307705 matches found
Wordpress-cve-CVE-2022-21661
Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...
CVE-2025-10897
CVE-2025-10897 WooCommerce는 웹사이트를 온라인 스토어로 전환해 주는 WordPress용 오픈소스 전자상거래 플러그인입니다. WooCommerce Designer Pro는 JMA Plugins에서 개발한 WordPress 플러그인으로, 고객이 WooCommerce 스토어에서 직접 제품을 디자인하고 맞춤 설정할 수 있게 해 줍니다. 중요 : WooCommerce와 WooCommerce Designer Pro는 완전히 다른 제품입니다. WooCommerce Designer Pro는 명함, 엽서, 전단지, 포스터...
CVE-2026-14483
CVE-2026-14483 — WPL 부동산 RCE Realtyna WPL Real Estate Listing WordPress 플러그인에 대한 인증되지 않은 원격 코드 실행. 필드| 세부정보 ---|--- CVE| CVE-2026-14483 영향받는 버전| 기본적으로 스크립트는 WPL 5.2.0 을 실행 중인 대상만 공격합니다. 재정의하려면 --force를 사용하세요. 이미지 취약점 요약 1. 자격 증명 유출 — 기본 apikey / apisecret이 공개 SQL 마이그레이션 덤프를 통해 노출됩니다. 2. 인증되지 않은 업...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 This repository contains a Proof of Concept PoC script for exploiting a privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin. The vulnerability, identified as CVE-2024-28000 , allows unauthenticated users to gain...
CVE-2026-5718-Lab
CVE-2026-5718 Local Docker Lab Local-only vulnerable vs patched Docker lab for CVE-2026-5718 , affecting the WordPress plugin Drag and Drop Multiple File Upload for Contact Form 7. This lab demonstrates the difference between the vulnerable version 1.3.9.6 and the patched version 1.3.9.7 using a...
CVE-2026-5118
CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...
CVE-2024-50491
CVE-2024-50491 RSVP ME = 1.9.9 - 인증되지 않은 SQL 인젝션 설명 WordPress용 RSVP ME 플러그인은 1.9.9를 포함한 이하 버전에서 사용자가 제공한 매개변수에 대한 이스케이프 처리 부족과 기존 SQL 쿼리에 대한 사전 준비 부족으로 인해 SQL 인젝션에 취약합니다. 이를 통해 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 덧붙여 데이터베이스에서 민감한 정보를 추출할 수 있게 됩니다. 세부 정보 유형 : 플러그인 슬러그 : rsvp-me 영향받는 버전 : 1.9.9 CVSS 점수 ...
CVE-2026-6433
CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance Item| Detail ---|--- Vector| Unauthenticated SQLi tunneled through plugin...
WordPress FileOrganizer plugin < 1.2.1 - DOM-based XSS vulnerability
DOM-based XSS vulnerability discovered by Mutantgun in WordPress Plugin FileOrganizer versions 1.2.1...
WordPress Bluff Post plugin <= 1.1.1 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Bluff Post versions = 1.1.1...
WordPress SPS-Suite plugin <= 1.4.0 - Unauthenticated Time-Based SQLi vulnerability
Unauthenticated Time-Based SQLi vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin SPS-Suite versions = 1.4.0...
CVE-2026-9018
CVE-2026-9018 CVE-2026-9018 — Easy Elements for Elementor ≤ 1.4.5 | 인증되지 않은 권한 상승 연구자: Atomic Edge 심각도: 높음 | CVSS: 8.8 | 인증 필요: 없음 개요 인증되지 않은 권한 상승 취약점이 Easy Elements for Elementor – Addons & Website Templates WordPress 플러그인버전 ≤ 1.4.5에 존재합니다. wpajaxnopriveelregister AJAX 핸들러를 통해 노출된...
WordPress Post Voting System plugin <= 1.0 - Subscriber+ SQLi vulnerability
Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Post Voting System versions = 1.0...
CVE-2025-22785
CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...
WordPress Testimonials Widget plugin <= 4.0.4 - Unauthenticated Arbitrary Post Update vulnerability
Unauthenticated Arbitrary Post Update vulnerability discovered by Naiches in WordPress Plugin Testimonials Widget versions = 4.0.4...
WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ SQLi vulnerability
Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...
CVE-2026-48866
--- ┌───────────────────────────────────────────────────────────┐ │ │ │ C V E - 2 0 2 6 - 4 8 8 6 6 │ │ │ │ Gravity Forms Path Traversal → Arbitrary File Deletion │ │ │ └───────────────────────────────────────────────────────────┘ gformuploadedfiles принимает ../ в URL. Кл...
WordPress Ad Inserter plugin 2.8.12-2.8.18 - Subscriber+ RCE / Stored XSS vulnerability
Subscriber+ RCE / Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Ad Inserter versions 2.8.12-2.8.18...
CVE-2026-8181-Lab
CVE-2026-8181 — Burst Statistics Authentication Bypass Lab Local-only Docker lab for CVE-2026-8181 , an authentication bypass in the WordPress plugin Burst Statistics – Privacy-Friendly WordPress Analytics. This lab compares a vulnerable plugin version against the patched version and uses a...