CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-82212

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82211

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details...

CVE-2026-105322

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

CVE-2026-105316

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

CVE-2026-104953

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

CVE-2026-104678

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2026-104049

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of pai...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attacker...

CVE-2026-103681

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

CVE-2016-15041-mainwp-dashboard

CVE-2016-15041 Lab - MainWP Dashboard Stored XSS Vulnerable lab for CVE-2016-15041: Unauthenticated stored XSS in MainWP Dashboard WordPress plugin = 3.1.2. Quickstart docker compose up -d --build Wait 30 seconds for auto-setup. The lab prints a banner when ready: docker compose logs -f wordpress...

cve-2019-14206-poc

CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File Deletion 📋 Index 1. About the Vulnerability 2. Prerequisites 3. Installation 4. Testing Methods Quick Test Full Test with Docker Test with Nuclei Manual Test 5. Interpreting Results 6. Cleanup 7. Troubleshooting 8. Mitigation 9. Legal...

CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

EUVD-2026-94194

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site mail relay...

EUVD-2026-94193

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...

CVE-2026-86833 MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...

CVE-2025-62950-PoC

الوصف يصف إثبات المفهوم هذا PoC ثغرة تزوير الطلبات عبر المواقع CSRF الموجودة في إضافة Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. تسمح هذه المشكلة للمهاجم بخداع مستخدم مُصادَق لتنفيذ طلب مُصمَّم يحذف عنصر معرض دون موافقته وعن غير قصد، مما يؤدي إلى فقدان محتوى بشكل غير...

CVE-2025-4094-POC

تجاوز OTP لملحق ووردبريس Digits CVE-2025-4094 نظرة عامة هذا النص البرمجي هو استغلال لملحق ووردبريس Digits الإصدارات -p -i OPTIONS الوسائط -u, --url: مطلوب عنوان URL الهدف مثال: https://example.com/wp-admin/admin-ajax.php -p, --phone: مطلوب رقم الهاتف المستهدف أرقام فقط -i, --instance-id: مطلوب مع...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-87782 Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...