278191 matches found
CVE-2026-14989 Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpluserpreference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-74775
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpluserpreference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14989
WPLP Cookie Consent (Cookie Banner for GDPR / CCPA) WordPress plugin versions up to and including 4.4.1 are affected by an Unauthenticated Stored Cross-Site Scripting vulnerability in the wpl_user_preference parameter of the consent-logging AJAX endpoint. The root cause is insufficient input sani...
EUVD-2026-74774
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...
CVE-2026-14359 YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verificatio...
CVE-2026-75927
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...
CVE-2026-15398
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...
CVE-2026-17149
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...
reproducing-CVE-2025-1489
CVE-2025-1489 の再現 このリポジトリは、Web関連のCVE CVE-2025-1489 を安全な環境で再現し、フォレンジック/脆弱性分析スキルを実演・練習するためのものです。 特定・再現された脆弱性は、WordPressプラグインWP-Appbox バージョン4.5.4 におけるストアドクロスサイトスクリプティング XSS...
CVE-2026-1844
PixelYourSite PRO - 未认证存储型跨站脚本（CVE-2026-1844） 概述 WordPress 的 PixelYourSite PRO 插件在 12.4.0.2 及之前的所有版本中，由于对 'pysTrafficSource' 参数和 'pyslandingpage' 参数的输入清理和输出转义不足，存在存储型跨站脚本漏洞。这使得未认证的攻击者能够在页面中注入任意 Web 脚本，当用户访问被注入的页面时，这些脚本将执行。 关键要点 严重性 ：严重 CVSS 评分 ：7.2（高危） 攻击向量 ：网络 点击此处下载...
WP-CVE-2023-5360
WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – 未認証の任意ファイルアップロード Python 2.7 寄付 : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC 使用方法 Python 2.7 をインストール ここからダウンロード python file.py 参照 :...
CVE-2026-14483_exploit
CVE-2026-14483 — Realtyna WPL / Organic IDX 未认证任意文件上传 → RCE 未认证任意文件上传漏洞，可导致 Realtyna WPL / Organic IDX WordPress 插件（real-estate-listing-realtyna-wpl ≤ 5.2.0）中的远程代码执行（RCE）。 该插件在公开的 WordPress init 钩子上注册了一个 “I/O 服务” ，可通过 ?wplview=io&wplformat=io 在站点根目录未认证 访问。唯一的门槛是插件迁移中附带的一对静态硬编码默认密钥 （每个安装环境均相同），且...
WordPress Repeater Fields for Gravity Forms plugin <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by andrea bocchetti in WordPress Plugin Repeater Fields for Gravity Forms versions = 3.0.4...
WordPress Product Filter for WooCommerce by WBW plugin <= 3.4.2 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Product Filter by WBW versions = 3.4.2...
EUVD-2026-74760
The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...
EUVD-2026-74758
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...
EUVD-2026-74759
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...
CVE-2026-17149
CVE-2026-17149 is a Stored Cross-Site Scripting (XSS) vulnerability in the myCred WordPress plugin (Points Management System for Gamification, Ranks, Badges, and Loyalty Rewards Program), affecting all versions up to and including 3.2.4 . The flaw exists in the 'wrapper' shortcode attribute due t...
CVE-2026-17149 myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...
CVE-2026-75927 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...