions": "<=1.1.11"}, "RULE-CVE-2026-5488-01": {"ajax_action": "exactmetrics_ads_get_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_get_token allows subscriber+ role access to Google Ads OAuth token", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5488-02": {"ajax_action": "exactmetrics_ads_reset_experience", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5488", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5488", "description": "ExactMetrics <=9.1.2 missing authorization on exactmetrics_ads_reset_experience allows subscriber+ role to reset Google Ads experience", "mode": "block", "severity": 5.3, "slug": "google-analytics-dashboard-for-wp", "tags": ["missing-authorization", "authenticated", "broken-access-control"], "target": "plugin", "versions": "<=9.1.2"}, "RULE-CVE-2026-5502-01": {"ajax_action": "tutor_update_course_content_order", "conditions": [{"name": "ARGS:data", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-5502", "mode": "block", "severity": 5.3, "slug": "tutor", "target": "plugin", "versions": "<=3.9.7"}, "RULE-CVE-2026-56006-01": {"ajax_action": "h5p_embed", "conditions": [{"name": "ARGS:id", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56006", "description": "H5P <=1.17.6 unauthenticated reflected XSS via id parameter in h5p_embed AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.6"}, "RULE-CVE-2026-56011-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mapp/v1/(?:maps|maps/(?:clone|import))(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/][^>]*on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=|<iframe[\\\\s/])~i"}], "cve": "CVE-2026-56011", "description": "MapPress Maps for WordPress <=2.97.3 unauthenticated stored XSS via REST API map creation/update endpoints", "mode": "block", "severity": 7.1, "slug": "mappress-google-maps-for-wordpress", "target": "plugin", "versions": "<=2.97.3"}, "RULE-CVE-2026-56012-01": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[orderby]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\b|\\\\bSELECT\\\\s+.*\\\\bFROM\\\\b|/\\\\*[^*]*\\\\*/|information_schema)~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[orderby] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56012-02": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[s]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\'\\\\s*(?:--|#|/\\\\*))~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[s] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56012-03": {"ajax_action": "query-attachments", "conditions": [{"name": "ARGS:query[order]", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|\\\\bCASE\\\\s+WHEN\\\\b|/\\\\*[^*]*\\\\*/|\'\\\\s*(?:--|#))~i"}], "cve": "CVE-2026-56012", "description": "Media Library Assistant <=3.35 blind SQL injection via query[order] in query-attachments AJAX handler", "mode": "block", "severity": 8.5, "slug": "media-library-assistant", "target": "plugin", "versions": "<=3.35"}, "RULE-CVE-2026-56014-01": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_params", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_params parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-02": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:slider_id", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via slider_id parameter on admin preview page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-03": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via orderby parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-04": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via order parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-05": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:post_mime_type", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via post_mime_type parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56014-06": {"action": "init", "conditions": [{"name": "ARGS:page", "type": "contains", "value": "masterslider"}, {"name": "ARGS:detached", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-56014", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56014", "description": "Master Slider <=3.11.2 reflected XSS via detached parameter on admin list table page", "mode": "block", "severity": 7.1, "slug": "master-slider", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<=3.11.2"}, "RULE-CVE-2026-56028-01": {"ajax_action": "eel_register", "conditions": [{"name": "ARGS:role", "type": "regex", "value": "~^(?:administrator|editor|author)$~i"}], "cve": "CVE-2026-56028", "description": "Easy Elements for Elementor <=1.4.9 unauthenticated privilege escalation via role parameter in eel_register AJAX handler", "mode": "block", "severity": 9.8, "slug": "easy-elements", "target": "plugin", "versions": "<=1.4.9"}, "RULE-CVE-2026-56030-01": {"ajax_action": "pt_ajax_check_item_limits", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56030", "description": "Paytium <=5.0.2 unauthenticated privilege escalation via pt_ajax_check_item_limits", "mode": "block", "severity": 9.8, "slug": "paytium", "target": "plugin", "versions": "<=5.0.2"}, "RULE-CVE-2026-56036-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:order_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via order_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:refund_id", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via refund_id parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-03": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:payment_action", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via payment_action parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56036-04": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^|/)wp-admin/admin-ajax\\\\.php~"}, {"name": "ARGS:_pafw_uid", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s|\'\\\\s*(?:OR|AND)\\\\s)~i"}], "cve": "CVE-2026-56036", "description": "PGAll for WooCommerce <=5.5.6 unauthenticated SQL injection via _pafw_uid parameter", "mode": "block", "severity": 9.3, "slug": "pgall-for-woocommerce", "target": "plugin", "versions": "<=5.5.6"}, "RULE-CVE-2026-56040-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gutenverse-form/~"}, {"name": "ARGS", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<svg[\\\\s/].*?on\\\\w+\\\\s*=|<img[\\\\s/][^>]*on\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-56040", "description": "Gutenverse Form <=2.4.7 unauthenticated stored XSS via form submission REST API", "mode": "block", "severity": 7.1, "slug": "gutenverse-form", "target": "plugin", "versions": "<=2.4.7"}, "RULE-CVE-2026-56042-01": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_mark_exported", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_mark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56042-02": {"action": "admin_init", "conditions": [{"name": "ARGS:woe_bulk_unmark_exported", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56042", "description": "Advanced Order Export For WooCommerce <=4.0.9 reflected XSS via woe_bulk_unmark_exported parameter in admin notices", "mode": "block", "severity": 7.1, "slug": "woo-order-export-lite", "target": "plugin", "versions": "<=4.0.9"}, "RULE-CVE-2026-56043-01": {"ajax_action": "cr_submit_review", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_submit_review AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56043-02": {"ajax_action": "cr_local_forms_submit", "conditions": [{"name": "ARGS:comment", "type": "regex", "value": "~<(?:script|img|svg|iframe|object|embed|math|details|marquee|video|audio|body|form|input|button|select|textarea|style|link|base|meta|applet|frame|frameset|isindex|layer|bgsound|table)[\\\\s/>]|\\\\bon(?:error|load|click|mouseover|focus|blur|submit|change|input|keydown|keyup|keypress|mouseout|mouseenter|mouseleave|dblclick|contextmenu|wheel|pointerover|animationend|beforeprint)\\\\s*=~i"}], "cve": "CVE-2026-56043", "description": "Blocks unauthenticated stored XSS via cr_local_forms_submit AJAX action by detecting HTML/script injection in the comment parameter", "mode": "block", "severity": 7.1, "slug": "customer-reviews-woocommerce", "target": "plugin", "versions": "<5.111.0"}, "RULE-CVE-2026-56053-01": {"ajax_action": "eventprime_api", "conditions": [{"name": "ARGS", "type": "regex", "value": "~[OCa]:[0-9]+:(?:\\\\\\"|\\\\{)~"}], "cve": "CVE-2026-56053", "description": "EventPrime <=4.3.4.1 subscriber+ PHP Object Injection via eventprime_api AJAX handler", "mode": "block", "severity": 8.8, "slug": "eventprime-event-calendar-management", "target": "plugin", "versions": "<=4.3.4.1"}, "RULE-CVE-2026-56054-01": {"ajax_action": "jsticket_ajax", "conditions": [{"name": "ARGS:jsst_dir", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env(?:\\\\b|[._])|error_log|debug\\\\.log))~i"}], "cve": "CVE-2026-56054", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56054", "description": "JS Help Desk <=3.1.1 subscriber+ arbitrary file/directory deletion via jsticket_ajax AJAX handler (path traversal in jsst_dir)", "mode": "block", "severity": 7.7, "slug": "js-support-ticket", "tags": ["path-traversal", "arbitrary-file-deletion", "missing-authorization"], "target": "plugin", "versions": "<=3.1.1"}, "RULE-CVE-2026-56060-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wcdn/v1/(?:settings|dashboard|templates|fonts)(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_woocommerce"}], "cve": "CVE-2026-56060", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56060", "description": "Print Invoice & Delivery Notes for WooCommerce <=7.1.1 unauthenticated sensitive data exposure via REST API endpoints (wcdn/v1/settings, dashboard, templates, fonts)", "mode": "block", "severity": 7.5, "slug": "woocommerce-delivery-notes", "tags": ["missing-authorization", "information-disclosure", "rest-api", "unauthenticated"], "target": "plugin", "versions": "<=7.1.1"}, "RULE-CVE-2026-56063-01": {"ajax_action": "mcbSubmit_Form_Data", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 unauthenticated broken access control on mcbSubmit_Form_Data AJAX handler", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-02": {"ajax_action": "mcb_get_access_token", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcb_get_access_token allows subscriber+ OAuth token retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-03": {"ajax_action": "mcbAudienceList", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbAudienceList allows subscriber+ audience list retrieval", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56063-04": {"ajax_action": "mcbSubmit_Form_AudienceId", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56063", "description": "Block for Mailchimp <=1.1.15 missing authorization on mcbSubmit_Form_AudienceId allows subscriber+ audience ID modification", "mode": "block", "severity": 8.3, "slug": "block-for-mailchimp", "target": "plugin", "versions": "<=1.1.15"}, "RULE-CVE-2026-56064-01": {"ajax_action": "tf_booking_calendar_filter", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_calendar_filter AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-02": {"ajax_action": "tf_booking_details_popup", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_booking_details_popup AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-03": {"ajax_action": "tf_order_bulk_action_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_bulk_action_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-04": {"ajax_action": "tf_order_status_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_order_status_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-05": {"ajax_action": "tf_visitor_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_visitor_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56064-06": {"ajax_action": "tf_checkinout_details_edit", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|/\\\\*[!+]|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML)\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-56064", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-56064", "description": "Tourfic <=2.22.5 authenticated SQL injection via tf_checkinout_details_edit AJAX handler", "mode": "block", "severity": 8.5, "slug": "tourfic", "tags": ["sql-injection", "authenticated", "missing-authorization"], "target": "plugin", "versions": "<=2.22.5"}, "RULE-CVE-2026-56070-01": {"ajax_action": "thaps_ajax_get_search_value", "conditions": [{"name": "ARGS:search", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\(|LOAD_FILE\\\\s*\\\\(|INTO\\\\s+(?:OUT|DUMP)FILE\\\\s)~i"}], "cve": "CVE-2026-56070", "description": "Unauthenticated SQL Injection via thaps_ajax_get_search_value AJAX handler in TH Advance Product Search <= 1.4.4", "mode": "block", "severity": 9.3, "slug": "th-advance-product-search", "target": "plugin", "versions": "<=1.4.4"}, "RULE-CVE-2026-56071-01": {"ajax_action": "forminator_submit_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via form submission field values", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-56071-02": {"ajax_action": "forminator_submit_preview_form_custom-forms", "conditions": [{"name": "ARGS", "type": "regex", "value": "~(?:<\\\\s*script[\\\\s/>]|\\\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\\\s*=|javascript\\\\s*:|data\\\\s*:(?!\\\\s*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-56071", "description": "Forminator <=1.53.1 unauthenticated stored XSS via preview form submission", "mode": "block", "severity": 7.1, "slug": "forminator", "target": "plugin", "versions": "<=1.53.1"}, "RULE-CVE-2026-5710-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/contact-form-7/v1/contact-forms/[0-9]+/feedback(?:[/?]|$)~"}, {"name": "ARGS:mfile", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/])~"}], "cve": "CVE-2026-5710", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5710", "description": "Drag and Drop Multiple File Upload for CF7 <=1.3.9.6 unauthenticated path traversal leading to arbitrary file read via mfile[] parameter on CF7 REST feedback endpoint", "method": "POST", "mode": "block", "severity": 7.5, "slug": "drag-and-drop-multiple-file-upload-contact-form-7", "tags": ["path-traversal", "arbitrary-file-read", "unauthenticated", "rest-api"], "target": "plugin", "versions": "<=1.3.9.6"}, "RULE-CVE-2026-5714-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "enable-media-replace/enable-media-replace.php"}, {"name": "ARGS:location_dir", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<img[\\\\s/][^>]*on[a-z]+=|<svg[\\\\s/>]|<embed[\\\\s/>]|<object[\\\\s/>])~i"}], "cve": "CVE-2026-5714", "description": "Enable Media Replace <=4.1.8 authenticated (Author+) stored XSS via location_dir parameter", "mode": "block", "severity": 6.4, "slug": "enable-media-replace", "target": "plugin", "versions": "<=4.1.8"}, "RULE-CVE-2026-5722-01": {"ajax_action": "wlfmc_waitlist_signup", "conditions": [{"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist token reuse with email change", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-5722-02": {"action": "init", "conditions": [{"name": "ARGS:waitlist_verify", "type": "equals", "value": "1"}, {"name": "ARGS:token", "type": "exists"}, {"name": "ARGS:email", "type": "exists"}], "cve": "CVE-2026-5722", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5722", "description": "Smart Wishlist for More Convert <=1.9.14 authentication bypass via waitlist verification link token reuse (blocks verification endpoint on vulnerable version; legitimate verification clicks also blocked until patched to 1.9.15)", "mode": "block", "severity": 9.8, "slug": "smart-wishlist-for-more-convert", "tags": ["authentication-bypass", "token-reuse", "verification-link", "cwe-287"], "target": "plugin", "versions": "<=1.9.14"}, "RULE-CVE-2026-57317-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~simply-schedule-appointments/booking-app-new/iframe-inner\\\\.php~"}, {"name": "ARGS:token", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|data\\\\s*:(?![\\\\s])(?!(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-57317", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57317", "description": "Simply Schedule Appointments <=1.6.12.2 unauthenticated reflected XSS via token parameter in booking iframe", "mode": "block", "severity": 7.1, "slug": "simply-schedule-appointments", "tags": ["xss", "unauthenticated", "reflected"], "target": "plugin", "versions": "<=1.6.12.2"}, "RULE-CVE-2026-57319-01": {"ajax_action": "woocs_convert_currency", "conditions": [{"name": "ARGS:precision", "type": "exists"}, {"name": "ARGS:precision", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'precision\' parameter in the woocs_convert_currency AJAX handler (wp_die sink at woocs.php:3728). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57319-02": {"ajax_action": "woocs_rates_current_currency", "conditions": [{"name": "ARGS:exclude", "type": "exists"}, {"name": "ARGS:exclude", "type": "regex", "value": "~[<>\\"\'`]|javascript\\\\s*:|on\\\\w+\\\\s*=~i"}], "cve": "CVE-2026-57319", "description": "Blocks unauthenticated Reflected XSS via the \'exclude\' parameter in the woocs_rates_current_currency AJAX handler (wp_die sink at woocs.php:3754). The parameter is passed unsanitized to wp_die output in versions <=1.4.8.", "mode": "block", "severity": 7.1, "slug": "woocommerce-currency-switcher", "target": "plugin", "versions": "<=1.4.8"}, "RULE-CVE-2026-57321-01": {"ajax_action": "h5p_files", "conditions": [{"name": "ARGS:filePath", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log))~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57321", "description": "H5P <=1.17.7 contributor+ arbitrary file deletion via path traversal in h5p_files AJAX handler", "mode": "block", "severity": 7.1, "slug": "h5p", "target": "plugin", "versions": "<=1.17.7"}, "RULE-CVE-2026-57631-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popup_category", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popup_category parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:popupbox", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via popupbox parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57631-03": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "ays-pb"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}], "cve": "CVE-2026-57631", "description": "Popup Box <=6.0.1 authenticated SQL injection via orderby parameter", "mode": "block", "severity": 7.6, "slug": "ays-popup-box", "target": "plugin", "versions": "<=6.0.1"}, "RULE-CVE-2026-57636-01": {"ajax_action": "wpforo_ai_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-57636", "description": "wpForo Forum <=3.0.9 contributor+ SQL injection via wpforo_ai_action AJAX handler", "mode": "block", "severity": 8.5, "slug": "wpforo", "target": "plugin", "versions": "<=3.0.9"}, "RULE-CVE-2026-57644-01": {"ajax_action": "mprm_process_checkout", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57644-02": {"ajax_action": "mprm_process_checkout_login", "conditions": [{"name": "ARGS:mprm-purchase-var", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[!+]|\\\\b(?:OR|AND)\\\\s+[\\\\d\'\\"]+\\\\s*=\\\\s*[\\\\d\'\\"]+|(?:SLEEP|BENCHMARK|EXTRACTVALUE|UPDATEXML|LOAD_FILE)\\\\s*\\\\()~i"}], "cve": "CVE-2026-57644", "description": "Restaurant Menu by MotoPress <=2.4.10 SQL injection via mprm-purchase-var in mprm_process_checkout_login AJAX handler", "mode": "block", "severity": 8.5, "slug": "mp-restaurant-menu", "target": "plugin", "versions": "<=2.4.10"}, "RULE-CVE-2026-57645-01": {"ajax_action": "newsletters_executemultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_executemultiple AJAX handler allows subscriber+ batch operations", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57645-02": {"ajax_action": "newsletters_exportmultiple", "conditions": [{"type": "missing_capability", "value": "newsletters_subscribers"}], "cve": "CVE-2026-57645", "description": "Newsletters <=4.13 missing authorization on newsletters_exportmultiple AJAX handler allows subscriber+ data export", "mode": "block", "severity": 8.1, "slug": "newsletters-lite", "target": "plugin", "versions": "<=4.13"}, "RULE-CVE-2026-57663-01": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via orderby parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57663-02": {"action": "admin_init", "conditions": [{"name": "ARGS:page", "type": "equals", "value": "zrdn-recipes"}, {"name": "ARGS:order", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|\\\\bSLEEP\\\\s*\\\\(|\\\\bBENCHMARK\\\\s*\\\\(|\\\\bIF\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\b|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[^*]*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-57663", "description": "Zip Recipes <=8.2.7 authenticated (Contributor+) SQL injection via order parameter in admin Recipe_Table", "mode": "block", "severity": 8.5, "slug": "zip-recipes", "target": "plugin", "versions": "<=8.2.7"}, "RULE-CVE-2026-57724-01": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"name": "ARGS:endpoint", "type": "equals", "value": "update-form-cell"}, {"name": "ARGS:data", "type": "regex", "value": "~(?:O|C):[0-9]+:\\"[^\\"]+\\":[0-9]+:\\\\{~"}], "cve": "CVE-2026-57724", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-57724", "description": "Kirki <=6.0.12 authenticated PHP object injection via update-form-cell request writing to data field later unserialized without allowed_classes restriction", "mode": "block", "severity": 9.8, "slug": "kirki", "tags": ["object-injection", "deserialization", "authenticated"], "target": "plugin", "versions": "<=6.0.12"}, "RULE-CVE-2026-57728-01": {"action": "wp_footer", "conditions": [{"name": "ARGS:block", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-57728", "description": "Flatsome theme <=3.20.5 unauthenticated reflected XSS via block parameter in ux_block_frontend()", "mode": "block", "severity": 7.1, "slug": "flatsome", "target": "theme", "versions": "<=3.20.5"}, "RULE-CVE-2026-5809-01": {"ajax_action": "wpforo_ai_wp_get_post_types", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_get_post_types AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-02": {"ajax_action": "wpforo_ai_wp_get_taxonomies", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomies AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-03": {"ajax_action": "wpforo_ai_wp_get_taxonomy_terms", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_get_taxonomy_terms AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-04": {"ajax_action": "wpforo_ai_wp_index_by_taxonomy", "conditions": [{"name": "ARGS:taxonomy", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via taxonomy param in wpforo_ai_wp_index_by_taxonomy AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5809-05": {"ajax_action": "wpforo_ai_wp_index_custom", "conditions": [{"name": "ARGS:post_type", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log)|(?:php|data|expect|phar)://)~i"}], "cve": "CVE-2026-5809", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5809", "description": "wpForo <=3.0.2 authenticated LFI via post_type param in wpforo_ai_wp_index_custom AJAX handler", "mode": "block", "severity": 7.1, "slug": "wpforo", "tags": ["local-file-inclusion", "path-traversal", "authenticated", "cwe-73"], "target": "plugin", "versions": "<=3.0.2"}, "RULE-CVE-2026-5957-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/emailkit/v1/create[_-]template(?:/|\\\\?|&|$)~"}, {"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 authenticated arbitrary file read via REST create_template emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-03": {"ajax_action": "emailkit_admin_action", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_admin_action AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-5957-04": {"ajax_action": "emailkit_filter_save_as_template", "conditions": [{"name": "ARGS:emailkit-editor-template", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[/\\\\\\\\]){2,}|/(?:etc|proc|root|var)/|wp-config\\\\.php|\\\\.htaccess|\\\\.htpasswd|\\\\.env|debug\\\\.log|error_log|id_rsa|id_dsa|/home/[^/]+/\\\\.|php://(?:filter|input)|file://|expect://|data://)~i"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-5957", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-5957", "description": "EmailKit <=1.6.5 path traversal defense-in-depth on emailkit_filter_save_as_template AJAX emailkit-editor-template parameter", "mode": "block", "severity": 6.5, "slug": "emailkit", "tags": ["local-file-inclusion", "path-traversal", "authenticated"], "target": "plugin", "versions": "<=1.6.5"}, "RULE-CVE-2026-60137-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-03": {"action": "init", "conditions": [{"name": "ARGS:/^author_exclude$|^author__not_in$/", "type": "detectSQLi"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress Core SQL injection via author__not_in / REST author_exclude in WP_Query (wp2shell SQLi primitive) - standalone/plugin-mediated parameter and WP 6.8.x coverage not addressed by the batch-scoped rules -01/-02.", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "unauthenticated", "wp-core", "wp2shell", "defense-in-depth"], "target": "core", "versions": ">=6.8.0 <6.8.6 || >=6.9.0 <6.9.5 || >=7.0.0 <7.0.2"}, "RULE-CVE-2026-60137-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-60137-05": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"name": "ARGS:/^requests$/", "type": "regex", "value": "~(?:[?&](?:author_exclude|author__not_in)=[^&#]{0,256}?|(?:^|[^A-Za-z0-9_?&=])-?\\\\d+\\\\)?[\\\\s+]{0,8})(?:\\\\b(?:or|and)\\\\b[\\\\s+]*(?:\\\\([\\\\s+]*)*(?:(?:sleep|benchmark|extractvalue|updatexml|gtid_subset|ascii|substring|ord|if)[\\\\s+]*\\\\(|(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\')[\\\\s+]*(?:=|!=|<>|<=>|like)[\\\\s+]*(?:-?\\\\d+|0x[0-9a-f]+|\'[^\']{0,64}\'))|\\\\bunion[\\\\s+/\\\\*]+(?:all[\\\\s+/\\\\*]+)?select\\\\b|;[\\\\s+]*(?:select|insert|update|delete|drop)\\\\b|--[\\\\s+]|/\\\\*|#)~i"}], "cve": "CVE-2026-60137", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "description": "WordPress core facilitated SQL injection through nested REST batch author exclusion path; covers URL and parsed rest_route carriers", "mode": "block", "severity": 9.1, "tags": ["sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6203-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-login\\\\.php~"}, {"name": "ARGS:action", "type": "equals", "value": "logout"}, {"name": "ARGS:redirect_to_on_logout", "type": "regex", "value": "~^\\\\s*(?:(?:https?:)?//|[a-zA-Z][a-zA-Z0-9+.-]*:)~i"}], "cve": "CVE-2026-6203", "description": "User Registration <=5.1.4 unauthenticated open redirect via redirect_to_on_logout parameter on wp-login.php logout", "method": "GET", "mode": "block", "severity": 6.1, "slug": "user-registration", "target": "plugin", "versions": "<=5.1.4"}, "RULE-CVE-2026-6227-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/backwpup/v1/getblock(?:[/?&]|$)~"}, {"name": "ARGS:block_name", "type": "regex", "value": "~(?:(?:(?:\\\\.\\\\.|%2e%2e)[\\\\\\\\/]|(?:\\\\.\\\\.|%2e%2e)(?:%2f|%5c)){2,}|(?:\\\\.{4,}[\\\\\\\\/]{1,}){2,}|%252e%252e(?:%252f|%255c|%2f|%5c|/|\\\\\\\\))~i"}], "cve": "CVE-2026-6227", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6227", "description": "BackWPup <=5.6.6 authenticated local file inclusion via block_name parameter in /backwpup/v1/getblock REST endpoint", "mode": "block", "severity": 7.2, "slug": "backwpup", "tags": ["local-file-inclusion", "path-traversal", "rest-api", "authenticated"], "target": "plugin", "versions": "<=5.6.6"}, "RULE-CVE-2026-6229-01": {"action": "init", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via Data Table widget CSV URL parameter", "method": "POST", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6229-02": {"ajax_action": "wpr_data_fetch", "conditions": [{"name": "ARGS:csv_url", "type": "regex", "value": "~(?:^(?:https?://)?(?:(?:127\\\\.)|(?:10\\\\.)|(?:172\\\\.(?:1[6-9]|2[0-9]|3[01])\\\\.)|(?:192\\\\.168\\\\.)|(?:169\\\\.254\\\\.)|(?:0\\\\.)|localhost|\\\\[::1?\\\\]|0x[0-9a-f]|0[0-7])|(?:metadata\\\\.google|169\\\\.254\\\\.169\\\\.254|metadata\\\\.aws)|^(?:file|gopher|dict|ftp|ldap|tftp|php|data|expect|phar)://)~i"}], "cve": "CVE-2026-6229", "description": "Royal Elementor Addons <=1.7.1057 authenticated SSRF via url parameter in Data Table CSV fetch", "mode": "block", "severity": 7.2, "slug": "royal-elementor-addons", "target": "plugin", "versions": "<=1.7.1057"}, "RULE-CVE-2026-6235-01": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apikey", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via manage_admin_requests", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6235-02": {"action": "admin_init", "conditions": [{"name": "ARGS:sm_apisecret", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6235", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6235", "description": "Sendmachine for WordPress <=1.0.20 unauthenticated SMTP configuration overwrite via sm_apisecret", "method": "POST", "mode": "block", "severity": 9.8, "slug": "sendmachine", "tags": ["missing-authorization", "unauthenticated", "configuration-overwrite"], "target": "plugin", "versions": "<=1.0.20"}, "RULE-CVE-2026-6248-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/admin-post\\\\.php~"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (admin-post.php)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6248-02": {"action": "init", "conditions": [{"name": "ARGS:wpforo", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|[\\\\\\\\/]etc[\\\\\\\\/]passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)~i"}], "cve": "CVE-2026-6248", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6248", "description": "wpForo Forum <=3.0.5 authenticated arbitrary file deletion via path traversal in file-type custom profile field (front-end profile update)", "method": "POST", "mode": "block", "severity": 8.1, "slug": "wpforo", "tags": ["path-traversal", "arbitrary-file-deletion", "authenticated"], "target": "plugin", "versions": "<=3.0.5"}, "RULE-CVE-2026-6275-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/profile\\\\.php~"}, {"name": "ARGS:nickname", "type": "regex", "value": "~(?:</script|<script[\\\\s/>]|on(?:error|load|click|mouseover|focus|input|blur)\\\\s*=|javascript\\\\s*:|\\"\\\\s*;)~i"}], "cve": "CVE-2026-6275", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6275", "description": "StatCounter <=2.1.1 Author+ stored XSS via nickname field echoed unescaped into JavaScript context by statcounter_addToTags()", "method": "POST", "mode": "block", "severity": 6.4, "slug": "official-statcounter-plugin-for-wordpress", "tags": ["xss", "stored", "authenticated"], "target": "plugin", "versions": "<=2.1.1"}, "RULE-CVE-2026-63030-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/batch/v1[\\\\\\\\/]*(?:[?&]|$)~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-63030-03": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=6.9.0 <6.9.5"}, "RULE-CVE-2026-63030-04": {"action": "rest_api_init", "conditions": [{"name": "ARGS:rest_route", "type": "regex", "value": "~^/batch/v1[\\\\\\\\/]*$~i"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-63030", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "description": "WordPress core REST batch route confusion chained with SQL injection; emergency anonymous mitigation across URL and parsed rest_route carriers", "mode": "block", "severity": 7.5, "tags": ["remote-code-execution", "sql-injection", "rest-api", "unauthenticated", "waf-bypass"], "target": "core", "versions": ">=7.0.0 <7.0.2"}, "RULE-CVE-2026-6320-01": {"ajax_action": "salon", "conditions": [{"name": "ARGS:file", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|(?:wp-config\\\\.php|/etc/passwd|\\\\.htaccess|\\\\.env|debug\\\\.log|error_log))~i"}], "cve": "CVE-2026-6320", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6320", "description": "Salon Booking System <=10.30.25 unauthenticated arbitrary file read via booking attachment file field path traversal", "mode": "block", "severity": 7.5, "slug": "salon-booking-system", "tags": ["arbitrary-file-read", "path-traversal", "unauthenticated", "file-inclusion"], "target": "plugin", "versions": "<=10.30.25"}, "RULE-CVE-2026-6372-01": {"action": "init", "conditions": [{"name": "ARGS:wc-api", "type": "regex", "value": "~^WC_Gateway_Plisio$~i"}, {"name": "ARGS:status", "type": "regex", "value": "~^(?:completed|mismatch|expired|cancelled)$~i"}], "cve": "CVE-2026-6372", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6372", "description": "Accept Cryptocurrencies with Plisio <=2.0.5 unauthenticated payment bypass via forged wc-api callback", "mode": "block", "severity": 7.5, "slug": "plisio-payment-gateway-for-woocommerce", "tags": ["missing-authorization", "payment-bypass", "unauthenticated", "woocommerce"], "target": "plugin", "versions": "<=2.0.5"}, "RULE-CVE-2026-6403-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/quickplayground/v1/blueprint/[^/?]+(?:[/?]|$)~"}, {"name": "ARGS:stylesheet", "type": "regex", "value": "~(?:(?:\\\\.\\\\.[\\\\\\\\/]){2,}|/(?:etc/passwd|wp-config\\\\.php|\\\\.htaccess|\\\\.env)|[a-z]:[/\\\\\\\\]|\\\\\\\\\\\\\\\\)~i"}], "cve": "CVE-2026-6403", "description": "Quick Playground <=1.3.3 unauthenticated path traversal via stylesheet parameter in blueprint REST endpoint", "mode": "block", "severity": 7.5, "slug": "quick-playground", "target": "plugin", "versions": "<=1.3.3"}, "RULE-CVE-2026-6456-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/account-switcher/v1/remember-login(/|\\\\?|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6456", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6456", "description": "Account Switcher <=1.0.2 privilege escalation via rememberLogin REST endpoint loose comparison", "mode": "block", "severity": 8.8, "slug": "account-switcher", "tags": ["authentication-bypass", "privilege-escalation", "rest-api", "unauthenticated-from-subscriber"], "target": "plugin", "versions": "<=1.0.2"}, "RULE-CVE-2026-6495-01": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_container_type", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_container_type", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-02": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-03": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_color", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_color", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-04": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_btn_class", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_btn_class", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-05": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_custom_js", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_custom_js", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-06": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_default_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_default_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-07": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-repeaters~"}, {"name": "ARGS:alm_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-08": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-theme-templates~"}, {"name": "ARGS:alm_theme_repeater", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_theme_repeater", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-09": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more-licenses~"}, {"name": "ARGS:alm_license_key", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_license_key", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6495-10": {"action": "admin_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~/wp-admin/admin\\\\.php.*page=ajax-load-more~"}, {"name": "ARGS:alm_preview", "type": "regex", "value": "~[<>\\"]|on(?:error|load|click|mouseover)\\\\s*=~i"}], "cve": "CVE-2026-6495", "description": "Ajax Load More <=7.8.3 reflected XSS via alm_preview", "mode": "block", "severity": 7.1, "slug": "ajax-load-more", "target": "plugin", "versions": "<=7.8.3"}, "RULE-CVE-2026-6518-01": {"ajax_action": "cmp_theme_update_install", "conditions": [{"name": "ARGS:file", "type": "exists"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6518", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6518", "description": "CMP Coming Soon & Maintenance <=4.1.16 authenticated arbitrary file upload via cmp_theme_update_install AJAX action", "mode": "block", "severity": 8.8, "slug": "cmp-coming-soon-maintenance", "tags": ["arbitrary-file-upload", "remote-code-execution", "missing-authorization"], "target": "plugin", "versions": "<=4.1.16"}, "RULE-CVE-2026-6690-01": {"ajax_action": "lp_update_mds", "conditions": [{"name": "ARGS:n", "type": "regex", "value": "~(?:<script[\\\\s/>]|on[a-z]+\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-6690", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6690", "description": "LifePress <=2.2.2 unauthenticated stored XSS via lp_update_mds AJAX action", "mode": "block", "severity": 7.2, "slug": "lifepress", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=2.2.2"}, "RULE-CVE-2026-6817-01": {"ajax_action": "ays_rate_the_quiz", "conditions": [{"name": "ARGS:rate_reason", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle|animationend|animationstart|animationiteration|transitionend|pointerover|pointerdown|pointerup|pointermove|pointerenter|pointerleave|pointercancel|gotpointercapture|lostpointercapture|wheel|contextmenu|copy|cut|paste|drag|dragstart|dragend|dragenter|dragleave|dragover|drop|input|change|select|submit|reset|keydown|keyup|keypress|touchstart|touchend|touchmove|touchcancel|abort|beforeunload|hashchange|message|offline|online|pagehide|pageshow|popstate|resize|storage|unload)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=|&#x?0*(?:3c|60)\\\\s*;\\\\s*script)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS via rate_reason parameter in ays_rate_the_quiz AJAX action", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6817-02": {"ajax_action": "ays_load_more_reviews", "conditions": [{"name": "ARGS:start_from", "type": "regex", "value": "~(?:<\\\\s*(?:script|img|svg|iframe|object|embed|link|meta|style|a|body|input|form|video|audio|source|details|marquee)\\\\b|on(?:load|error|click|mouseover|focus|blur|toggle)\\\\s*=|javascript\\\\s*:|data\\\\s*:\\\\s*text/html|srcdoc\\\\s*=)~i"}], "cve": "CVE-2026-6817", "description": "Quiz Maker by AYS <=6.7.1.29 unauthenticated stored XSS render path via ays_load_more_reviews start_from parameter", "mode": "block", "severity": 5.8, "slug": "quiz-maker", "target": "plugin", "versions": "<=6.7.1.29"}, "RULE-CVE-2026-6828-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]+\\\\bonerror\\\\b|<svg[\\\\s/][^>]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (post.php)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6828-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[fluentform\\\\s[^\\\\]]*permission_message\\\\s*=\\\\s*[\\"\'][^\\"\']*(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<img\\\\b[^>]+\\\\bonerror\\\\b|<svg[\\\\s/][^>]*\\\\bon(?:load|error)\\\\b)~i"}, {"name": "", "type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-6828", "description": "Fluent Forms <=6.2.1 contributor+ stored XSS via permission_message shortcode attribute in post content (REST API)", "mode": "block", "severity": 6.4, "slug": "fluentform", "target": "plugin", "versions": "<=6.2.1"}, "RULE-CVE-2026-6933-01": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "create_plugin"}, {"name": "ARGS:premmerce_plugin_namespace", "type": "regex", "value": "~[;{}()$`]|\\\\b(?:system|exec|passthru|shell_exec|popen|proc_open|eval|assert|phpinfo|file_put_contents|file_get_contents|base64_decode|unlink)\\\\s*\\\\(~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 authenticated RCE via unsanitized namespace injection in plugin generator", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-02": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "generate_data"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on generate_data admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6933-03": {"action": "admin_init", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "clean_up"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6933", "description": "Premmerce Dev Tools <=2.0 missing authorization on clean_up admin-post action", "mode": "block", "severity": 8.8, "slug": "premmerce-dev-tools", "target": "plugin", "versions": "<=2.0"}, "RULE-CVE-2026-6963-01": {"ajax_action": "wmg_save_provider_config", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_save_provider_config allows subscriber+ privilege escalation", "mode": "block", "severity": 9.8, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "privilege-escalation"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-02": {"ajax_action": "wmg_get_saved_configs", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_get_saved_configs allows subscriber+ data disclosure", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "information-disclosure"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-6963-03": {"ajax_action": "wmg_test_provider_config_send_mail", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-6963", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-6963", "description": "WP Mail Gateway <=1.8 missing authorization on wmg_test_provider_config_send_mail allows subscriber+ email sending", "mode": "block", "severity": 7.5, "slug": "wp-mail-gateway", "tags": ["missing-authorization", "email-abuse"], "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-7048-01": {"action": "init", "conditions": [{"name": "ARGS:content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post content", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7048-02": {"action": "init", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~Best_Wordpress_Gallery[^\\\\]]*order_by\\\\s*=\\\\s*[\\"\']?[^\\"\'\\\\]]*(?:SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|(?:EXTRACT|UPDATE)XML\\\\s*\\\\(|\\\\(\\\\s*SELECT\\\\s|IF\\\\s*\\\\(|CASE\\\\s+WHEN|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE|SELECT)\\\\s|UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s)~i"}], "cve": "CVE-2026-7048", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7048", "description": "Photo Gallery by 10Web <=1.8.40 authenticated SQL injection via Best_Wordpress_Gallery shortcode order_by attribute in post_content parameter", "mode": "block", "severity": 6.5, "slug": "photo-gallery", "tags": ["sql-injection", "authenticated", "shortcode"], "target": "plugin", "versions": "<=1.8.40"}, "RULE-CVE-2026-7106-01": {"action": "personal_options_update", "conditions": [{"name": "ARGS:hscrm_user_roles", "type": "exists"}, {"type": "missing_capability", "value": "promote_users"}], "cve": "CVE-2026-7106", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7106", "description": "Highland Software Custom Role Manager <=1.0.0 authenticated privilege escalation via hscrm_user_roles[] on personal_options_update", "method": "POST", "mode": "block", "severity": 8.8, "slug": "highland-software-custom-role-manager", "tags": ["missing-authorization", "privilege-escalation", "authenticated"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-7330-01": {"ajax_action": "aal_stats_save", "conditions": [{"name": "ARGS:url", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|click|mouseover|mouseout|focus|blur)\\\\s*=|javascript\\\\s*:)~i"}], "cve": "CVE-2026-7330", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7330", "description": "WP Auto Affiliate Links <=6.8.8 unauthenticated stored XSS via url parameter", "mode": "block", "severity": 7.2, "slug": "wp-auto-affiliate-links", "tags": ["xss", "stored", "unauthenticated"], "target": "plugin", "versions": "<=6.8.8"}, "RULE-CVE-2026-7465-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (classic editor)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-7465-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~wp:uagb/[a-zA-Z0-9_-]+\\\\s*\\\\{[^}]*render_callback~i"}], "cve": "CVE-2026-7465", "description": "Spectra Gutenberg Blocks <=2.19.25 authenticated (Contributor+) RCE via fake uagb/ block render_callback in post content (REST API)", "mode": "block", "severity": 8.8, "slug": "ultimate-addons-for-gutenberg", "target": "plugin", "versions": "<=2.19.25"}, "RULE-CVE-2026-7567-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~[?&]temp-login-token\\\\[~"}], "cve": "CVE-2026-7567", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7567", "description": "Temporary Login <=1.0.0 authentication bypass via non-scalar temp-login-token array parameter", "mode": "block", "severity": 9.8, "slug": "temporary-login", "tags": ["authentication-bypass", "unauthenticated", "cwe-288"], "target": "plugin", "versions": "<=1.0.0"}, "RULE-CVE-2026-7649-01": {"ajax_action": "arm_directory_paging_action", "conditions": [{"name": "ARGS:orderby", "type": "regex", "value": "~(?:UNION(?:\\\\s|/\\\\*[^*]*\\\\*/)+(?:ALL(?:\\\\s|/\\\\*[^*]*\\\\*/)+)?SELECT(?:\\\\s|/\\\\*[^*]*\\\\*/)|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|(?:--|#)(?:\\\\s|$)|\\\\b(?:OR|AND)\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|\\\\bCASE\\\\b.*\\\\bWHEN\\\\b|\\\\b(?:SLEEP|BENCHMARK)\\\\s*\\\\()~i"}], "cve": "CVE-2026-7649", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-7649", "description": "ARMember <=4.0.60 unauthenticated blind SQL injection via orderby parameter", "mode": "block", "severity": 8.8, "slug": "armember-membership", "tags": ["sql-injection", "unauthenticated", "blind-sql-injection"], "target": "plugin", "versions": "<=4.0.60"}, "RULE-CVE-2026-7654-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:metavalue", "type": "regex", "value": "~[OCa]:[0-9]+:\\\\{?\\"~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via classic editor post meta (metavalue) leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-7654-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS", "type": "regex", "value": "~[OC]:[0-9]+:\\"[a-zA-Z]~"}], "cve": "CVE-2026-7654", "description": "Admin Columns <=7.0.18 PHP object injection via REST API post meta leading to RCE", "mode": "block", "severity": 8.8, "slug": "codepress-admin-columns", "target": "plugin", "versions": "<=7.0.18"}, "RULE-CVE-2026-7795-01": {"action": "save_post", "conditions": [{"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through classic editor post.php", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-7795-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[chat\\\\s[^\\\\]]*num\\\\s*=\\\\s*[\'\\"][^\'\\"]*[);][^\'\\"]*[\'\\"]~i"}], "cve": "CVE-2026-7795", "description": "Block stored XSS via [chat] shortcode num parameter injection through REST API post creation/update", "mode": "block", "severity": 6.4, "slug": "click-to-chat-for-whatsapp", "target": "plugin", "versions": "<4.40"}, "RULE-CVE-2026-8073-01": {"action": "rest_api_init", "conditions": [{"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8073-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json/|(?:^|&|\\\\?)rest_route=/)[^?&]*(?:downloadZIP|download-zip|download_zip)~i"}, {"name": "ARGS:file-name", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|%2[Ee]%2[Ee](?:%2[Ff]|%5[Cc])|%2[Ee]%2[Ee][\\\\\\\\/]|\\\\.\\\\.%2[Ff]|\\\\.\\\\.%5[Cc]|^/|^[A-Za-z]:[\\\\\\\\/]|^(?:php|file|data|expect|zip|phar)://|\\\\x00|%00)~i"}], "cve": "CVE-2026-8073", "description": "Kirki <=6.0.6 unauthenticated path traversal in API::downloadZIP via file-name parameter (rest_route query form)", "mode": "block", "severity": 7.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8089-01": {"ajax_action": "wemail_preview", "conditions": [{"name": "ARGS:action", "type": "equals", "value": "wemail_preview"}, {"name": "ARGS:shortcode", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|animationstart)\\\\s*=|javascript\\\\s*:|[\\"\']\\\\s*(?:>|on[a-z]+=))~i"}], "cve": "CVE-2026-8089", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8089", "description": "weMail <2.1.3 reflected XSS via shortcode parameter in wemail_preview AJAX handler", "mode": "block", "severity": 7.1, "slug": "wemail", "tags": ["xss", "reflected", "unauthenticated"], "target": "plugin", "versions": "<2.1.3"}, "RULE-CVE-2026-8096-01": {"ajax_action": "kirki_wp_admin_get_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_get_apis allows subscriber+ to read sensitive form submission data", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8096-02": {"ajax_action": "kirki_wp_admin_post_apis", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8096", "description": "Kirki <=6.0.6 missing authorization on kirki_wp_admin_post_apis allows subscriber+ to access admin-restricted POST API", "mode": "block", "severity": 6.5, "slug": "kirki", "target": "plugin", "versions": "<=6.0.6"}, "RULE-CVE-2026-8163-01": {"ajax_action": "infility_redirect", "conditions": [{"name": "ARGS:RId", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT\\\\s|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|/\\\\*[\\\\s\\\\S]*?\\\\*/|(?:--|#)\\\\s|\\\\b(?:OR|AND)\\\\s+[\'\\"]?\\\\d+[\'\\"]?\\\\s*=\\\\s*[\'\\"]?\\\\d+|SLEEP\\\\s*\\\\(|BENCHMARK\\\\s*\\\\(|EXTRACTVALUE\\\\s*\\\\(|UPDATEXML\\\\s*\\\\()~i"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8163", "description": "Infility Global <2.15.19 authenticated (Subscriber+) SQL injection via RId parameter in infility_redirect AJAX handler", "mode": "block", "severity": 8.8, "slug": "infility-global", "target": "plugin", "versions": "<2.15.19"}, "RULE-CVE-2026-8172-01": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_name", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_name parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-02": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_email", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_email parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-03": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_message", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_message parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8172-04": {"action": "init", "conditions": [{"name": "ARGS:scf_submit", "type": "exists"}, {"name": "ARGS:scf_subject", "type": "regex", "value": "~(?:<script[\\\\s/>]|on(?:error|load|mouseover|click|focus|blur)\\\\s*=|javascript\\\\s*:|<(?:img|svg|iframe|object|embed|details|math|video|audio|body|input|select|textarea|form|button|marquee|isindex|table|meta|link|base|style)\\\\b[^>]*\\\\bon\\\\w+\\\\s*=)~i"}], "cve": "CVE-2026-8172", "description": "Simple Basic Contact Form <=20250114 unauthenticated reflected XSS via scf_subject parameter on validation error", "mode": "block", "severity": 7.1, "slug": "simple-basic-contact-form", "target": "plugin", "versions": "<=20250114"}, "RULE-CVE-2026-8379-01": {"action": "init", "conditions": [{"name": "ARGS:file_id", "type": "regex", "value": "~^[0-9]+$~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-8379", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8379", "description": "Frontend File Manager Plugin <=23.6 unauthenticated file download via IDOR on file_id parameter", "mode": "block", "severity": 7.5, "slug": "nmedia-user-file-uploader", "tags": ["missing-authorization", "idor", "unauthenticated", "information-disclosure"], "target": "plugin", "versions": "<=23.6"}, "RULE-CVE-2026-8382-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_title", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post title overwrite via _post_title in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-8382-02": {"action": "init", "conditions": [{"name": "ARGS:_acf_form", "type": "exists"}, {"name": "ARGS:_post_content", "type": "exists"}, {"type": "missing_capability", "value": "edit_posts"}], "cve": "CVE-2026-8382", "description": "Advanced Custom Fields <=6.8.1 unauthenticated post content overwrite via _post_content in acf_form() submission", "mode": "block", "severity": 5.3, "slug": "advanced-custom-fields", "target": "plugin", "versions": "<=6.8.1"}, "RULE-CVE-2026-8438-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C(?:script|img|svg|iframe|object|embed|details|body|input|form|link|meta|style|marquee|video|audio|math|a(?:%20|\\\\+|%09|/|%2F))(?:%20|%09|%0[aAdD]|\\\\+|%3E|%2F|/)~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded HTML tags in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-8438-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/~"}, {"name": "REQUEST_URI", "type": "regex", "value": "~%3C[a-zA-Z][^%]*(?:%20|\\\\+|%09|/)on(?:error|load|click|mouseover|focus|blur|submit|change|input|animationend|toggle)%3D~i"}], "cve": "CVE-2026-8438", "description": "All-In-One Security (AIOS) <=5.4.7 unauthenticated stored XSS via URL-encoded event handler in REST API request path", "mode": "block", "severity": 7.2, "slug": "all-in-one-wp-security-and-firewall", "target": "plugin", "versions": "<=5.4.7"}, "RULE-CVE-2026-8494-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through wp-admin/post.php", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-8494-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:title", "type": "regex", "value": "~(?:on(?:focus|blur|click|mouse(?:over|out|enter)|load|error|animat(?:ion(?:end|start|iteration)|ioncancel)|key(?:down|up|press)|change|input|submit|reset|drag(?:start|end|over)?|drop|(?:before)?copy|cut|paste|contextmenu|wheel|scroll|resize|select|toggle|transitionend)\\\\s*=|<\\\\s*(?:script|iframe|embed|object|svg|img|details|marquee|math|video|audio|body|form|isindex|meta|link|style|base|applet|layer|ilayer|bgsound)[\\\\s/>]|javascript\\\\s*:)~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-8494", "description": "Permalink Manager Lite <=2.5.3.3 stored XSS via post title injection through REST API /wp/v2/posts", "mode": "block", "severity": 6.4, "slug": "permalink-manager", "target": "plugin", "versions": "<=2.5.3.3"}, "RULE-CVE-2026-8719-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mwai/v1/tools(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP tool enumeration via REST API allows low-privilege users to list admin-level tools", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "information-disclosure", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8719-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/mcp-oauth(?:[/?&]|$)~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8719", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-8719", "description": "AI Engine <=3.4.9 unauthorized MCP OAuth authorization allows non-admin users to authorize MCP applications", "mode": "block", "severity": 8.8, "slug": "ai-engine", "tags": ["missing-authorization", "privilege-escalation", "rest-api"], "target": "plugin", "versions": "<=3.4.9"}, "RULE-CVE-2026-8809-01": {"action": "init", "conditions": [{"name": "ARGS:_acf_post_id", "type": "exists"}, {"name": "ARGS", "type": "regex", "value": "~^administrator$~i"}], "cve": "CVE-2026-8809", "description": "ACF Extended <=0.9.2.5 unauthenticated privilege escalation via validation bypass in frontend form _acf_post_id parameter", "mode": "block", "severity": 9.8, "slug": "acf-extended", "target": "plugin", "versions": "<=0.9.2.5"}, "RULE-CVE-2026-8901-01": {"ajax_action": "integrazo_fwcrm_form_errorlog_show_action", "conditions": [{"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-8901", "description": "Integration for Freshsales <=1.0.15 stored XSS via error log - missing capability check on errorlog_show_action allows subscriber+ to trigger stored XSS payloads", "mode": "block", "severity": 7.2, "slug": "crm-integration-freshworks-any-form", "target": "plugin", "versions": "<=1.0.15"}, "RULE-CVE-2026-8912-01": {"ajax_action": "post_cg_gallery_form_upload", "conditions": [{"name": "ARGS:form_input", "type": "regex", "value": "~(?:UNION\\\\s+(?:ALL\\\\s+)?SELECT|;\\\\s*(?:DROP|DELETE|INSERT|UPDATE)\\\\s|\\\\b(?:OR|AND)\\\\b\\\\s+\\\\d+\\\\s*=\\\\s*\\\\d+|/\\\\*.*\\\\*/|(?:--|#)\\\\s)~i"}], "cve": "CVE-2026-8912", "description": "Contest Gallery <=28.1.6 unauthenticated SQL injection via form_input parameter in post_cg_gallery_form_upload", "mode": "block", "severity": 7.5, "slug": "contest-gallery", "target": "plugin", "versions": "<=28.1.6"}, "RULE-CVE-2026-900001-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/popup-anything-on-click/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support / Essential Plugin supply chain attack: unauthenticated RCE via wpos-analytics REST endpoint. Compromised analytics.essentialplugin.com returns malicious serialized PHP object through unserialize() in class-anylc-admin.php, leading to arbitrary file_put_contents (dropper: wp-comments-posts.php, wp-config.php injection). Shared SDK affects 22 plugins (~200k installs). No CVE assigned \\u2014 synthetic ID.", "method": "POST", "mode": "block", "severity": 10.0, "slug": "popup-anything-on-click", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "ssrf", "backdoor", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-logo-showcase-responsive-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Logo Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-logo-showcase-responsive-slider-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-03": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/countdown-timer-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Countdown Timer Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "countdown-timer-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-04": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wprps-post-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Responsive Recent Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-responsive-recent-post-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-05": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-news-and-scrolling-widgets/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP News and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-news-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-06": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-slick-slider-and-image-carousel/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Slick Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-slick-slider-and-image-carousel", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-07": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/album-and-image-gallery-plus-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Album and Image Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "album-and-image-gallery-plus-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-08": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-testimonials-with-rotator-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Testimonial with Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-testimonial-with-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-09": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-blog-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Blog and Widgets plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-blog-and-widgets", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-10": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/blog-designer-post-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Blog Designer for Post and Widget plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "blog-designer-for-post-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-11": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/meta-slider-and-carousel-with-lightbox/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Meta Slider and Carousel plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "meta-slider-and-carousel-with-lightbox", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-12": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/post-grid-and-filter-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Post Grid and Filter Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "post-grid-and-filter-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-13": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/timeline-and-history-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Timeline and History Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "timeline-and-history-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-14": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-responsive-faq-with-category-plugin/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in SP FAQ plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "sp-faq", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-15": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-team-showcase-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Team Showcase plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-team-showcase-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-17": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-trending-post-slider-and-widget/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Trending Post Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-trending-post-slider-and-widget", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-18": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/featured-post-creative/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Featured Post Creative plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "featured-post-creative", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-19": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/portfolio-and-projects/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Portfolio and Projects plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "portfolio-and-projects", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-20": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/ticker-ultimate/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in Ticker Ultimate plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "ticker-ultimate", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-21": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/video-gallery-and-player/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in HTML5 Video Gallery plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "html5-videogallery-plus-player", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-900001-22": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp-featured-content-and-slider/v1/analytics(?:[/?]|$)~"}], "cve": "CVE-2026-900001", "description": "WP Online Support supply chain \\u2014 unauthenticated RCE via wpos-analytics REST endpoint in WP Featured Content and Slider plugin", "method": "POST", "mode": "block", "severity": 10.0, "slug": "wp-featured-content-and-slider", "tags": ["supply-chain", "unauthenticated", "rce", "deserialization", "rest-api"], "target": "plugin", "versions": ">=0"}, "RULE-CVE-2026-9109-01": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/gptranslate/v1/request(?:/|\\\\?|$)~"}, {"name": "ARGS", "type": "regex", "value": "~<script[\\\\s/>]|on(?:error|load|toggle|mouseover|focus|click|change)\\\\s*=|javascript\\\\s*:|<iframe[\\\\s/>]|<svg[\\\\s/>]|<img\\\\b[^>]+\\\\bon[a-z]~i"}], "cve": "CVE-2026-9109", "description": "GPTranslate <=2.31 unauthenticated stored XSS via REST API translation storage", "mode": "block", "severity": 7.2, "slug": "gptranslate", "target": "plugin", "versions": "<=2.31"}, "RULE-CVE-2026-9125-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (classic editor)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9125-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/posts(?:/[0-9]+)?(?:[/?]|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~presto_player_overlay[^\\\\]]*link_url\\\\s*=\\\\s*[\\"\']?\\\\s*(?:j[\\\\s]*a[\\\\s]*v[\\\\s]*a[\\\\s]*s[\\\\s]*c[\\\\s]*r[\\\\s]*i[\\\\s]*p[\\\\s]*t[\\\\s]*:|&#[xX]?0*(?:6[Aa]|106);?|data[\\\\s]*:(?![\\\\s]*(?:image|audio|video|font)/))~i"}], "cve": "CVE-2026-9125", "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2026-9125", "description": "Presto Player <=4.2.0 contributor+ stored XSS via javascript: URI in presto_player_overlay shortcode link_url attribute (REST API)", "mode": "block", "severity": 6.4, "slug": "presto-player", "tags": ["xss", "stored", "shortcode", "authenticated", "rest-api"], "target": "plugin", "versions": "<=4.2.0"}, "RULE-CVE-2026-9134-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~^/wp-admin/post\\\\.php~"}, {"name": "ARGS:post_content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through post editor", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9134-02": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v2/(?:posts|pages)(?:/|\\\\?|$)~"}, {"name": "ARGS:content", "type": "regex", "value": "~\\\\[foogallery[^\\\\]]*custom_attribute_key\\\\s*=\\\\s*[\\"\']?on[a-z]+~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9134", "description": "FooGallery <=3.1.31 stored XSS via custom_attribute_key shortcode parameter through REST API", "mode": "block", "severity": 6.4, "slug": "foogallery", "target": "plugin", "versions": "<=3.1.31"}, "RULE-CVE-2026-9178-01": {"action": "init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/wp/v3/user/list/[0-9]+(?:/|\\\\?|$)~"}, {"name": "REQUEST_HEADERS:Username", "type": "exists"}], "cve": "CVE-2026-9178", "description": "WP Forms Connector <=1.8 unauthenticated sensitive user data exposure via wp/v3/user/list REST endpoint", "mode": "block", "severity": 7.5, "slug": "wp-forms-connector", "target": "plugin", "versions": "<=1.8"}, "RULE-CVE-2026-9243-01": {"ajax_action": "elementor_ajax", "conditions": [{"name": "ARGS", "type": "regex", "value": "~carousel_direction[^}]*(?:on(?:focus|blur|mouse(?:over|enter|move|out)|click|dblclick|key(?:down|up|press)|load|error|focusin|focusout|pointerover|touchstart|animationend)\\\\s*=|style\\\\s*=\\\\s*[^\\"]*(?:position|expression))~i"}, {"type": "missing_capability", "value": "unfiltered_html"}], "cve": "CVE-2026-9243", "description": "The Plus Addons for Elementor <=6.4.15 contributor+ stored XSS via carousel_direction unquoted attribute injection", "mode": "block", "severity": 6.4, "slug": "the-plus-addons-for-elementor-page-builder", "target": "plugin", "versions": "<=6.4.15"}, "RULE-CVE-2026-9570-01": {"action": "init", "conditions": [{"name": "ARGS:page_no", "type": "regex", "value": "~[\'\\"><();]|</script|\\\\\\\\x[0-9a-fA-F]{2}~i"}], "cve": "CVE-2026-9570", "description": "Taskbuilder <5.0.8 unauthenticated reflected XSS via page_no parameter in frontend shortcode inline JavaScript", "mode": "block", "severity": 7.1, "slug": "taskbuilder", "target": "plugin", "versions": "<5.0.8"}, "RULE-CVE-2026-9662-01": {"action": "init", "conditions": [{"name": "ARGS:tpf", "type": "exists"}, {"name": "ARGS:tpf", "type": "regex", "value": "~(?:\\\\.\\\\.[\\\\\\\\/]|[\\\\\\\\/]|(?:php|phar|data|zip|expect|glob|zlib)://)~i"}], "cve": "CVE-2026-9662", "description": "Recover Exit For WooCommerce <=1.0.3 unauthenticated LFI via tpf POST parameter in recover_exit()", "mode": "block", "severity": 8.1, "slug": "recoverexit-for-woocommerce", "target": "plugin", "versions": "<=1.0.3"}, "RULE-CVE-2026-9702-01": {"ajax_action": "update_locker_from_typ_page", "conditions": [{"name": "ARGS:order_id", "type": "exists"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-9702", "description": "InPost PL <1.9.1 unauthenticated parcel-locker destination update via update_locker_from_typ_page AJAX handler", "mode": "block", "severity": 7.5, "slug": "inpost-for-woocommerce", "target": "plugin", "versions": "<1.9.1"}, "RULE-CVE-2026-9702-02": {"action": "rest_api_init", "conditions": [{"name": "REQUEST_URI", "type": "regex", "value": "~(?:^/wp-json|(?:^|&|\\\\?)rest_route=)/inpost_pl/v1/order/update(?:/|\\\\?|$)~"}, {"type": "missing_capability", "value": "read"}], "cve": "CVE-2026-9702", "description": "InPost PL <1.9.1 unauthenticated order update via REST route inpost_pl/v1/order/update with open permission_callback", "mode": "block", "severity": 7.5, "slug": "inpost-for-woocommerce", "target": "plugin", "versions": "<1.9.1"}, "RULE-CVE-2026-9860-01": {"ajax_action": "cf_images_do_setup", "conditions": [{"name": "ARGS:account-id", "type": "regex", "value": "~[\'\\"]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-9860", "description": "Offload, AI & Optimize with Cloudflare Images <=1.10.2 authenticated (Author+) RCE via single-quote injection in account-id parameter written to wp-config.php", "mode": "block", "severity": 8.8, "slug": "cf-images", "target": "plugin", "versions": "<=1.10.2"}, "RULE-CVE-2026-9860-02": {"ajax_action": "cf_images_do_setup", "conditions": [{"name": "ARGS:api-key", "type": "regex", "value": "~[\'\\"]~"}, {"type": "missing_capability", "value": "manage_options"}], "cve": "CVE-2026-9860", "description": "Offload, AI & Optimize with Cloudflare Images <=1.10.2 authenticated (Author+) RCE via single-quote injection in api-key parameter written to wp-config.php", "mode": "block", "severity": 8.8, "slug": "cf-images", "target": "plugin", "versions": "<=1.10.2"}, "RULE-WPT-2453-01": {"action": "init", "conditions": [{"name": "ARGS:_chk", "type": "exists"}], "cve": "WPT-2453", "description": "Block Smart Slider 3 Pro 3.5.1.35 supply chain backdoor activation via _chk parameter. The compromised release uses this hidden parameter to receive base64-encoded PHP payloads for remote code execution.", "mode": "block", "severity": 10, "slug": "nextend-smart-slider3-pro", "tags": ["supply-chain", "backdoor", "rce", "unauthenticated"], "target": "plugin", "versions": "3.5.1.35"}, "RULE-WPT-2587-01": {"ajax_action": "sendForm", "conditions": [{"name": "ARGS:mod", "type": "equals", "value": "forms"}, {"name": "ARGS_NAMES", "type": "regex", "value": "~^fields\\\\[(?:FIELD_[A-Za-z0-9_-]+)\\\\]$~i"}, {"name": "ARGS", "type": "regex", "value": "~[\\"\']\\\\s*on(?:abort|afterprint|animation(?:cancel|end|iteration|start)|auxclick|before(?:input|match|print|toggle|unload)|blur|cancel|canplay(?:through)?|change|click|close|contextmenu|copy|cuechange|cut|dblclick|drag(?:end|enter|leave|over|start)?|drop|durationchange|emptied|ended|error|focus(?:in|out)?|formdata|hashchange|input|invalid|key(?:down|press|up)|load(?:eddata|edmetadata|start)?|message|mouse(?:down|enter|leave|move|out|over|up|wheel)|offline|online|page(?:hide|show)|paste|pause|play(?:ing)?|pointer(?:cancel|down|enter|leave|move|out|over|up)|popstate|progress|ratechange|reset|resize|scroll(?:end)?|securitypolicyviolation|seek(?:ed|ing)|select|slotchange|stalled|storage|submit|suspend|timeupdate|toggle|touch(?:cancel|end|move|start)|transition(?:cancel|end|run|start)|unload|volumechange|waiting|wheel)\\\\s*=~i"}], "cve": "WPT-2587", "description": "AI Copilot Content Generator form submission hardening", "method": "POST", "mode": "block", "severity": 6.1, "slug": "ai-copilot-content-generator", "tags": ["xss", "stored-xss", "zero-day"], "target": "plugin", "versions": "<=1.5.4"}, "TEST-HEARTBEAT": {"action": "init", "conditions": [{"type": "probabilistic", "value": "0.0002"}], "cve": "TEST-HEARTBEAT", "mode": "pass", "severity": 0.1, "target": "core", "versions": ">=1.0.0"}, "TEST-RULE": {"action": "init", "conditions": [{"name": "ARGS:test-rule", "type": "equals", "value": "b3d45e60-53a5-4959-b911-5178baaef7ac"}], "cve": "TEST-CVE", "mode": "block", "severity": 2.0, "target": "core", "versions": ">=1.0.0"}}}', true );