275523 matches found
CVE-2026-5118
CVE-2026-5118 — Divi Form Builder = 5.1.2 — Nicht authentifizierte Privilegienausweitung durch Rolleninjektion 🔥 Zusammenfassung der Sicherheitslücke Das WordPress-Plugin Divi Form Builder in Versionen = 5.1.2 ist anfällig für eine nicht authentifizierte Privilegienausweitung. Dieser kritische...
WordPress_Backup_Migration-RCE_Unauthenticated
CVE-2023-6553 — Plugin Backup Migration per WordPress - Reverse Shell Una versione estesa dell'exploit CVE-2023-6553 di Chocapikk che aggiunge una modalità reverse shell con un solo comando alla webshell interattiva originale. Vulnerabilità CVE-2023-6553 — Esecuzione remota di codice non...
sudowp-postgallery
SudoWP PostGallery Fork de Segurança Contribuidores: SudoWP, WP Republic Autores Originais: RTO GmbH Tags: galeria, segurança, corrigido, cve-2025-13543 Requer pelo menos: 5.8 Testado até: 6.7 Tag estável: 1.12.6 Licença: GPLv2 ou posterior Aviso de Segurança Este é um fork endurecido contra...
WordPress Betheme plugin <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'iconbox2' Shortcode vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Theme Betheme versions = 28.4...
WordPress Gutenverse plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Blocks vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Gutenverse versions = 4.0.2...
WordPress Mailgun for WordPress plugin <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) vulnerability
Unauthenticated Server-Side Request Forgery SSRF vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin Mailgun for WordPress versions = 2.2.0...
WordPress kk Star Ratings – Rate Post & Collect User Feedbacks plugin <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Ronnachai Sretawat Na Ayutaya Simonhaskelly in WordPress Plugin kk Star Ratings versions = 5.4.10.3...
sudowp-crowdsignal-forms
SudoWP Crowdsignal Forms Questo è un fork di sicurezza SudoWP del plugin originale Crowdsignal Forms. !WARNING Avviso di sicurezza : il plugin originale "Crowdsignal Forms" versioni = 1.7.2 contiene una vulnerabilità critica di autorizzazione mancante CVE-2025-69015 che consente a utenti...
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
A year ago we wrote that we'd put AI to work across the whole company, turning everyone on the team into a capable AI operator so our defenders could stay ahead of the threat actors attacking the sites we protect. In April we showed where it was heading: in the space of a few months, AI-assisted...
WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...
WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion vulnerability
Authenticated Administrator+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Manager versions = 7.3.7.4...
CVE-2023-6063-PoC
CVE-2023-6063 PoC Referenz Nicht authentifizierte SQL-Injection-Schwachstelle in WP Fastest Cache 1.2.2 behoben | WPScan Plugin-Einstellung Aktiviere "WP Fastest Cache". PoC Der Cookie-Parameter "wordpressloggedin" ist verwundbar. root@kitploit: $ python sqlmap.py --dbms=mysql -u...
CVE-2026-78468
The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...
WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability
Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...
CVE-2026-78468
FluentCRM Pro for WordPress (all versions up to and including 3.1.12 ) is vulnerable to SQL Injection caused by insufficient escaping of a user-supplied parameter and lack of sufficient preparation on an existing SQL query. An authenticated attacker with Author-level or higher access can append a...
CVE-2026-78468
...
EUVD-2026-65579
The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2025-3054-Exploit
CVE-2025-3054 الاستغلال: تحميل هنا التفاصيل معرف CVE : CVE-2025-3054 نشر : 5 يونيو 2025 CVSS : 8.8 التصحيح متوفر: لا يوجد تصحيح رسمي حتى الآن التأثير إضافة WP User Frontend Pro لـ WordPress معرضة لرفع الملفات بشكل عشوائي بسبب عدم التحقق من نوع الملف في دالة uploadfiles في جميع الإصدارات حتى الإصد...