EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

CVE-2026-92536 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false при обработке загрузки. Аутентифицированный пользователь, обладающий правами импорта — например, администратор сайта по умолчанию или администратор сайта, не являющийся суперадминистратором, в архитектуре WordPress Multisite — может обойти ограничения на...

CVE-2024-24135

CVE-2024-24135 : Inventaire de produits avec export vers Excel - Cross-Site-Scripting Preuve de conceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24135.md Preuve de conceptPoC : https://github.com/BurakSevben/CVE-2024-24135/blob/main/CVE-2024-24135.md...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server: недоверенный @-заголовок → подмена внутренних метаданных CVSS 10.0 критический · CWE-20 · GHSA-jrh6-9hgv-mqm7 Краткое описание Apache Traffic Server резервирует заголовки с префиксом @ @Ats-Internal, @ICAP-Status, @TCPInfo, ... для внутренних метаданных : о...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Preuve de concept Ceci est un exploit de preuve de concept PoC pour CVE-2023-3124, une vulnérabilité dans le plugin Elementor Pro de WordPress. Description: Le plugin Elementor Pro pour WordPress est vulnérable à une modification non autorisée des données en raison d'u...

CVE-2024-49668

🚨 CVE-2024-49668: WordPress Verbalize WP 플러그인 임의 파일 업로드 취약점 📋 개요 CVE-2024-49668 은 WordPress Verbalize WP 플러그인 버전 1.0 이하에서 발견된 심각한 취약점입니다. 이 취약점은 인증되지 않은 공격자가 웹 서버에 웹 셸을 포함한 임의의 파일을 업로드할 수 있게 합니다. 문제는 파일 업로드 시 충분한 입력 검증 및 파일 형식 제한이 부족하기 때문에 발생합니다. 세부 정보 게시일: 2024-10-23 업데이트일: 2024-10-23 제목:...

WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution

WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supportedtype to php% and uploading a .php% file. id: CVE-2020-12800 info: name: WordPress Contact Form 7 1.3.3.3 - Remote Code Execution author: dwisiswant0 severity: critical description...

WP Fastest Cache 1.2.2 - SQL Injection

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. id: CVE-2023-6063 info: name: WP Fastest Cache 1.2.2 - SQL Injection author: DhiyaneshDK...

WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive...

WordPress Google Maps <7.11.18 - SQL Injection

WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute...

CVE-2026-15253

CVE-2026-15253 Easy Media Replace = 0.2.0 - Аутентифицированное Author+ хранимое межсайтовое выполнение сценариев Описание Плагин Easy Media Replace уязвим к хранимому межсайтовому выполнению сценариев XSS через заголовок медиавложения. Когда Author переименовывает медиафайл, используя XSS-полезн...

[SECURITY] Fedora 45 Update: xmms2-0.9.7-9.fc45

XMMS2 is an audio framework, but it is not a general multimedia player - it will not play videos. It has a modular framework and plugin architecture for audio processing, visualisation and output, but this framework has not been designed to support video. Also the client-server design of XMMS2 an...

[SECURITY] Fedora 45 Update: xfce4-weather-plugin-0.12.0-2.fc45

A weather plugin for the Xfce panel. It shows the current temperature and weather condition, using weather data provided by xoap.weather.com...

[SECURITY] Fedora 45 Update: vim-syntastic-3.10.0-32.fc45

Syntastic is a syntax checking plugin that runs files through external syntax checkers and displays any resulting errors to the user. This can be done on demand, or automatically as files are saved. If syntax errors are detected, t he user is notified and is happy because they didn't have to...

[SECURITY] Fedora 45 Update: evolution-rspam-0.6.0-67.fc45

Rspam Evolution Plugin enables Evolution Mail client to report email messages as spam to checksum-based and statistical filtering networks. It supports Razor network, DCC, SpamCop and Pyzor. This plugins requires a pretty new version of evolution to build. See README for more information about...