276500 matches found
CVE-2026-66591
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WordPress plugin Media Library Assistant by David Lingren, affecting versions up to and including 3.39 . The flaw stems from improper neutralization of input during web page generation , allowing malicious scripts to be permanently s...
WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Media LIbrary Assistant versions = 3.39...
CVE-2026-66602 WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...
CVE-2026-66602
A CSRF vulnerability (CVSS 8.8, HIGH) affects the HashBar – WordPress Notification Bar plugin through version 2.0.0, discovered by Brian Willows. An attacker can force an authenticated admin to perform unintended actions (e.g., changing settings) via a crafted link. Exploitation evidence includes...
WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin HashBar – WordPress Notification Bar versions = 2.0.0...
CVE-2026-66603 WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
CVE-2026-66603
CVE-2026-66603 is a Stored XSS vulnerability in the WordPress plugin Draft List (simple-draft-list) by David Artiss, affecting versions through 2.6.4 . The root cause is improper neutralization of input during web page generation , allowing an attacker to persist a malicious script that executes ...
WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Draft List versions = 2.6.4...
wp2exp-2026
wp2exp2026 🔥 WordPress All-in-One Exploit Framework — Detector · Scanner · Enumerator · Exploit · Escalation wp2exp2026 is the rebranded, battle-tested successor of the wp2shell framework. It merges the original wp2shell checker/exploit chain, three public CVE-2026-63030 PoC kits Ch4120N,...
Exploit for CVE-2026-64638
CVE-2026-64638 // XSS2Shell Análisis técnico y matriz de mi...
WordPress StoreEngine plugin <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability
Authenticated Vendor+ Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability discovered by zickzick2 - Sejong University of cyber security student in WordPress Plugin StoreEngine versions = 2.1.1...
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ SSRF via proSol_url_validate vulnerability
Subscriber+ SSRF via proSolurlvalidate vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability
Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...
WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...
WordPress WPAdverts – Classifieds Plugin plugin <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Deva Parekh in WordPress Plugin WPAdverts versions = 2.3.2...
WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability
Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...
CVE-2026-19500
CVE-2026-19500 affects the Entries component of the Brainstorm Force SureForms WordPress plugin (versions below 2.12.3 ). The root cause is the absence of adequate limits on user-controlled form fields and submitted content during processing and rendering. A remote, unauthenticated attacker can s...
