CVE-2026-15406

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion via the event_layout parameter in all versions up to and including 4.1.22 . Authenticated attackers with custom-level access or above can include and execute...

EUVD-2026-74568

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...

CVE-2026-15406 Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...

CVE-2026-76801

CVE-2026-76801 affects the FireBox WordPress plugin (WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment) in versions up to and including 3.1.10 . The root cause is a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core funct...

CVE-2026-13359

The Contact Form to DB by BestWebSoft WordPress plugin (versions up to and including 1.7.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter, caused by insufficient input sanitization and output escaping. An attacker can inject a payload by...

EUVD-2026-74567

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

CVE-2026-13359 Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-12956 Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

EUVD-2026-74566

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

EUVD-2026-74565

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-76801 FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

CVE-2026-12956

The WP Event Solution (Eventin) WordPress plugin (versions ≤ 4.1.22 ) is affected by a Missing Authorization vulnerability in the /wp-json/eventin/v2/orders REST endpoint. The create_item_permissions_check() function relies solely on a wp_rest nonce that is leaked to every visitor via the etn-pub...

CVE-2025-5287

描述： 这是一个利用代码，针对WordPress插件上的Unauth SQL注入漏洞（CVE-2025-5287），支持多个URL和多线程。 使用示例： 用法: CVE-2025-5287.py -h --file FILE --fudge FUDGE --timeout TIMEOUT --threads THREADS --proxy PROXY 基于时间的SQL注入检查器（整洁、多线程、支持代理） 可选参数： -h, --help 显示此帮助信息并退出 --file FILE 包含基础URL的文件（例如 http://example.com） --fudge FUDGE...

CVE-2026-82222

⚡ GHOSTLYR00T - GiveWP RCE 漏洞利用框架 CVE-2026-82222 - GiveWP 未授权 RCE 漏洞利用 批量扫描 + 自动检测 + 多线程 + 交互式 Shell 📋 目录 | Table of Contents 概述 主要功能 | Key Features 漏洞详情 安装 | Installation 完整参数 | Complete Parameters 使用示例 | Examples 扫描结果 | Scan Results...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - 未认证权限提升 免责声明！ 本文档中提供的 CVE（通用漏洞与暴露）信息仅用于教育和参考目的。所提供细节基于作者对公开资源的检索、研究及分析。内容无意促进或鼓励任何非法活动，包括黑客攻击、漏洞利用或对系统的未授权访问。 作者对信息的任何滥用不承担任何责任。建议个人和组织负责任地应用这些知识，并遵守适用法律法规。强烈建议读者仅在获得适当授权的受控环境中测试漏洞。 本文档的作者和贡献者不支持或纵容恶意活动，并鼓励负责任的披露和道德黑客实践。 描述 在“User Registratio...

CVE-2024-10542

CVE-2024-10542 和 CVE-2024-10781 的 PoC：CleanTalk 插件（版本 = 6.43.2）中的认证绕过漏洞 免责声明： 本文档中关于 CVE-2024-10542 的信息仅供学习和教育目的。我们不鼓励或授权将此信息用于任何有害目的，包括但不限于漏洞利用、系统篡改或其他非法活动。 简介： 在日益复杂的数字环境中，确保网站安全对许多站点所有者至关重要。最近，发现两个严重漏洞，对 WordPress 站点构成重大威胁。这些漏洞影响知名的 CleanTalk 插件，该插件提供垃圾邮件防护、反垃圾邮件功能和防火墙。情况为何更加紧迫？让我们深入探讨！ 跟踪为...

CVE-2024-9047

CVE-2024-9047 CVE-2024-9047, wfufiledownloader.php 通过 wfufiledownloader.php 文件访问， WordPress File Upload Solution poc，该解决方案存在漏洞，可以任意访问、操作或修改文件。...

CVE-2023-6360

CVE-2023-6360 分析报告 概述 CVE-2023-6360 是 WordPress 特定插件中发现的 SQL 注入漏洞，攻击者可以利用 web 应用程序的安全漏洞将恶意 SQL 代码注入数据库。这可能导致数据泄露、数据篡改等严重的安全问题。​:contentReferenceoaicite:3index=3 受影响版本 :contentReferenceoaicite:4index=4​:contentReferenceoaicite:5index=5 漏洞详情 :contentReferenceoaicite:6index=6...

cve-2026-15748

CVE-2026-15748 — Forminator Security Scanner A Python-based security research and vulnerability assessment scanner for identifying WordPress installations that use the Forminator plugin and assessing version-related exposure. For Educational & Authorized Testing Only Run this project only against...

CVE-2025-3616

Metasploit 模块: Greenshift WordPress 插件任意文件上传漏洞 CVE-2025-3616 此仓库包含一个 Metasploit 模块，用于利用 CVE-2025-3616 ，这是 Greenshift WordPress 插件（版本 11.4 至 11.4.5）中的一个任意文件上传漏洞。 该漏洞利用允许经过身份验证的用户（订阅者及以上）上传任意文件，从而导致远程代码执行（RCE）。它通过使用 GIF 魔法字节（GIF89a;）伪造 MIME 类型来绕过插件的文件类型验证。 功能特点 身份验证处理 ：支持使用现有凭据（USERNAME/PASSWORD）登录...