316294 matches found
WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Taylsec in WordPress Plugin Simple JWT Login versions 4.0.0...
CVE-2018-6389
CVE-2018-6389 Exploit CVE-2018-6389 Checker — a small, non‑destructive Python tool that checks for indicators of the CVE‑2018‑6389 WordPress vulnerability by issuing three controlled load-scripts.php requests and analysing response size, timing and JS token patterns. ⚠️ Disclaimer Use this tool...
CVE-2023-5412
CVE-2023-5412 Image horizontal reel scroll slideshow = 13.2 - Authenticated Subscriber+ SQL Injection via Shortcode Description: The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to...
WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by etomixer in WordPress Plugin Youzify versions = 1.3.7...
wordpress-cve-2026-63030
WordPress REST API Batch Route Confusion + SQL Injection → RCE Pre-authentication, unauthenticated, no plugins required. Works against a stock WordPress install via the REST API batch endpoint. | ---|--- CVE| CVE-2026-63030 route confusion → RCE + CVE-2026-60137 SQLi GHSA| GHSA-ff9f-jf42-662q ·...
WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by duna in WordPress Plugin Document Gallery versions = 5.1.1...
CVE-2026-18366
CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Privilege Escalation to Administrator 🔗 Stay Updated For the latest zero-days, exploits, and security research 📋 Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-18366 Severity| 🔴 CRITICAL CVSS 9.8 Plugin| Events Manager for...
CVE-2018-6389
CVE-2018-6389 Wordpress Exploit CVE-2018-6389 Exploit Can Down Any Wordpress site under 4.9.3 The flaw affects the load-scripts.php WordPress script, it receives a parameter called load About PoC A simple Script In Python With threading could allow anyone to take down most WordPress websites with...
WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Coopernicus in WordPress Plugin Gmedia Photo Gallery versions = 1.25.1...
WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Coopernicus in WordPress Plugin Hotel Booking versions = 3.8...
WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Captcha by BestWebSoft versions = 5.2.8...
WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Doctreat Core versions = 1.7.0...
WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability
WordPress JobZilla - Job Board WordPress Theme theme = 2.2 - Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Theme JobZilla - Job Board WordPress Theme versions = 2.2...
CVE-2022-0441
A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...
WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Tabs versions = 2.5...
WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin VikRentCar versions = 1.4.7...
wp2shell
wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...
WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Theme Doctreat versions = 1.7.0...
WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Security & Malware scan by CleanTalk versions = 2.189...