CVE-2026-75971 ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the rumimporter function being registered on the WordPress core importstart action hook with ...

CVE-2026-75971

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin is vulnerable to privilege escalation in versions up to and including 4.9.4 . The root cause is the rum_importer() function registered on the import_start action hook without a plugin-owned capability check or allowlist filtering...

EUVD-2026-65461

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17587

My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is affected by an authorization bypass in all versions up to and including 3.3.6 . The root cause is missing access-control checks on the map_missing_cookie_shield and map_check_consent_mode_status AJAX actions, allowing...

CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

EUVD-2026-65464

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-75908

The Newsletters plugin for WordPress (all versions up to and including 4.17 ) is susceptible to an authorization bypass due to missing verification of user permissions. An authenticated attacker with author-level access or above can forge the newsletters_mailinglistsroles POST field during a norm...

CVE-2026-12277

CVE-2026-12277 Plugin Frontend File Manager WordPress = 23.6 – Eliminazione arbitraria di file non autenticata a RCE Riepilogo...

CVE-2023-22622

DoS WP-Cron - CVE-2023-22622 Exploit PoC Panoramica Questo repository contiene uno script che sfrutta la vulnerabilità CVE-2023-22622 in WordPress, causando una Denial of Service DoS tramite WP-Cron. Questo script può essere utilizzato per inondare un sito WordPress vulnerabile con richieste,...

CVE-2022-1329

WP Elementor 3.6.0/1/2 रिमोट कोड निष्पादन root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version...

wordpress_cve-2018-6389

wordpresscve-2018-6389 Tenta di sfruttare una vulnerabilità di WordPress CVE-2018-6389 che può essere utilizzata per causare un Denial of Service. ATTENZIONE: Questo software non esegue DoS su target vulnerabili; esegue una sola chiamata HTTP GET per verificare se la vulnerabilità è presente...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application Questa è un'applicazione vulnerabile per testare l'exploit del bypass di autenticazione di Really Simple Security 9.1.2 CVE-2024-10924. ATTENZIONE! Questa applicazione contiene gravi vulnerabilità di sicurezza. Eseguila a tuo...

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application Questa è un'applicazione vulnerabile per testare l'exploit per il controllo di accesso non corretto broken access control di Jetpack 13.9.1 CVE-2024-9926. ATTENZIONE! Questa applicazione contiene serie vulnerabilità di sicurezza...

CVE-2023-23488-PoC

CVE-2023-23488-PoC SQL Injection non autenticata - Paid Memberships Pro 2.9.8 Plugin WordPress Eseguendo questo script contro un'istanza WordPress con il plugin Paid Membership Pro ti dice se il target è vulnerabile. Poiché la tecnica di SQL injection necessaria per sfruttarla è Time-based blind,...

CVE-2026-76128

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-78576

The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append...

CVE-2026-78570

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

wp-user-registration-vuln-checker

वर्डप्रेस उपयोगकर्ता पंजीकरण जाँचकर्ता CVE-2026-1492 के लिए स्वामित्व वाली वर्डप्रेस साइटों के लिए केवल-पढ़ने योग्य जाँचकर्ता जो User Registration & Membership प्लगइन में CVE-2026-1492 से प्रभावित हो सकती हैं। यह साइट स्वामी को प्लगइन एक्सपोज़र की पुष्टि करने और छिपे हुए व्यवस्थापक खातों, संदिग्ध...

CVE-2022-1386

Beschreibung Fusion Builder ist ein WordPress-Plugin, das es Benutzern ermöglicht, Seiten per Drag-and-Drop zu erstellen und zu bearbeiten. Es ist anfällig für eine nicht authentifizierte SSRF, die einem Angreifer erlaubt, beliebige Dateien auf dem Server zu lesen. Beweis des Konzepts Anfrage:...