CVE-2026-105397

The LearnPress plugin for WordPress (versions through 4.4.9.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of input sanitization in the update_question AJAX handler , which allows authenticated users with the Instructor role to inject malicious scripts v...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Jitlada in WordPress Plugin Builderius versions = 1.4-beta...

WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...

WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...

WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Real 3D FlipBook versions = 5.5...

CVE-2024-10924

CVE-2024-10924 Really Simple Security Free, Pro e Pro Multisite 9.0.0 – 9.1.1.1 – Bypass dell'autenticazione Descrizione I plugin Really Simple Security Free, Pro e Pro Multisite per WordPress sono vulnerabili al bypass dell'autenticazione nelle versioni dalla 9.0.0 alla 9.1.1.1. Ciò è dovuto a u...

WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by wackydawg in WordPress Plugin Meta Box AIO versions = 3.7.1...

CVE-2024-10924

POC per CVE-2024-10924 Una falla nella gestione degli errori nell'API REST del plugin WordPress Really Simple Plugins versioni comprese tra 9.0.0 e 9.1.1.1 incluse permette a un attaccante, quando l'autenticazione a due fattori è abilitata, di bypassare l'autenticazione e prendere il controllo di...

CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Authentifiziert Abonnent+ PHP-Objekt-Injection Beschreibung Das ARPrice-Plugin für WordPress ist in Versionen bis einschließlich 4.0.3 anfällig für PHP-Objekt-Injection über die Deserialisierung nicht vertrauenswürdiger Eingaben. Dadurch ist es authentifizierten...

hdwebmobile-booking-appointments

HDWebmobile Buchung & Termine Verkaufen Sie buchbare Dienstleistungen und Termine über WooCommerce, mit einer Kapazität pro Zeitfenster, die niemals überbucht werden kann. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Erfordert: WordPress 6.9+, WooCommerce, PHP 7....

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI a RCE Esecuzione remota di codice non autenticata in Backup Migration Plugin WordPress. Esecuzione $ python exploit.py Il seguente script PHP viene eseguito. out.txt; ? Riferimenti Trovata esecuzione remota di codice non autenticata critica nel plugin Backup Migration...

CVE-2025-2294

Kubio Page Builder LFI-Exploit CVE-2025-2294 Local File Inclusion LFI-Exploit für das WordPress-Plugin Kubio Page Builder Versionen ≤ 2.5.1. 📌 Beschreibung Dieses Tool nutzt eine unauthentifizierte LFI-Schwachstelle im Plugin Kubio Page Builder CVE-2025-2294 aus, die es Angreifern ermöglicht,...

CVE-2024-9047-Exploit

CVE-2024-9047: Exploit per il plugin WordPress File Upload Descrizione Il plugin WordPress File Upload per WordPress è vulnerabile a una vulnerabilità di Path Traversal in tutte le versioni fino alla 4.24.11 inclusa, tramite il file wfufiledownloader.php. Questa vulnerabilità consente a un...

CVE-2024-3867

CVE-2024-3867 Questa repository ti mostra alcune informazioni su questa vulnerabilità, che è stata trovata da me. Ecco la descrizione ufficiale fornita: Il tema archive-tainacan-collection per WordPress è vulnerabile a Cross-Site Scripting riflesso a causa dell'uso di addqueryarg senza un adeguat...

CVE-2024-9796

CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - Injeção SQL não autenticada Descrição A injeção SQL do PoC irá extrair usuários e hashes do WordPress. Aviso: Este script é apenas para uso educacional. Não o utilize para fins ilegais. Se o fizer, é de sua total responsabilidade; não me responsabilizo p...

test-task-CVE-2024-25600

tarefa-teste-CVE-2024-25600 Repositório para a tarefa-teste de estágio. Passo 0: Clonar este repositório git git clone https://github.com/Sibul-Dan-Glokta/test-task-CVE-2024-25600 Passo 1: Criar contêineres Docker Iniciar o daemon Docker sudo systemctl start docker.service Iniciar os Contêineres...

CVE-2019-11223

CVE-2019-11223 Caricamento Arbitrario di File nel Plugin Wordpress SupportCandy Versione 2.0 e Inferiori https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/ https://wordpress.org/plugins/supportcandy/developers...

WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ratchanon Chamnankit in WordPress Plugin WP Event Solution versions = 4.1.25...