114 matches found
Exploit for CVE-2026-64638
xss2shell-check Non-destructive, dependency-free detector for...
Exploit for CVE-2026-12345
CVE-2026-64638 - WordPress wp-login.php Reflected XSS "XSS2...
The vulnerability of the wp-login.php file within the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the wp-login.php file in the WordPress content management system is related to the lack of security measures taken to protect the website’s structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
EUVD-2019-10728
Malware in sbrugna...
EUVD-2020-27993
Malware in sbrugna...
EUVD-2012-2739
Malware in sbrugna...
EUVD-2019-6743
Malware in sbrugna...
CVE-2022-1732 Rename wp-login.php <= 2.6.0 - Secret URL Update via CSRF
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack...
PT-2022-14081
Name of the Vulnerable Software and Affected Versions Rename wp-login.php WordPress plugin versions prior to 2.6.1 Description The issue concerns the lack of a CSRF check when updating the secret login URL. This could allow attackers to make a logged-in admin change the URL via a CSRF attack...
CVE-2022-1732: Cross-Site Request Forgery (CSRF)
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack...
Rename wp-login.php <= 2.6.0 - Secret URL Update via CSRF
The plugin does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack document.getElementById"test".submit;...
CVE-2021-24228
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...
CVE-2021-24228: Improper Neutralization of Input During Web Page Generation
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...
Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)
The plugin did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. From an IP not in the Allow List...
Cross site scripting
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
CVE-2020-6850
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
CVE-2020-6850
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
CVE-2020-6850: Improper Neutralization of Input During Web Page Generation
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...
PT-2020-19264
Name of the Vulnerable Software and Affected Versions miniorange-saml-20-single-sign-on plugin versions prior to 4.8.84 Description The issue allows for XSS via a crafted SAML XML Response to "wp-login.php". This is related to the SAMLResponse and RelayState variables, and the Destination paramet...
