WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability

Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Subida de archivos arbitraria no autenticada a RCE Exploit para CVE-2026-0740 descubierta por Selim Lanouar whattheslime. Para una inmersión técnica completa, lea el artículo completo en el blog de Lexfo. Descargo de responsabilidad Este repositor...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

CVE-2026-2942

ProSolution WP Client — Escáner de Subida de Archivos No Autenticada y RCE Plugin: prosolution-wp-client Versión Afectada: Tipo de Vulnerabilidad: Subida de Archivos Arbitraria No Autenticada → Ejecución Remota de Código Nivel de Riesgo: 🔴 Crítico CVSS 9.8 Requisito: Página pública que contiene e...

WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

CVE-2026-0740-mass

CVE-2026-0740 — Motor de Explotación Masiva Autor: 0xNuts Colaborador: Cursor Repositorio: https://github.com/ExDev994/CVE-2026-0740-mass PoC para CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Subida Arbitraria de Archivos sin Autenticación que puede llevar a RCE. La vulnerabilidad inicial f...

WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WPAdverts versions = 2.3.3...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin CVE-2026-5718 — DnD CF7 File Upload RCE Scanner Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Plugin Slug: drag-and-drop-multiple-file-upload-contact-form-7 CVE ID: CVE-2026-5718 CVSS Score: 8...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-2520

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-3174

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-17509

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

CVE-2026-18021

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-12230

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layoutcustomcss' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it...

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tony Harris in WordPress Plugin Thank You Page Customizer for WooCommerce versions = 1.2.2...

WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by CidKagenouSama in WordPress Plugin WP Travel versions = 12.0.3...

CVE-Wordpress

CVE-2026-49777, CVE-2026-10735 ⚡ Uso Simple Utilice este proyecto únicamente en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aisladas Entornos de pruebas de penetración autorizados Ejemplo de configuración y uso: root@kitploit...

wp2shell-scanner

wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-60137 – WordPress wp2shell vulnerability-chain scanner Authorized security-research tool with optional command-verification PoC. wp2shell-scanner detects the WordPress wp2shell vulnerability chain by validating public WordPress evidence,...