CVE-2026-5415

CVE-2026-5415 CVE-2026-5415 WP Captcha PRO Exploit de Omisión de Autenticación Autenticada...

CVE-2025-13673

CVE-2025-13673 — Laboratorio de Inyección SQL de Tutor LMS Inyección SQL no autenticada en el plugin de WordPress Tutor LMS = 3.9.6 mediante el parámetro couponcode. Inicio rápido 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploy...

CVE-2026-8206

CVE-2026-8206 CVE-2026-8206 Exploit de toma de control de cuenta no autenticada del plugin Kirki...

CVE-2021-43798

Exploit de Grafana CVE-2021-43798 Resumen Este repositorio demuestra la explotación de CVE-2021-43798, una vulnerabilidad de directory traversal en Grafana. Esta vulnerabilidad permite a los atacantes leer archivos arbitrarios en el servidor. Detalles del CVE CVE : CVE-2021-43798 Descripción :...

CVE-2023-2437

CVE-2023-2437 Hola, TODOS , soy RxR He codificado una herramienta para explotar la vulnerabilidad UserPro = 5.1.1 – Bypass de autenticación a Administrador El exploit obtiene el usuario del administrador , luego inicia sesión con su acceso , para crear un nuevo administrador La mejor forma de...

CVE-2024-9932-POC

CVE-2024-9932-POC Descripción: El plugin Wux Blog Editor para WordPress es vulnerable a la subida arbitraria de archivos debido a una validación insuficiente del tipo de archivo en la función wuxbtinsertImageNew. Las versiones hasta la 3.0.0 inclusive están afectadas. Esta vulnerabilidad permite ...

CVE-2026-19856

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

WordPress WPC Estimated Delivery Date for WooCommerce plugin <= 4.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPC Estimated Delivery Date for WooCommerce versions = 4.0.1...

CVE-2014-125130

The CodeArt Google MP3 Audio Player plugin for WordPress (versions through 1.0.11 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. This flaw exists due to a path-traversal vulnerability in the file parameter of the direct_download.php file. Remote attackers can exploit thi...

CVE-2026-19856

The All in One SEO WordPress plugin versions prior to 5.0.2.1 contains a vulnerability where it fails to correctly identify which shortcodes are present in content derived from user input before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on t...

EUVD-2026-91769

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2023-4596

CVE-2023-4596 Script PoC para CVE-2023-4596, ejecución remota de comandos no autenticada mediante subida de archivos arbitrarios. Vídeo del PoC en uso Plantilla de Nuclei Artículo de noticias WordFence NVD Nist Resumen Se ha descubierto una vulnerabilidad crítica en el plugin de WordPress...

CVE-2026-104854

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on ...

CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via Session-Scoped OTP Lockout An authentication bypass in the miniOrange Two-Factor Authentication plugin for WordPress allows an attacker who already holds a victim's valid password to brute-force the second factor without limit, defeating...

CVE-2026-104854 Nx daemon and plugin worker sockets are accessible to other local users

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on ...

CVE-2023-4634

CVE-2023-4634 Exploit de RCE para el plugin Media-Library de WordPress 3.10 CVE-2023-4634 Información Patrowl descubrió una vulnerabilidad de RCE no autenticada en el plugin Media-Librairy-Assistant de WordPress en versiones 3.10. El exploit no es trivial y requiere solo una pequeña configuración...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...

WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mindio Magic MCP versions = 0.5.6...