316276 matches found
WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina – Charts and Graphs For Elementor versions = 3.1.12...
WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dutafi in WordPress Plugin Buddyboss Platform versions = 3.1.0...
CVE-2026-3300
CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...
WordPress The7 theme <= 14.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bonds in WordPress Theme The7 versions = 14.2.2...
CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS
CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...
WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Challan versions = 3.7.88...
CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction
CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...
WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jamaal ahmed in WordPress Plugin ARForms versions = 7.1.2...
CVE-2021-24545
CVE-2021-24545 Es una vulnerabilidad XSS encontrada en un plugin cuya distribución ha sido suspendida. Vulnerabilidad XSS en la descripción del plugin HTML Author Bio de WordPress. Esta vulnerabilidad se debe a una validación inadecuada del parámetro description en /wp-admin/profile.php. Un...
CVE-2023-4800
CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Kim Sang HPT Vietnam in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.6...
CVE-2024-28000
PoC de Escalada de Privilegios en LiteSpeed Cache - CVE-2024-28000 🎤 Traducción del README Inglés فارسی 📸 Captura de pantalla 💎 Introducción Este repositorio contiene una Prueba de Concepto PoC para una vulnerabilidad crítica de escalada de privilegios descubierta en el plugin LiteSpeed Cache de...
WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.7.1...
CVE-2026-105397
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...
CVE-2021-3493_CVE-2022-3357
NOTE 1. This is a GitHub repository containing source code and research information about 2 CVEs: CVE-2021-3493 and CVE-2022-3357, respectively a CVE allowing privilege escalation and a CVE allowing RCE intrusion. If we combine these two CVEs, we can infiltrate a WordPress server and if that serv...
CVE-2026-8732-PoC
CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation English | Türkçe English Overview CVE-2026-8732 is a critical vulnerability CVSS 9.8 in the WP Maps Pro wp-google-map-gold WordPress plugin version = 6.1.0. Unauthenticated attackers can create WordPress administrator accounts by abusing...
WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Zein in WordPress Plugin Social Rocket versions = 1.3.5...
CVE-2025-2005
CVE-2025-2005 El Plugin Front End Users de WordPress = 3.2.32 es vulnerable a la subida de archivos arbitrarios Explotación del Plugin Front-End Users de WordPress Información de la Vulnerabilidad Nombre del Plugin : Front-End Users Plugin Versión Afectada : = 3.2.32 Tipo de Vulnerabilidad : Subi...