276834 matches found
EUVD-2026-71878
The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-71877
The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-77830
The Spam protection, Honeypot, Anti-Spam by CleanTalk WordPress plugin (versions ≤ 6.86 ) contains a Stored Cross-Site Scripting vulnerability in the Comment Content aria-label Placeholder , caused by insufficient input sanitization and output escaping. Authenticated attackers with custom-level a...
CVE-2025-4403
CVE-2025-4403 Exploit Details Published : May 8, 2025 Updated : May 9, 2025 Severity : High CVSS Score: 9.8 CWE : CWE-434 - Unrestricted Upload of File with Dangerous Type Affected Versions : All versions from n/a through 1.1.6 CVSS Vector CVSS Version : 9.8 Vector String :...
CVE-2018-7747
CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...
CVE-2023-28121
CVE-2023-28121 Notas de investigación y material auxiliar para estudiar CVE-2023-28121 en un laboratorio controlado de WordPress/WooCommerce Payments. Aviso de seguridad Utilice este material únicamente en sistemas de su propiedad o para los que tenga autorización explícita para realizar pruebas...
CVE-2024-1209
CVE-2024-1209 Exposición de información sensible mediante assignments en LearnDash. Los visitantes no autenticados pueden explorar y descargar los assignments subidos. Vulnerabilidad: CVE-2024-1209 Exposición de información sensible mediante assignments CVSS: 5.3 Media Software: LearnDash sfwd-lm...
CVE-2025-2539
CVE-2025-2539 PoC Exploit de Lectura Arbitraria de Archivos no Autenticado para WordPress File Away Plugin ≤ 3.9.9.0.1 📖 Descripción Este script en Python es un exploit de prueba de concepto PoC para CVE-2025-2539 , dirigido a una vulnerabilidad en el WordPress File Away Plugin ≤ 3.9.9.0.1. La...
CVE-2020-12696
CVE-2020-12696 root@kitploit: ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Iframe iframe src="javascript:confirmdocument.cookie" width="100%" height="500" Version plugin: 4.4 Tested on: WordPress...
CVE-2015-6668
CVE-2015-6668 Título: Divulgación de nombres de archivo CV en el plugin Job-Manager de WP...
CVE-2020-24186-wpDiscuz-7.0.4-RCE
POC CVE-2020-24186-wpDiscuz-7.0.4-RCE WordPress wpDiscuz 7.0.4 Ejecución Remota de Código Existe una vulnerabilidad de Ejecución Remota de Código en el plugin gVectors wpDiscuz 7.0 a 7.0.4 para WordPress, que permite a usuarios no autenticados subir cualquier tipo de archivo, incluyendo archivos...
CVE-2023-1405
CVE-2023-1405 Formidable Forms = 6.1.2 - Inyección de Objetos PHP sin autenticar Descripción: El plugin Formidable Forms para WordPress es vulnerable a la Inyección de Objetos PHP en versiones hasta la 6.1.2 inclusive, a través de la deserialización de entrada no confiable proveniente de envíos d...
CVE-2021-29447-POC
CVE-2021-29447-POC Acerca de Este script automatiza los pasos necesarios para explotar CVE-2021-29447 en la funcionalidad de carga de medios de Wordpress y usarlo para extraer archivos a través de un XXE. Uso root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip...
CVE-2016-10956-mail-masta
Mail Masta - Lectura Local de Archivos CVE-2016-10956 El plugin mail-masta 1.0 para WordPress tiene lectura de archivos local en countofsend.php y csvexport.php. Uso root@kitploit: $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage: CVE-2016-10956mailmasta.py -h...
EUVD-2026-71875
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...
EUVD-2026-71873
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...
CVE-2026-84936
EmbedPress WordPress plugin before 4.6.4 lacks proper authorization on a public review-loading action. An unauthenticated attacker can repeatedly trigger billable Google Reviews API requests using the site's own configured API key and insert an unbounded number of attacker-controlled rows into th...
CVE-2026-84937
CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions before 2.1.0 . The plugin fails to properly sanitise and escape user-supplied input before using it in a SQL statement within the ytp_ajax endpoint. Users with the Contributor role or above can exploit this to perfor...
EUVD-2026-71876
The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...
