292858 matches found
CVE-2024-9162
CVE-2024-9162 All-in-One WP Migration and Backup SELECT optionname,optionvalue FROM wpoptions WHERE optionname='ai1wmsecretkey'; +------------------+--------------+ | optionname | optionvalue | +------------------+--------------+ | ai1wmsecretkey | PwrqqK3UHQJo | +------------------+-------------...
WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.14...
WordPress Fancy Product Designer plugin <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Fancy Product Designer versions = 6.5.2...
CVE-2026-13158
CVE-2026-13158: Everest Toolkit = 1.2.3 — Admin+ Arbitrary File Upload to Remote Code Execution RCE 📖 Advisory Overview CVE-2026-13158 is an authenticated Admin+ arbitrary file upload vulnerability affecting the Everest Toolkit WordPress plugin prior to and including version 1.2.3, discovered and...
WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin AMP for WP versions = 1.1.16...
WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Coopernicus in WordPress Plugin WPDM – Premium Packages versions = 7.2.1...
CVE-2026-80514
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...
CVE-2026-88848
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...
CVE-2024-0757-Exploit
CVE-2024-0757 Exploit Descripción El plugin Insert or Embed Articulate Content into WordPress para WordPress es vulnerable a subidas arbitrarias de archivos a través de subidas inseguras de archivos en un archivo zip en todas las versiones hasta, e incluyendo, la 4.3000000023. Esto permite que...
CVE-2026-13156
CVE-2026-13156 — MailerSend Official SMTP Integration !IMPORTANT Abstract: A High-Severity Cross-Site Request Forgery CSRF vulnerability CVE-2026-13156 was discovered in the official MailerSend SMTP Integration plugin for WordPress 1.0.8. The configuration eradication handler...
CVE-2019-14314
CVE-2019-14314 CVE-2019-14314 - NextGEN Gallery 3.2.10 Inyección SQL autenticada Uso root@kitploit: usage: cve201914314.py -h url loginuser loginpass username CVE-2019-14314 Hash Extractor positional arguments: url Wordpress blog URL loginuser Username to login with loginpass Password to login wi...
WordPress BA Book Everything plugin <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BA Book Everything versions = 1.8.27...
WordPress wpForo Forum plugin <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin wpForo Forum versions = 3.1.6...
CVE-2025-6934
CVE-2025-6934 – Explotación de WordPress Opal Estate Pro 📖 Descripción Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2025-6934 , una vulnerabilidad crítica en el Plugin de WordPress: Opal Estate Pro = 1.7.5, que permite la creación de cuentas de administrador sin...
WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin GeoDirectory versions = 2.8.181...
setup-wordpress-with-security-best-practice
Configurar WordPress con Prácticas Recomendadas de Seguridad Este documento está redactado con el objetivo de ser adecuado para aplicaciones web desarrolladas con WordPress que no interactúan con usuarios. Está destinado principalmente a páginas corporativas de marca, vistas estáticas diversas,...
CVE-2021-38314
Exploit en Python para CVE-2021-38314 Detalle El plugin Gutenberg Template Library & Redux Framework Ejemplo PoC - https://youtu.be/n1e4aFmXvOk Enlaces CVE-2021-38314...
CVE-2023-6634
Script de Exploit CVE-2023-6634 Descripción Este repositorio contiene un script de Python diseñado para explotar la vulnerabilidad CVE-2023-6634 encontrada en el plugin LearnPress para WordPress, en versiones hasta la 4.2.5.7 inclusive. La vulnerabilidad permite la ejecución remota de código RCE...
CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...
