WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Theme Doctreat versions = 1.7.0...

WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Security & Malware scan by CleanTalk versions = 2.189...

WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by dodoh4t in WordPress Plugin WPBase Cache versions = 5.5.6...

WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina – Charts and Graphs For Elementor versions = 3.1.12...

WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Buddyboss Platform versions = 3.1.0...

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-31 Technical...

WordPress The7 theme <= 14.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Theme The7 versions = 14.2.2...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...

WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Challan versions = 3.7.88...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...

WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jamaal ahmed in WordPress Plugin ARForms versions = 7.1.2...

CVE-2021-24545

CVE-2021-24545 This is an XSS vulnerability discovered in a plugin that is no longer distributed as a plugin. WordPress Plugin HTML Author Bio description XSS This vulnerability is caused by improper validation of the description parameter in /wp-admin/profile.php. A remote attacker can exploit...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Kim Sang HPT Vietnam in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.6...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction This repository contains a Proof of Concept PoC for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability,...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.7.1...

CVE-2026-105397

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2021-3493_CVE-2022-3357

NOTE 1. This is a GitHub repository containing source code and research information about 2 CVEs: CVE-2021-3493 and CVE-2022-3357, respectively a CVE allowing privilege escalation and a CVE allowing RCE intrusion. If we combine these two CVEs, we can infiltrate a WordPress server and if that serv...

CVE-2026-8732-PoC

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation English | Türkçe English Overview CVE-2026-8732 is a critical vulnerability CVSS 9.8 in the WP Maps Pro wp-google-map-gold WordPress plugin version = 6.1.0. Unauthenticated attackers can create WordPress administrator accounts by abusing...