Lucene search
+L

252802 matches found

Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•139 views

Crypto <= 2.15 - Authentication Bypass

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'cryptoconnectajaxprocess::login' function in the 'cryptoconnectajaxprocess' function. This makes it possible for unauthenticated...

9.8CVSS5.8AI score0.07112EPSS
SaveExploits0References5
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•50 views

WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass

Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users. id: CVE-2024-50477 info: name: WordPress Stacks Mobile App Builder =5.2.3 - Authentication Bypass...

9.8CVSS6AI score0.08118EPSS
SaveExploits3References4
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•32 views

WP Projects Portfolio <= 3.0 - Cross-Site Scripting

WP Projects Portfolio with Client Testimonials WordPress plugin = 3.0 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13114...

8.1AI score0.00584EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•50 views

LiteSpeed Cache <= 6.5.0.2 - Stored XSS

LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input. id: CVE-2024-47374 info...

7.1CVSS5.9AI score0.01408EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•32 views

Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting

WP Sunshine Sunshine Photo Cart versions up to 3.2.5 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-43971...

7.1CVSS5.5AI score0.00624EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•34 views

WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting

The WPMovieLibrary WordPress plugin through version 2.1.4.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'order' parameter in the import page before outputting it back, which could allow attackers to execute arbitrary JavaScript cod...

8.5AI score0.00681EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•54 views

WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kunal Nagar Custom 404 Pro allows Reflected XSS.This issue affects Custom 404 Pro: from n/a through 3.11.1. id: CVE-2024-39646 info: name: WordPress Custom 404 Pro = 3.11.1 - Reflected XSS...

7.1CVSS5.8AI score0.00624EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•19 views

WordPress 1 Click Migration Plugin < 2.3 - Information Exposure

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

5.9CVSS6.9AI score0.01639EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•80 views

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

7.2AI score0.03744EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•183 views

User Profile Builder < 3.11.8 - File Upload

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. id: CVE-2024-6366 info: name: User Profile Builder 3.11.8 - File Upload author: s4e-io severity: high...

5.8AI score0.28993EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•158 views

Hash Form <= 1.1.0 - Arbitrary File Upload

The Hash Form Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on...

9.8CVSS8.6AI score0.50653EPSS
SaveExploits8References3
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•56 views

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

7.5CVSS5.8AI score0.01211EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•78 views

Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution

Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...

8.1CVSS6.1AI score0.03463EPSS
SaveExploits3References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•24 views

ArForms < 6.6 - Remote Code Execution

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form id: CVE-2024-4620 info: name: ArForms 6.6 - Remote Code Execution autho...

5.8AI score0.03345EPSS
SaveExploits2References1
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•30 views

WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR

MapPress Maps for WordPress = 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests id: CVE-2026-8839 info: name:...

5.3CVSS5.8AI score0.01304EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•11 views

Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation

The Read More & Accordion expand-maker plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler yrmimportdata action. An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPre...

8.8CVSS5.8AI score0.01557EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•25 views

WP User Manager – User Profile Builder & Membership - Local File Inclusion

WP User Manager – User Profile Builder & Membership plugin for WordPress = 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP...

7.5CVSS6.2AI score0.02734EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•42 views

SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs. id: CVE-2024-6846 info: name: SmartSearchWP = 2.4.4 - Unauthenticated Log Purge author: s4e-io severity: medium description: | Th...

5.7AI score0.01252EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•14 views

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...

9.8CVSS5.9AI score0.02001EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/28 2:13 a.m.•13 views

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

7.5CVSS5.8AI score0.01588EPSS
SaveExploits1References3
Rows per page
Query Builder