CVE-2025-2539

CVE-2025-2539 PoC Exploit di lettura arbitraria di file non autenticato per WordPress File Away Plugin ≤ 3.9.9.0.1 📖 Descrizione Questo script Python è un exploit proof-of-concept PoC per CVE-2025-2539 , che sfrutta una vulnerabilità nel WordPress File Away Plugin ≤ 3.9.9.0.1. La vulnerabilità...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Bypass dell'autenticazione Descrizione: Il plugin Wechat Social login per WordPress è vulnerabile al bypass dell'autenticazione nelle versioni fino alla 1.3.0 inclusa. Ciò è dovuto a una verifica insufficiente dell'utente fornito durante il login social...

CVE-2019-17234b-Exploit

Vulnerabilità del plugin Wordpress IgniteUp Il plugin Wordpress IgniteUp v3.4 e versioni precedenti consente a utenti remoti non autenticati di eliminare potenzialmente qualsiasi file sul server web di destinazione, causando possibilmente un attacco Denial of Service. Cronologia CVE-2019-17234 La...

EUVD-2026-65167

Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

EUVD-2026-65169

Unauthenticated PHP Object Injection in WP Project Manager = 4.0.6 versions...

EUVD-2026-65173

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

EUVD-2026-65165

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

VulnCheck KEV: CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

PT-2026-81218

Name of the Vulnerable Software and Affected Versions NotificationX Pro versions prior to 3.1.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on...

PT-2026-81217

Name of the Vulnerable Software and Affected Versions Verdure Core versions prior to 1.3 Description The Verdure Core plugin for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of PH...

PT-2026-81273

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-81497

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.2 Description An unauthenticated attacker can retrieve a plaintext password-reset URL via the trp get translations regular AJAX endpoint, enabling the takeover of any administrator account. This issue affec...

PT-2026-81266

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-81177

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.4.3 Description An issue exists that allows unauthenticated attackers to elevate their privileges to those of an administrator. Recommendations Update Jawn to a version newer than 1.4.2...

PT-2026-81176

Name of the Vulnerable Software and Affected Versions WP Project Manager Pro versions prior to 4.0.2 Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL...

PT-2026-81165

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-81271

The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

PT-2026-81248

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-81250

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...