CVE-2026-104409 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.13...

CVE-2026-15964-PoC

CVE-2026-15964 - Single Sign On For TNG = 2.0.0 Élévation de privilèges non authentifiée via un changement de mot de passe non vérifié dans le plugin WordPress Single Sign On For TNG. | ---|--- Gravité| Critique 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-620 Changement de mot de...

WordPress SaveTo Wishlist Lite plugin < 1.1.5 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SaveTo Wishlist Lite versions 1.1.5...

By-Poloss..-..CVE-2026-11551-PoC

CVE-2026-11551: Branda Plugin - Неаутентифицированное повышение привилегий через захват аккаунта Обзор CVE ID : CVE-2026-11551 CVSS Score : 9.8 Критический Затронуто : Branda – White Label & Branding = 3.4.29 Исправлено : 3.4.31 Опубликовано : 19 июня 2026 г. Описание уязвимости Плагин Branda для...

WordPress Unlimited Elements for Elementor plugin 1.5.142-2.0.20 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 1.5.142-2.0.20...

WordPress Loco Translate plugin < 2.8.9 - Translator+ Limited File Read vulnerability

Translator+ Limited File Read vulnerability discovered by Shivamani Vastrala in WordPress Plugin Loco Translate versions 2.8.9...

WordPress MPG plugin < 4.2.3 - Editor+ Arbitrary File Read vulnerability

Editor+ Arbitrary File Read vulnerability discovered by ieuns in WordPress Plugin MPG versions 4.2.3...

WordPress TillKit plugin < 1.0.5 - Unauthenticated POS Takeover vulnerability

Unauthenticated POS Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin TillKit versions 1.0.5...

CVE-2026-6279.py

الوصف هذا النص البرمجي بلغة Python هو أداة استغلال لـ CVE-2026-6279 تستهدف Avada Builder الإصدار 3.15.2 فما دون. السلوك الرئيسي: يقوم بمسح الأهداف بحثًا عن fusionloadnonce عبر أنماط shortcode/صفحات خاصة بـ Avada يكتشف نقطة نهاية AJAX وتجاوز عنوان IP الأصلي إذا كان Cloudflare يحظر admin-ajax يبني...

CVE-2024-13869

CVE-2024-13869 Migration, Sauvegarde, Staging – WPvivid 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever...

CVE-2025-6934

CVE-2025-6934 escalade de privilèges non authentifiée dans Opal Estate Pro Description CVE-2025-6934 est une vulnérabilité critique dans le plugin WordPress Opal Estate Pro ≤ v1.7.5. Ce bogue permet à un attaquant non authentifié de créer un nouveau compte administrateur en envoyant une requête...

CVE-2024-28000-Exploit-Lab

CVE-2024-28000 — Laboratoire WordPress LiteSpeed Cache Reproduction autorisée en laboratoire local de CVE-2024-28000 , un problème d'élévation de privilèges sans authentification affectant les versions vulnérables du plugin WordPress LiteSpeed Cache. Portée : Ce dépôt documente des tests effectué...

CVE-2025-12674

CVE-2025-12674 KiotViet Sync = 1.8.5 - Téléchargement arbitraire de fichier non authentifié 🐚 KiotViet Sync = 1.8.5 - Téléchargement arbitraire de fichier non authentifié 📝 Description Le plugin KiotViet Sync pour WordPress versions jusqu'à et y compris 1.8.5 est vulnérable aux téléchargements...

CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-13607

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-78371

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

Wp2Shell

wp2shell Выполнение произвольного кода в ядре WordPress до аутентификации. CVE-2026-60137 SQL-инъекция в WPQuery в связке с CVE-2026-63030 путаница маршрутов в REST API Batch. Только для образовательных целей и санкционированных исследований безопасности. Затронутые версии Уязвимы WordPress...

CVE-2026-84169 UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin, affecting versions through 1.4.3 , contains a vulnerability where it fails to verify if a payment-confirmation request belongs to the specific order and customer it claims to confirm. This lack of authorization allows unauthenticated attackers to ...