CVE-2026-78568

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

CVE-2026-77142

CVE-2026-77142 is a Broken Access Control vulnerability in the TYPO3 extension Industry Directory (yellowpages2) . The frontend self-service editing feature hides the edit form using a template-level visibility flag for company records a visitor does not own, but the corresponding server-side wri...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT Es gab einen Fehler im WordPress-Plugin Email Subscribers & Newsletters vor Version 4.3.1, der es ermöglichte, SQL-Anweisungen über den Hash-Parameter an die Datenbank zu übergeben eine blinde SQL-Injection-Schwachstelle. Dieses Skript ist eine „bereinigte Version“ des...

CVE-2025-14172-Nuclei-Template

📄 Template Nuclei per CVE-2025-14172 🚀 Panoramica Questo repository contiene un template Nuclei specificamente progettato per rilevare una vulnerabilità di autorizzazione mancante CVE-2025-14172 nel plugin WordPress WP Page Permalink Extension. Questo problema consente ad attaccanti autenticati d...

CVE-2024-6205

CVE-2024-6205 pip install requests Questo è un PoC scritto in Python per una vulnerabilità recente in un plugin di WordPress. Ulteriori informazioni su questo qui https://nvd.nist.gov/vuln/detail/CVE-2024-6205 https://cvefeed.io/vuln/detail/CVE-2024-6205...

CVE-2026-8809

CVE-2026-8809 Advanced Custom Fields: Extended = 0.9.2.5 - Unauthentifizierte Privilegieneskalation durch Validierungs-Bypass zum 'acfpostid'-Parameter Diese kritische Sicherheitslücke CVSS 9.8 betrifft alle Versionen des beliebten WordPress-Plugins Advanced Custom Fields: Extended ACF Extended a...

ODH-BricksBuilder-CVE-2024-25600-THM

ODH-BricksBuilder-CVE-2024-25600-THM Übersicht Dieses Repository enthält einen in Python entwickelten Schwachstellenscanner von Oblivion Development & Hosting OD&H zur Erkennung von CVE-2024-25600 im Bricks Builder Plugin für WordPress. Dieses Tool ist hauptsächlich für die Verwendung in Try Hack...

cve-2022-1609-exploit

cve-2022-1609-exploit Exploit para CVE-2022-1609 WordPress Weblizar Backdoor...

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78566 Shuffle <= 1.8 - Unauthenticated Local File Inclusion

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.8 . An unauthenticated attacker over the network can include and execute arbitrary files on the server, enabling execution of any PHP code contained in those files. This may be used to bypa...

CVE-2026-78562

CVE-2026-78562 is a Local File Inclusion (LFI) vulnerability in the Verdure Core plugin for WordPress, affecting all versions up to and including 1.2 . An unauthenticated attacker can include and execute arbitrary files on the server, enabling PHP code execution in files already present (e.g., up...

EUVD-2026-65324

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

CVE-2026-78568 Total Donations <= 2.0.5 - Unauthenticated SQL Injection

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2026-78568

The Total Donations plugin for WordPress is vulnerable to unauthenticated SQL Injection in all versions up to and including 2.0.5 . The root cause is insufficient escaping on a user-supplied parameter combined with lack of sufficient preparation on the existing SQL query, allowing an attacker to ...

CVE-2026-78563

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.1.4 , caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute whenev...

CVE-2026-78563 NotificationX Pro <= 3.1.4 - Unauthenticated Stored Cross-Site Scripting

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

EUVD-2026-65323

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...