2026-09-24 10:50:21 WEB_APP_ATTACK XSS 203.0.113.77
KR South Korea GET High /?s=%3Cstyle%3E%40keyframes+x%7B%7D%3C%2Fstyle%3E%3Cxss+style%3D%22animation-name%3Ax%22+onanimationend%3D%22alert%281%29%22%3E%3C%2Fxss%3E&post_type=post
Expand Full URI /?s=%3Cstyle%3E%40keyframes+x%7B%7D%3C%2Fstyle%3E%3Cxss+style%3D%22animation-name%3Ax%22+onanimationend%3D%22alert%281%29%22%3E%3C%2Fxss%3E&post_type=post
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=s transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-24 10:30:20 WEB_APP_ATTACK XSS 203.0.113.77
KR South Korea GET High /?html=%3Cinput%20value=\'x\'%20onfocus=alert(1)%3E
Expand Full URI /?html=%3Cinput%20value=\'x\'%20onfocus=alert(1)%3E
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=html transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 10:10:19 WEB_APP_ATTACK XSS 203.0.113.61
AE United Arab Emirates GET High /?html=%3Cinput%20value%3D%27x%27%20onfocus%3Dalert%281%29%3E
Expand Full URI /?html=%3Cinput%20value%3D%27x%27%20onfocus%3Dalert%281%29%3E
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=html transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 09:50:19 WEB_APP_ATTACK REMOTE_CODE_EXECUTION 203.0.113.61
AE United Arab Emirates GET Critical /?run=eval%28base64_decode%28%22ZWNobyBwaW5n%22%29%29
Expand Full URI /?run=eval%28base64_decode%28%22ZWNobyBwaW5n%22%29%29
Full Details rule_id=WPA-RCE-004 confidence=96 source=query parameter=run transform=raw enforcement=score findings=2 rules=WPA-RCE-004,WPA-OBF-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 09:30:18 WEB_APP_ATTACK SQL_INJECTION 203.0.113.45
ZA South Africa GET Low /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Expand Full URI /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Full Details rule_id=WPA-SQLI-008 confidence=49 source=query parameter=s transform=raw enforcement=score findings=2 rules=WPA-SQLI-008,WPA-SQLI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 09:10:17 WEB_APP_ATTACK XSS 203.0.113.45
ZA South Africa GET High /?q=%3Cscript%3Ealert(1)%3C/script%3E
Expand Full URI /?q=%3Cscript%3Ealert(1)%3C/script%3E
Full Details rule_id=WPA-XSS-001 confidence=90 source=query parameter=q transform=raw enforcement=score findings=1 rules=WPA-XSS-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 08:50:17 WEB_APP_ATTACK LFI_RFI 203.0.113.29
NL Netherlands GET Critical /?file=../../../../etc/passwd
Expand Full URI /?file=../../../../etc/passwd
Full Details rule_id=WPA-LFI-005 confidence=100 source=query parameter=file transform=raw enforcement=block findings=2 rules=WPA-LFI-005,WPA-LFI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 08:30:16 WEB_APP_ATTACK REMOTE_CODE_EXECUTION 203.0.113.29
NL Netherlands GET High /?cmd=shell_exec%28ls%29&exec=whoami
Expand Full URI /?cmd=shell_exec%28ls%29&exec=whoami
Full Details rule_id=WPA-RCE-005 confidence=88 source=query parameter=exec transform=raw enforcement=score findings=1 rules=WPA-RCE-005
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 08:10:15 WEB_APP_ATTACK SQL_INJECTION 203.0.113.13
BR Brazil GET Low /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Expand Full URI /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Full Details rule_id=WPA-SQLI-008 confidence=49 source=query parameter=s transform=raw enforcement=score findings=2 rules=WPA-SQLI-008,WPA-SQLI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 07:50:15 WEB_APP_ATTACK XSS 203.0.113.13
BR Brazil GET High /?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E
Expand Full URI /?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E
Full Details rule_id=WPA-XSS-001 confidence=90 source=query parameter=q transform=raw enforcement=score findings=1 rules=WPA-XSS-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 07:30:14 WEB_APP_ATTACK TOOL_FINGERPRINTS 198.51.100.76
AU Australia GET Medium /phpmyadmin/
Expand Full URI /phpmyadmin/
Full Details rule_id=WPA-RECON-001 confidence=52 source=path parameter=_path transform=raw enforcement=score findings=1 rules=WPA-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 07:10:13 WEB_APP_ATTACK WORDPRESS_RECON 198.51.100.76
AU Australia GET Low /?rest_route=%2Fwp%2Fv2%2Fusers
Expand Full URI /?rest_route=%2Fwp%2Fv2%2Fusers
Full Details rule_id=WPA-WP-RECON-001 confidence=45 source=query parameter=rest_route transform=raw enforcement=score findings=1 rules=WPA-WP-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 06:50:13 WEB_APP_ATTACK LFI_RFI 198.51.100.60
SG Singapore GET Critical /?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd
Expand Full URI /?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd
Full Details rule_id=WPA-LFI-005 confidence=100 source=query parameter=file transform=raw enforcement=block findings=2 rules=WPA-LFI-005,WPA-LFI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 06:30:12 WEB_APP_ATTACK REMOTE_CODE_EXECUTION 198.51.100.60
SG Singapore GET Critical /?run=eval%28base64_decode%28%22ZWNobyBwaW5n%22%29%29
Expand Full URI /?run=eval%28base64_decode%28%22ZWNobyBwaW5n%22%29%29
Full Details rule_id=WPA-RCE-004 confidence=96 source=query parameter=run transform=raw enforcement=score findings=2 rules=WPA-RCE-004,WPA-OBF-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 06:10:11 WEB_APP_ATTACK SQL_INJECTION 198.51.100.44
JP Japan GET Low /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Expand Full URI /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Full Details rule_id=WPA-SQLI-008 confidence=49 source=query parameter=s transform=raw enforcement=score findings=2 rules=WPA-SQLI-008,WPA-SQLI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 05:50:11 WEB_APP_ATTACK XSS 198.51.100.44
JP Japan GET High /?html=%3Cinput%20value=\'x\'%20onfocus=alert(1)%3E
Expand Full URI /?html=%3Cinput%20value=\'x\'%20onfocus=alert(1)%3E
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=html transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 05:30:10 WEB_APP_ATTACK TOOL_FINGERPRINTS 198.51.100.28
FR France GET Medium /phpmyadmin/
Expand Full URI /phpmyadmin/
Full Details rule_id=WPA-RECON-001 confidence=52 source=path parameter=_path transform=raw enforcement=score findings=1 rules=WPA-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 05:10:09 WEB_APP_ATTACK WORDPRESS_EXPLOITS 198.51.100.28
FR France GET High /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=check
Expand Full URI /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=check
Full Details rule_id=WPA-WP-001 confidence=88 source=query parameter=action transform=raw enforcement=score findings=1 rules=WPA-WP-001
MITRE ATT&CK T1190 Initial Access OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 04:50:09 WEB_APP_ATTACK WORDPRESS_RECON 198.51.100.12
DE Germany GET Low /?rest_route=%2Fwp%2Fv2%2Fusers
Expand Full URI /?rest_route=%2Fwp%2Fv2%2Fusers
Full Details rule_id=WPA-WP-RECON-001 confidence=45 source=query parameter=rest_route transform=raw enforcement=score findings=1 rules=WPA-WP-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 04:30:08 WEB_APP_ATTACK LFI_RFI 198.51.100.12
DE Germany GET Critical /?file=../../../../etc/passwd
Expand Full URI /?file=../../../../etc/passwd
Full Details rule_id=WPA-LFI-005 confidence=100 source=query parameter=file transform=raw enforcement=block findings=2 rules=WPA-LFI-005,WPA-LFI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 04:10:07 WEB_APP_ATTACK REMOTE_CODE_EXECUTION 192.0.2.75
CA Canada GET High /?cmd=shell_exec%28ls%29&exec=whoami
Expand Full URI /?cmd=shell_exec%28ls%29&exec=whoami
Full Details rule_id=WPA-RCE-005 confidence=88 source=query parameter=exec transform=raw enforcement=score findings=1 rules=WPA-RCE-005
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 03:50:07 WEB_APP_ATTACK SQL_INJECTION 192.0.2.75
CA Canada GET Low /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Expand Full URI /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Full Details rule_id=WPA-SQLI-008 confidence=49 source=query parameter=s transform=raw findings=2 rules=WPA-SQLI-008,WPA-SQLI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 03:30:06 WEB_APP_ATTACK XSS 192.0.2.59
IN India GET High /?html=%3Cinput%20value%3D%27x%27%20onfocus%3Dalert%281%29%3E
Expand Full URI /?html=%3Cinput%20value%3D%27x%27%20onfocus%3Dalert%281%29%3E
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=html transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 03:10:05 WEB_APP_ATTACK TOOL_FINGERPRINTS 192.0.2.59
IN India GET Medium /phpmyadmin/
Expand Full URI /phpmyadmin/
Full Details rule_id=WPA-RECON-001 confidence=52 source=path parameter=_path transform=raw enforcement=score findings=1 rules=WPA-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 02:50:05 WEB_APP_ATTACK WORDPRESS_EXPLOITS 192.0.2.43
BD Bangladesh GET High /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=check
Expand Full URI /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=check
Full Details rule_id=WPA-WP-001 confidence=88 source=query parameter=action transform=raw enforcement=score findings=1 rules=WPA-WP-001
MITRE ATT&CK T1190 Initial Access OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 02:30:04 WEB_APP_ATTACK WORDPRESS_RECON 192.0.2.43
BD Bangladesh GET Low /?rest_route=%2Fwp%2Fv2%2Fusers
Expand Full URI /?rest_route=%2Fwp%2Fv2%2Fusers
Full Details rule_id=WPA-WP-RECON-001 confidence=45 source=query parameter=rest_route transform=raw enforcement=score findings=1 rules=WPA-WP-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 02:10:03 WEB_APP_ATTACK LFI_RFI 192.0.2.27
GB United Kingdom GET Critical /?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd
Expand Full URI /?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd
Full Details rule_id=WPA-LFI-005 confidence=100 source=query parameter=file transform=raw enforcement=block findings=2 rules=WPA-LFI-005,WPA-LFI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 01:50:03 WEB_APP_ATTACK REMOTE_CODE_EXECUTION 192.0.2.27
GB United Kingdom GET Critical /?run=eval%28base64_decode%28%22ZWNobyBwaW5n%22%29%29
Expand Full URI /?run=eval%28base64_decode%28%22ZWNobyBwaW5n%22%29%29
Full Details rule_id=WPA-RCE-004 confidence=96 source=query parameter=run transform=raw enforcement=score findings=2 rules=WPA-RCE-004,WPA-OBF-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 01:30:02 WEB_APP_ATTACK SQL_INJECTION 192.0.2.11
US United States GET Low /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Expand Full URI /?s=1%20UNION%20SELECT%201%2C2%20FROM%20information_schema.tables%20OR%201%3D1
Full Details rule_id=WPA-SQLI-008 confidence=49 source=query parameter=s transform=raw findings=2 rules=WPA-SQLI-008,WPA-SQLI-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 01:10:01 WEB_APP_ATTACK XSS 192.0.2.11
US United States GET High /?q=%3Cscript%3Ealert(1)%3C/script%3E
Expand Full URI /?q=%3Cscript%3Ealert(1)%3C/script%3E
Full Details rule_id=WPA-XSS-001 confidence=90 source=query parameter=q transform=raw enforcement=score findings=1 rules=WPA-XSS-001
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-24 00:50:01 PLUGIN_DEACTIVATED PLUGIN 198.51.100.76
AU Australia GET Info /wp-admin/plugins.php?action=deactivate&plugin=wpauditor-pro%2Fwpauditor-pro.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Expand Full URI /wp-admin/plugins.php?action=deactivate&plugin=wpauditor-pro%2Fwpauditor-pro.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Full Details plugin=wpauditor-pro/wpauditor-pro.php
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
2026-09-24 00:30:00 QUARANTINE_DELETED 198.51.100.76
AU Australia POST Info /wp-admin/admin.php?page=wpauditor-quarantine-manager
Expand Full URI /wp-admin/admin.php?page=wpauditor-quarantine-manager
Full Details qid=x-php-08eb49d44b05d058
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
2026-09-23 21:00:00 FILE_MONITORING_SCAN FILE_MONITORING 198.51.100.76
AU Australia POST Info /wp-admin/admin-post.php
Expand Full URI /wp-admin/admin-post.php
Full Details scan_id=a825df6d2f1f42eeb260bfa8514b29a0 scope=all days=30 findings=624 high_risk=3 duration_ms=4034 truncated=1
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
2026-09-23 20:17:39 FILE_QUARANTINED FILE_FORENSICS 198.51.100.60
SG Singapore POST Info /wp-admin/admin.php?page=wpauditor-file-forensics&scan_id=4a3e856e2b0049fb9746378190478d60
Expand Full URI /wp-admin/admin.php?page=wpauditor-file-forensics&scan_id=4a3e856e2b0049fb9746378190478d60
Full Details qid=x-php-08eb49d44b05d058 file=wp-content/uploads/x.php finding_id=0b3ff4bf1074737cb3ff7ffd detector=uploads risk=Critical
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
2026-09-23 19:35:18 FILE_FORENSICS_SCAN FILE_FORENSICS 198.51.100.60
SG Singapore POST Info /wp-admin/admin-post.php
Expand Full URI /wp-admin/admin-post.php
Full Details scan_id=4a3e856e2b0049fb9746378190478d60 scope=all findings=11 critical=3 high=6 duration_ms=2840 truncated=0
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
2026-09-23 18:52:56 LOGIN_SUCCESS AUTH 198.51.100.44
JP Japan POST Info /wp-login.php
Expand Full URI /wp-login.php
Full Details user=admin
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 18:10:35 POST_DELETED POST 198.51.100.28
FR France POST Info /wp-cron.php?doing_wp_cron=1788957900.7685511112213134765625
Expand Full URI /wp-cron.php?doing_wp_cron=1788957900.7685511112213134765625
Full Details post_id=78 title=Auto Draft type:post
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent WordPress/7.1; http://localhost/wpauditor-ai
2026-09-23 17:28:14 PLUGIN_ACTIVATED PLUGIN 198.51.100.12
DE Germany GET Info /wp-admin/plugins.php?action=activate&plugin=wpauditor-pro%2Fwpauditor-pro.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Expand Full URI /wp-admin/plugins.php?action=activate&plugin=wpauditor-pro%2Fwpauditor-pro.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Full Details plugin=wpauditor-pro/wpauditor-pro.php
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 16:45:53 PLUGIN_DEACTIVATED PLUGIN 192.0.2.59
IN India GET Info /wp-admin/plugins.php?action=deactivate&plugin=wpauditor-pro%2Fwpauditor-pro.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Expand Full URI /wp-admin/plugins.php?action=deactivate&plugin=wpauditor-pro%2Fwpauditor-pro.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Full Details plugin=wpauditor-pro/wpauditor-pro.php
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 16:03:32 PLUGIN_ACTIVATED PLUGIN 192.0.2.27
GB United Kingdom GET Info /wp-admin/plugins.php?action=activate&plugin=wpauditor-freeX%2Fwpauditor.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Expand Full URI /wp-admin/plugins.php?action=activate&plugin=wpauditor-freeX%2Fwpauditor.php&plugin_status=all&paged=1&s&_wpnonce=DEMO
Full Details plugin=wpauditor-freeX/wpauditor.php
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 15:21:11 WEB_APP_ATTACK XSS 203.0.113.77
KR South Korea GET High /?s=%3Cstyle%3E%40keyframes+x%7B%7D%3C%2Fstyle%3E%3Cxss+style%3D%22animation-name%3Ax%22+onanimationend%3D%22alert%281%29%22%3E%3C%2Fxss%3E&post_type=post
Expand Full URI /?s=%3Cstyle%3E%40keyframes+x%7B%7D%3C%2Fstyle%3E%3Cxss+style%3D%22animation-name%3Ax%22+onanimationend%3D%22alert%281%29%22%3E%3C%2Fxss%3E&post_type=post
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=s transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 14:38:49 THEME_SWITCH THEME 203.0.113.77
KR South Korea GET Info /wp-admin/themes.php?action=activate&template=wpauditor-blog-theme&stylesheet=wpauditor-blog-theme&_wpnonce=DEMO
Expand Full URI /wp-admin/themes.php?action=activate&template=wpauditor-blog-theme&stylesheet=wpauditor-blog-theme&_wpnonce=DEMO
Full Details theme=WPAuditor Blog
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 13:56:28 MEDIA_DELETED MEDIA 203.0.113.77
KR South Korea POST Info /wp-admin/update.php?action=upload-theme
Expand Full URI /wp-admin/update.php?action=upload-theme
Full Details file=archive.zip
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 13:14:07 MEDIA_UPLOADED MEDIA 203.0.113.77
KR South Korea POST Info /wp-admin/update.php?action=upload-theme
Expand Full URI /wp-admin/update.php?action=upload-theme
Full Details file=archive.zip
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
2026-09-23 12:31:46 WEB_APP_ATTACK WORDPRESS_EXPLOITS 203.0.113.61
AE United Arab Emirates GET High /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=check
Expand Full URI /wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=check
Full Details rule_id=WPA-WP-001 confidence=88 source=query parameter=action transform=raw enforcement=score findings=1 rules=WPA-WP-001
MITRE ATT&CK T1190 Initial Access OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-23 11:49:25 WEB_APP_ATTACK WORDPRESS_RECON 203.0.113.61
AE United Arab Emirates GET Low /?rest_route=%2Fwp%2Fv2%2Fusers
Expand Full URI /?rest_route=%2Fwp%2Fv2%2Fusers
Full Details rule_id=WPA-WP-RECON-001 confidence=45 source=query parameter=rest_route transform=raw enforcement=score findings=1 rules=WPA-WP-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-23 11:07:04 WEB_APP_ATTACK TOOL_FINGERPRINTS 203.0.113.61
AE United Arab Emirates GET Medium /phpmyadmin/
Expand Full URI /phpmyadmin/
Full Details rule_id=WPA-RECON-001 confidence=52 source=path parameter=_path transform=raw enforcement=score findings=1 rules=WPA-RECON-001
MITRE ATT&CK T1595 Reconnaissance OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
2026-09-23 10:24:42 WEB_APP_ATTACK XSS 203.0.113.45
ZA South Africa GET High /?html=%3Cinput%20value=\'x\'%20onfocus=alert(1)%3E
Expand Full URI /?html=%3Cinput%20value=\'x\'%20onfocus=alert(1)%3E
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=html transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-23 09:42:21 WEB_APP_ATTACK XSS 203.0.113.45
ZA South Africa GET High /?html=%3Cinput%20value%3D%27x%27%20onfocus%3Dalert%281%29%3E
Expand Full URI /?html=%3Cinput%20value%3D%27x%27%20onfocus%3Dalert%281%29%3E
Full Details rule_id=WPA-XSS-003 confidence=86 source=query parameter=html transform=raw enforcement=score findings=1 rules=WPA-XSS-003
MITRE ATT&CK T1190 Initial Access User Agent WPAuditor-ThreatSimulator/1.1
2026-09-23 09:00:00 UNUSUAL_HTTP_METHOD Unusual HTTP 203.0.113.45
ZA South Africa OPTIONS Medium /
Expand Full URI /
Full Details
MITRE ATT&CK N/A
OWASP Top 10 (2025) N/A
User Agent WPAuditor-ThreatSimulator/1.1
KRSouth Korea
AEUnited Arab Emirates
ZASouth Africa
NLNetherlands
BRBrazil
AUAustralia
SGSingapore
JPJapan
FRFrance
DEGermany
CACanada
INIndia
BDBangladesh
GBUnited Kingdom
USUnited States