WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin Smart Forms versions = 2.6.104...

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...

CVE-2025-4796

CVE-2025-4796 eventin y actualizar el email del ponente a un email que controle. Luego, el atacante puede usar el restablecimiento de contraseña de WordPress para tomar el control de la cuenta de administrador. requisitos: python 3.8 o superior requests instalar requests: pip install requests uso...

CVE-2021-44967

CVE-2021-44967: RCE autenticado en LimeSurvey Prueba de concepto para CVE-2021-44967. El script se autentica en LimeSurvey, sube y activa un plugin PHP, y desencadena una reverse shell. Utiliza esto únicamente contra sistemas que poseas o estés autorizado a probar. Requisitos Python 3...

WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Progress Planner versions = 1.10.0...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Tipo de vulnerabilidad: Cross-Site Scripting XSS – XSS reflejado CWE: CWE-79 – Neutralización incorrecta de entrada durante la generación de páginas web 'Cross-site Scripting' Severidad: Alta CISA ADP CVSS v3.1: 7.1 Resumen CVE-2026-9833 afecta al plugin de...

CVE-2025-14440

CVE-2025-14440 JAY Login & Register = 2.4.01 - Bypass de Autenticación mediante Cookie 🚨 JAY Login & Register = 2.4.01 - Bypass de Autenticación mediante Cookie 📝 Descripción El plugin JAY Login & Register para WordPress es vulnerable a un bypass de autenticación en versiones hasta la 2.4.01...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Carga Arbitraria de Archivos No Autenticada Descripción El plugin WooCommerce Designer Pro para WordPress, utilizado por el tema Pricom - Printing Company & Design Services de WordPress, es vulnerable a cargas arbitrarias de archivos debido a la...

WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Eunho Kim in WordPress Plugin PDF for Contact Form 7 versions = 7.1.0...

WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sakri Koskimies in WordPress Plugin BEAR versions = 1.2.2...

violin

Violin ☤ — Supervised Agentic Hermes Pentest Profile 35 playbooks · 19 references · 14 templates · required execution guard · Hermes-native Violin is a Hermes-native agentic pentest profile for supervised, authorised penetration tests — from reconnaissance through safe exploit validation to...

CVE-2026-17005

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

CVE-2025-2005

CVE-2025-2005 — Carga Arbitraria de Archivos por Usuarios de Front-End CVE-2025-2005 Usuarios de Front-End de WordPress — Carga Arbitraria de Archivos sin Autenticación 0xZ3R0 // h4ckxel 0x00 — Resumen Ejecutivo Front-End Users se ve afectado por una vulnerabilidad de carga arbitraria de archivos...

CVE-2026-82222-MassExploit

CVE-2026-82222 — Ejecución Remota de Código No Autenticada en el Plugin GiveWP de WordPress Ejecución Remota de Código Crítica No Autenticada CVSS 9.8 — GiveWP ≤ 4.16.7.1 Esta herramienta explota CVE-2026-82222 , una vulnerabilidad en el plugin GiveWP de WordPress que permite a atacantes no...

WordPress User Private Files plugin < 2.2.0 - Unauthenticated Private File Disclosure vulnerability

Unauthenticated Private File Disclosure vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin User Private Files versions 2.2.0...

CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

WordPress Horizontal scrolling announcements plugin <= 2.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by testoun in WordPress Plugin Horizontal scrolling announcements versions = 2.6...

EUVD-2026-92071

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit Kit de Explotación CVE-2025-0316 🚨 Exploit de Bypass de Autenticación para el Plugin de WordPress WP Directorybox Manager 🔥 Script de explotación automatizado para CVE-2025-0316 — Bypass de autenticación mediante una acción AJAX vulnerable. ⚠️ Aviso Legal Esta herramienta est...

CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Bypass de Autenticación en Burst Statistics -brightgreen.svg?style=for-the-badge !CAUTION ALERTA CRÍTICA: Esta vulnerabilidad permite a un atacante remoto no autenticado eludir la autenticación y obtener privilegios completos de Administrador en el sitio WordPress objetivo...