WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

CVE-2026-19856

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by ashv4ni in WordPress Theme Wallstreet versions = 2.8.6...

WordPress WPC Estimated Delivery Date for WooCommerce plugin <= 4.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPC Estimated Delivery Date for WooCommerce versions = 4.0.1...

EUVD-2014-9822

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130

The CodeArt Google MP3 Audio Player plugin for WordPress (versions through 1.0.11 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. This flaw exists due to a path-traversal vulnerability in the file parameter of the direct_download.php file. Remote attackers can exploit thi...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2026-19856

The All in One SEO WordPress plugin versions prior to 5.0.2.1 contains a vulnerability where it fails to correctly identify which shortcodes are present in content derived from user input before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on t...

CVE-2026-19856 All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

EUVD-2026-91769

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

TryHack3M-Bricks-Heist

TryHack3M: Ограбление Bricks Эксплойт • Writeup • CTF-задача Полный репозиторий, содержащий собственный эксплойт и подробное описание прохождения задачи TryHack3M: Bricks Heist Быстрый старт • Структура репозитория • Эксплойт • Writeup • Отказ от ответственности Обзор В этом репозитории...

WP2Shell

WP2Shell — эксплойт RCE до аутентификации для WordPress CVE-2026-63030 + CVE-2026-60137 Версия: 4.0.0 Автор: G0D150NE 📌 Обзор WP2Shell — это инструмент, реализующий полную цепочку эксплуатации WordPress для удалённого выполнения кода RCE до аутентификации. Он объединяет две критические уязвимости...

CVE-2023-4596

CVE-2023-4596 PoC-скрипт для CVE-2023-4596: неаутентифицированное удалённое выполнение команд через произвольную загрузку файлов. Видео использования PoC Шаблон Nuclei Новостная статья WordFence NVD Nist Краткое описание Критическая уязвимость обнаружена в плагине WordPress Forminator, которая...

WordPress SEOPress – AI SEO Plugin & On-site SEO plugin <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin SEOPress versions = 10.2...

WordPress WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin <= 4.7.3 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by walid213 in WordPress Plugin Social Icons Widget & Block by WPZOOM versions = 4.7.3...

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: обход 2FA через привязанную к сессии блокировку OTP Обход аутентификации в плагине miniOrange Two-Factor Authentication для WordPress позволяет злоумышленнику, уже владеющему действующим паролем жертвы, неограниченно перебирать второй фактор, полностью...

CVE-2023-4634

CVE-2023-4634 RCE-эксплойт для плагина Wordpress Media-Library Plugin 3.10 CVE-2023-4634 Информация Patrowl обнаружила неаутентифицированную RCE-уязвимость в плагине Media-Librairy-Assistant для Wordpress версии 3.10. Эксплойт нетривиален и требует лишь небольшой настройки, описанной ниже. Общие...

WordPress Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Content Modification vulnerability discovered by Webbernaut in WordPress Plugin Download Alt Text AI versions = 1.10.41...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...