CVE-2026-104652

The Envira Gallery WordPress plugin, in versions prior to 1.16.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize and escape a gallery item identifier before it is outputted into an image tag attribute . This allows users with the Author role ...

CVE-2026-104667

The Animated Number Counters WordPress plugin (versions before 3.1 ) is vulnerable to a second-order SQL injection (CWE-89). The root cause is the failure to sanitize or escape values stored by a user with Editor-level privileges before they are concatenated into a SQL query. This query is execut...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

EUVD-2026-94175

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

EUVD-2026-94174

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103378 Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103681

The Frontend Dashboard WordPress plugin (versions before 3.0.0 ) is vulnerable to an improper access control issue (CWE-284) in one of its AJAX actions . Specifically, the plugin fails to perform a necessary capability check , allowing authenticated users with low privileges, such as subscribers ...

CVE-2026-104049 Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2025-12721

g-FFL Cockpit 'returntrue'، مما يجعلها في متناول أي زائر غير مصادق عليه تمامًا. موجودة في class-sync-endpoint.php: 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue', // Public endpoin...

CVE-2024-10924

CVE-2024-10924 - تجاوز المصادقة في Really Simple Security نظرة عامة يعرض هذا المشروع استغلال وتخفيف تأثير CVE-2024-10924، وهي ثغرة حرجة في تجاوز المصادقة في إضافة WordPress "Really Simple Security". الخطوة 1: إعداد البيئة ابدأ بيئة WordPress المستضعفة: cd...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset

Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1. id: CVE-2023-32243 info: name: WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset author:...

NotificationX <= 2.8.2 - SQL Injection

The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and la...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

CVE-2025-3616

وحدة Metasploit: تحميل ملف عشوائي في إضافة Greenshift لووردبريس CVE-2025-3616 يحتوي هذا المستودع على وحدة Metasploit لاستغلال CVE-2025-3616 ، وهي ثغرة تحميل ملف عشوائي في إضافة Greenshift لووردبريس الإصدارات 11.4 حتى 11.4.5. تسمح هذه الثغرة للمستخدمين الموثقين مشترك فما فوق بتحميل ملفات عشوائية...

CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read

CVE-2025-2539 - قراءة ملف تعسفي في إضافة File Away لووردبريس 📋 ملخص تنفيذي CVE ID: CVE-2025-2539 Plugin: File Away الإصدارات = 3.9.9.0.1 Vulnerability Type: قراءة ملف تعسفي موثقة CVSS Score: 8.5 عالي Exploit Availability: PoC عام متاح Impact: كشف ملفات غير مصرح به بما في ذلك wp-config.php وبيانات...

PT-2026-107400

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

PT-2026-107416

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

PT-2026-107397

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

PT-2026-107398

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...