WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by etomixer in WordPress Plugin Youzify versions = 1.3.7...

wordpress-cve-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE Pre-authentication, unauthenticated, no plugins required. Works against a stock WordPress install via the REST API batch endpoint. | ---|--- CVE| CVE-2026-63030 route confusion → RCE + CVE-2026-60137 SQLi GHSA| GHSA-ff9f-jf42-662q ·...

WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by duna in WordPress Plugin Document Gallery versions = 5.1.1...

CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Escalation dei privilegi non autenticata ad Amministratore 🔗 Rimani Aggiornato Per le ultime zero-day, exploit e ricerche sulla sicurezza 📋 Panoramica della vulnerabilità Attributo| Dettagli ---|--- CVE ID| CVE-2026-18366 Gravità| 🔴 CRITICA CVSS 9.8 Plugin|...

CVE-2018-6389

CVE-2018-6389 Wordpress Exploit CVE-2018-6389 Exploit Can Down Any Wordpress site under 4.9.3 The flaw affects the load-scripts.php WordPress script, it receives a parameter called load About PoC A simple Script In Python With threading could allow anyone to take down most WordPress websites with...

WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Coopernicus in WordPress Plugin Gmedia Photo Gallery versions = 1.25.1...

WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Coopernicus in WordPress Plugin Hotel Booking versions = 3.8...

WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Captcha by BestWebSoft versions = 5.2.8...

WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Doctreat Core versions = 1.7.0...

WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

WordPress JobZilla - Job Board WordPress Theme theme = 2.2 - Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Theme JobZilla - Job Board WordPress Theme versions = 2.2...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Tabs versions = 2.5...

WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin VikRentCar versions = 1.4.7...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Theme Doctreat versions = 1.7.0...

WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Security & Malware scan by CleanTalk versions = 2.189...

WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by dodoh4t in WordPress Plugin WPBase Cache versions = 5.5.6...

WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina – Charts and Graphs For Elementor versions = 3.1.12...

WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Buddyboss Platform versions = 3.1.0...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...