CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94299

The elegro Crypto Payment WordPress plugin versions through 1.0.1 is vulnerable to an unauthenticated arbitrary order status change via IPN callback. The root cause is a failure to require a shared secret for validating incoming payment notification requests. If the secret remains at its default ...

CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE-Exploit KRITISCHE Schwachstelle CVE-ID: CVE-2025-32583 Schweregrad: 9.9 KRITISCH CVSS-Vektor: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Beschreibung Eine Schwachstelle im PDF 2 Post WordPress-Plugin entwickelt von termel ermöglicht Remote Code...

CVE-2026-10580

WordPress - Hippoo Mobile App für WooCommerce = 1.9.4 - Authentifizierungsumgehung zur Admin-Konto-Übernahme Übersicht Dieses Tool ist ein Proof-of-Concept-Exploit für CVE-2026-10580 , eine Authentifizierungsumgehungs-Schwachstelle, die das Hippoo Mobile App für WooCommerce WordPress-Plugin...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress-Plugin – POC für beliebigen Datei-Upload durch authentifizierte Abonnenten Wordpress-Plugin AI Engine 2.9.3 – 2.9.4 Proof of Concept Bitte beachten Sie, dass diese Schwachstelle nur dann ausgenutzt werden kann, wenn die Option „Public API“ aktiviert ist standardmäßig...

CVE-2025-4334

🔓 Simple User Registration = 6.3 – Unauthenticated Privilege Escalation 📄 Beschreibung Das Simple User Registration Plugin für WordPress ist in allen Versionen bis einschließlich 6.3 anfällig für Privilege Escalation. Grund dafür sind unzureichende Einschränkungen bei Benutzer-Meta-Werten, die...

CVE-2022-1329

WP Elementor 3.6.0/1/2 Entfernte Codeausführung Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version Version: 3.6....

wordpress-jetpack-broken-access-control-exploit

wordpress-jetpack-broken-access-control-exploit Este é um programa Python3 que explora a vulnerabilidade de controle de acesso quebrado do Jetpack 13.9.1 CVE-2024-9926. AVISO LEGAL Esta ferramenta é destinada a engenheiros de segurança e profissionais de AppSec para avaliações de segurança. Use...

CVE-2026-14894

CVE-2026-14894 — Super Forms ≤ 6.3.313 Übersicht Nicht authentifizierter beliebiger Datei-Upload → Remote Code Execution im WordPress-Plugin Super Forms Versionen ≤ 6.3.313. Die Schwachstelle befindet sich im AJAX-Handler supersubmitform, der Datei-Uploads über ein datauristring-Feld verarbeitet,...

CVE-2026-15282

CVE-2026-15282 — Exploração em Massa de RCE no Instant Appointment Pré-Autenticação filegetcontents + fileputcontents → PHP Webshell Visão Geral CVE-2026-15282 é uma vulnerabilidade crítica CVSS 9.8 de upload arbitrário de arquivo não autenticado no plugin Instant Appointment do WordPress ≤ 1.2. ...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Zusammenfassung Dieses Repository enthält ein lokales Docker-Labor zur Reproduktion und Validierung von CVE-2026-56011, einer nicht authentifizierten Cross-Site-Scripting-Sicherheitslücke, die MapPress Maps f...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI से RCE तक एक्सप्लॉइट 'tab' पैरामीटर के माध्यम से Pre-Auth Path Traversal → Local File Inclusion अवलोकन CVE-2026-9290 WP User Manager – User Profile Builder & Membership WordPress प्लगइन ≤ 2.9.17 में उच्च-गंभीरता CVSS 7.5 वाली बिना प्रमाणीकरण वाली Local File...

PT-2026-106341

Name of the Vulnerable Software and Affected Versions elegro Crypto Payment versions prior to 1.0.2 Description The plugin fails to require a shared secret before trusting incoming payment notification requests. This allows unauthenticated attackers to forge payment confirmations and change the...

PT-2026-106339

Name of the Vulnerable Software and Affected Versions Deema Payment Gateway versions prior to 1.1.3 Description The Deema Payment Gateway WordPress plugin fails to verify payments with the payment provider when processing the return from a hosted checkout. Additionally, the plugin does not valida...

CVE-2026-81780-Hash-Form

CVE-2026-81780-Hash-Form CVE-2026-81780 — Hash Form RCE A Vulnerabilidade Upload de arquivo não autenticado no plugin Hash Form do WordPress ≤ 1.4.2. O plugin permite uploads arbitrários de arquivos sem autenticação adequada ou validação de tipo de arquivo, levando à Execução Remota de Código RCE...

CVE-2025-22510

CVE-2025-22510 1️⃣ Komponententyp WordPress-Plugin 2️⃣ Komponentendetails Komponentenname WC Price History for Omnibus Verwundbare Version Um dieses Plugin zu aktivieren, muss das WooCommerce-Plugin zuer...

CVE-2026-11961

CVE-2026-11961 CVE-2026-11961 के लिए मास एक्सप्लॉइट टूल जो WordPress User Registration & Membership प्लगइन को प्रभावित करता है। विशेषताएँ प्लगइन संस्करण का पता लगाना एकल लक्ष्य single target समर्थन बैच लक्ष्य प्रोसेसिंग मल्टी-थ्रेड समर्थन रैंडम या कस्टम क्रेडेंशियल HTTP/HTTPS प्रॉक्सी समर्थन...