https://vulnerability.circl.lu/sightings/feed 2026-08-30T19:06:49.569286+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/da82e5e4-de09-473c-98a2-664407fa3d66/export 2026-08-30T19:06:49.591411+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "da82e5e4-de09-473c-98a2-664407fa3d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mucwgzvl2m2h", "content": "CVE-2026-82222 is trending. Hype score 12, currently #3 on cvemon.\n\nDeserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.\n\nhttps://cvemon.intruder.io/cves/CVE-2026-82222", "creation_timestamp": "2026-08-30T17:34:46.385497Z"} 2026-08-30T17:34:46.385497+00:00 https://vulnerability.circl.lu/sighting/1fd7eec9-bf9f-4a4a-bec3-e34bd1751ac2/export 2026-08-30T19:06:49.593581+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1fd7eec9-bf9f-4a4a-bec3-e34bd1751ac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/510", "content": "python poc.py -u https://parishtest.actondev7.com\nCVE-2026-82222 GiveWP unauth RCE PoC \u2014 1 target(s), cmd='id'\n\n[*] target https://parishtest.actondev7.com token mb1qjodqvj9a\n [PASS] register (auth cookie issued) \u2014 status=200\n [PASS] profile nonce harvested \u2014 uid='14'\n [PASS] gadget stored in last_name meta \u2014 update=True stored_len=481\n [PASS] donation form discovered \u2014 form_id=9 via https://parishtest.actondev7.com/donations/donate-to-the-parish/\n [PASS] donation nonce via admin-ajax \u2014 nonce=d675274bcb...\n [FAIL] session poisoned (HTTP 500 after write) \u2014 status=200 (no crash: amount/gateway mismatch or write-path rejection \u2014 target may be patched)\n [FAIL] command executed (marker fetched over HTTP) \u2014 marker https://parishtest.actondev7.com/wp-content/uploads/mb1qjodqvj9a.txt not retrievable\n\n================================================================\ntarget result\n----------------------------------------------------------------\nhttps://parishtest.actondev7.com not confirmed\n================================================================\n0/1 target(s) confirmed command execution", "creation_timestamp": "2026-08-30T17:00:05.264472Z"} 2026-08-30T17:00:05.264472+00:00 https://vulnerability.circl.lu/sighting/a062f690-3101-445a-97e3-b085df43d2c9/export 2026-08-30T19:06:49.593765+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a062f690-3101-445a-97e3-b085df43d2c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/509", "content": "poc: https://github.com/dinosn/givewp-cve-2026-82222-rce-lab", "creation_timestamp": "2026-08-30T14:00:04.528687Z"} 2026-08-30T14:00:04.528687+00:00 https://vulnerability.circl.lu/sighting/121c2e13-67e2-4911-aa4e-b608c47c281d/export 2026-08-30T19:06:49.593896+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "121c2e13-67e2-4911-aa4e-b608c47c281d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3muc6kho37s2h", "content": "Daily IT Security Digest \u2014 2026-08-30\nbeing actively exploited in the wild.\n Source: https://infosec.exchange/@beyondmachines1/117183879688482251\n\n5. **GiveWP Maximum-Severity RCE (CVE-2026-82222)**\n GiveWP, a widely used WordPress donation plugin, released an emergency update to fix a critical", "creation_timestamp": "2026-08-30T10:27:11.466726Z"} 2026-08-30T10:27:11.466726+00:00 https://vulnerability.circl.lu/sighting/17d57ec9-93be-4a0f-a5a5-2f07ddf55c96/export 2026-08-30T19:06:49.594015+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "17d57ec9-93be-4a0f-a5a5-2f07ddf55c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100326", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a givewp-cve-2026-82222-rce-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-30 05:23:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAuthorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-30T09:00:06.397429Z"} 2026-08-30T09:00:06.397429+00:00 https://vulnerability.circl.lu/sighting/9101bdf6-b58e-4c45-8724-83d8835f09af/export 2026-08-30T19:06:49.594139+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9101bdf6-b58e-4c45-8724-83d8835f09af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/100304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-82222-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a UdinChan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-30 01:54:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC for CVE-2026-82222\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-30T07:00:04.767427Z"} 2026-08-30T07:00:04.767427+00:00 https://vulnerability.circl.lu/sighting/8bcdcc6d-ecac-44e2-8ad2-00c0dfd716bd/export 2026-08-30T19:06:49.594260+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8bcdcc6d-ecac-44e2-8ad2-00c0dfd716bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mu74dqrndj2u", "content": "\ud83e\udd16 CVE-2026-82222: RCE in the GiveWP WordPress donation plugin. Unauthenticated registration + unserialize gadget chain \u2192 arbitrary code execution. Fixed in 4.16.7.2.\nhttps://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/", "creation_timestamp": "2026-08-29T05:09:39.447897Z"} 2026-08-29T05:09:39.447897+00:00 https://vulnerability.circl.lu/sighting/ab0fec19-fce8-422b-93b6-81a61198f252/export 2026-08-30T19:06:49.594376+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ab0fec19-fce8-422b-93b6-81a61198f252", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu72ott44y2f", "content": "CVE-2026-82222 - givewp\nThe GiveWP donation plugin for WordPress can be fooled by specially crafted information, allowing an attacker to insert malicious instructions that run on your site. This could give them\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#givewp #CVE #infosec", "creation_timestamp": "2026-08-29T04:40:04.447533Z"} 2026-08-29T04:40:04.447533+00:00 https://vulnerability.circl.lu/sighting/f93647f6-874e-4e07-acf7-e90351568f59/export 2026-08-30T19:06:49.594489+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f93647f6-874e-4e07-acf7-e90351568f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "seen", "source": "https://bsky.app/profile/bilaltariq01.bsky.social/post/3mu6uv3gyfa2f", "content": "GiveWP CVE-2026-82222: RCE Chain from Unauthenticated Registration to PHP Object Injection https://cstu.io/36a669 #tecnologia #python #google", "creation_timestamp": "2026-08-29T02:56:11.806762Z"} 2026-08-29T02:56:11.806762+00:00 https://vulnerability.circl.lu/sighting/b2284380-2d4a-44b0-b8ff-bae4b4933f33/export 2026-08-30T19:06:49.594611+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "b2284380-2d4a-44b0-b8ff-bae4b4933f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82222", "type": "seen", "source": "https://t.me/captainsmok3r_official/506", "content": "GiveWP WordPress donation plugin has a CVSS 10 RCE flaw. CVE-2026-82222: unauthenticated PHP object injection via deserialization. Affects <= 4.16.7.1", "creation_timestamp": "2026-08-29T00:00:07.107418Z"} 2026-08-29T00:00:07.107418+00:00