CVE

4 posts tagged with CVE.

2026-04-20bug bountyCVEWordPress7 min read

Finding CVEs in WordPress: CVE-2025-4392, stored XSS in Shared Files

CVE-2025-4392 was an unauthenticated stored XSS in the Shared Files plugin. A sanitizer that only ran for SVGs and silently passed everything else through. How the gate made the function's name a lie, and a checklist to grep your own plugin source for the same pattern.

2026-04-18bug bountyCVEWordPress7 min read

Finding CVEs in WordPress: CVE-2025-3769, IDOR in LatePoint

A walkthrough of CVE-2025-3769, an IDOR in the LatePoint plugin that exposed customer data from about 100K WordPress sites. How I found it, the code-review pattern behind it and a checklist for auditing WordPress plugins yourself.

2026-02-18CVEweb securitySQLi3 min read

Two lines of defense that opened the door to SQL injection

Both lines were written for security. One added protection, the other removed it. How $wpdb->prepare() and stripslashes() combined into a critical SQL injection.

2025-12-10cybersecuritymalwareCVE5 min read

The hidden cost of CVE scanner convenience

When critical CVEs drop, malicious scanners follow. Here's why you should review the code before running any security tool from GitHub.