0xManticore writeupsSecurity write-ups by Saleh Elsayed (0xManticore): web and API security, WordPress, vulnerability research, and offensive methodology.https://0xmanticore.com/en-usA reflected XSS in Cisco Webex Meetings, and what a clean disclosure looks likehttps://0xmanticore.com/blog/cisco-webex-xss-disclosure/https://0xmanticore.com/blog/cisco-webex-xss-disclosure/Notes on reporting CVE-2026-20233, an unauthenticated reflected cross-site scripting issue in the Webex Meetings web interface, and the process that turned it into a fixed product and a named credit.Wed, 03 Jun 2026 00:00:00 GMTwebxssdisclosureUnauthenticated SSRF in WordPress plugins, and the callback pattern that keeps producing ithttps://0xmanticore.com/blog/unauthenticated-ssrf-wordpress-plugins/https://0xmanticore.com/blog/unauthenticated-ssrf-wordpress-plugins/A field note on the class of bug behind CVE-2026-7798 in FluentCRM. When a plugin fetches a URL supplied in an unauthenticated request, an allowlist is not optional. Educational only, no weaponization.Fri, 22 May 2026 00:00:00 GMTwordpressssrfmethodology