CVE-2021-38314

Unauthenticated Sensitive Information Disclosure CVE-2021-38314 Python exploit for CVE-2021-38314 Use: python3 cve-2021-38314.py http://www.target.com The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users ...

CVE-2020-12077

CVE-2020-12077 MapPress Maps Pro 2.53.9 - Remote Code Execution RCE due to Incorrect Access Control in AJAX Actions Description The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’,...

CVE-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin Example PoC - https://youtu.be/n1e4aFmXvOk Links CVE-2021-38314...

CVE-2022-1329

CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

Ubigeo de Peru < 3.6.4 - SQL Injection

The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections. id: CVE-2022-0814 info: name: Ubigeo de Peru 3.6.4 - SQL Injection author: r3Y3r53...

WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload

WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpformsuploadchunkinit, wpformsuploadchunk and wpformsfilechunksuploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under...

CVE-2021-38314

CVE-2021-38314 What is the vulnerability? The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministi...

CVE-2026-85126

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

CVE-2026-86717

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...

CVE-2026-81420

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-14854

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request...

CVE-2026-85126

The Crowdfundly WordPress plugin, in versions through 2.2.2 , is vulnerable to privilege escalation due to missing capability checks on certain AJAX actions . An attacker with a low-privileged role within the plugin can exploit this flaw to grant themselves administrator privileges or arbitrary c...

CVE-2026-86706

The Quick quotes WordPress plugin, in versions through 1.0.0 , is vulnerable to an unauthenticated integer-value option update due to a missing capability and nonce check on an AJAX action . This flaw allows unauthenticated users to specify which option to write, enabling them to alter arbitrary ...

CVE-2026-85126 Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation

The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover...

EUVD-2026-96767

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role...

CVE-2026-85121 Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress...

CVE-2026-85118

The AI Content Generator Marketing WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated privilege escalation. The root cause is a failure to enforce nonce or capability checks on specific AJAX actions , which allows unauthenticated users to update or delete arbitrary WordPr...

CVE-2026-85118 AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site...

CVE-2026-81420

The Tcard WP WordPress plugin, in versions through 1.8.0 , is vulnerable to SQL injection because it fails to sanitize and escape a parameter—specifically the group_id parameter—before using it in a SQL statement within an unauthenticated AJAX action. This flaw allows unauthenticated users to per...