CVE-2026-97341: Improper Neutralization of Input During Web Page Generation

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-92923: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

CVE-2026-80517: Improper Neutralization of Input During Web Page Generation

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...

CVE-2026-93896: Improper Neutralization of Input During Web Page Generation

The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path writedebuglogs reflecting the raw value of $SERVER'REQUESTURI' through vprintf directly inside a...

Fedora 44 : wordpress (2026-7f9c69a63c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7f9c69a63c advisory. WordPress 6.9.9 Security Release Security updates included in this release - Unauthenticated path traversal in page-template resolution leading to conditiona...

CVE-2026-103421: Improper Neutralization of Input During Web Page Generation

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI path segment after /androidjson/search/' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This make...

CVE-2026-92551: Improper Neutralization of Input During Web Page Generation

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppressbillingaddress Filename Parameter in all versions up to, and including, 4.17.4 due to insufficie...

CVE-2026-96962: Exposure of Sensitive Information to an Unauthorized Actor

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

CVE-2026-96575: Improper Neutralization of Input During Web Page Generation

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...

CVE-2025-12828: Improper Neutralization of Input During Web Page Generation

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2026-101161: Uncontrolled Resource Consumption

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...

CVE-2026-92826: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-18464

CVE-2026-18464 — WP Maps Pro 이 저장소는 이미 공개된 취약점에 대한 기술 참고 자료로 제공됩니다. 무기화된 서비스 거부 스크립트는 포함하지 않습니다. 개요 항목| 세부 정보 ---|--- CVE| CVE-2026-18464 제품| WP MAPS PRO 영향받는 버전| 6.1.3 수정된 버전| 6.1.3 취약점 유형| CWE-400 — 제어되지 않은 리소스 소비 공격 요건| 인증되지 않은 원격 공격자 심각도| 7.5 CVSS 3.1 공개일| 2026-08-09 발견자| Mohammad Aghdasi CNA...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - 未認証の格納型クロスサイトスクリプティング プラグインURL https://wordpress.org/plugins/wp-stats/ 説明 statspage の statsauthor GET パラメータにおける未認証の反射型XSS。サニタイズフィルタ striptags が urldecode より前に適用されるため、攻撃者はペイロードを二重URLエンコードすることでこれをバイパスできる。 POC 1. WP-Stats プラグインをインストールして有効化する 2. pagestats...

CVE-2025-47646

CVE-2025-47646 PoC Эксплойт неавторизованного повышения привилегий для WordPress PSW Front-end Login Registration Plugin ≤ 1.12 📖 Описание Этот скрипт на Python является эксплойтом proof-of-concept PoC для CVE-2025-47646 , нацеленным на уязвимость в WordPress PSW Front-end Login Registration Plug...

CVE-2018-20463

CVE-2018-20463 В версии 1.07 плагина WordPress JSmol2WP существует уязвимость безопасности. Злоумышленник может использовать эту уязвимость для чтения произвольных файлов. Необязательные аргументы: -h, --help показать это справочное сообщение и выйти -u url, --url url Целевой URL, например:...

CVE-2026-78006-POC

CVE-2026-78006-POC CVE-2026-78006 The Events Calendar !IMPORTANT 이 저장소와 함께 현재 공개된 연구 PoC는 내부적으로 = 6.1...

CVE-2025-25101

🚀 CVE-2025-25101 - Плагин Munk Sites для WordPress = 1.0.7 - CSRF для произвольной установки плагинов 📌 Обзор CVE-2025-25101 — это уязвимость Межсайтовой подделки запроса CSRF в плагине MetricThemes Munk Sites для WordPress версии ≤ 1.0.7. Эта уязвимость позволяет неаутентифицированному...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e Этот модуль требует Metasploit: https://metasploit.com/download Текущий источник: https://github.com/rapid7/metasploit-framework...

CVE-2025-6058

⚡ WPBookit = 1.0.4 - Неаутентифицированная произвольная загрузка файлов 📝 Описание Плагин WPBookit для WordPress уязвим к произвольной загрузке файлов из-за отсутствия проверки типа файла в функции imageuploadhandle, которая подключается через маршрут addbookingtype во всех версиях вплоть до 1.0....