CVE-2026-87918 WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own...

CVE-2026-87916 WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...

CVE-2026-87918

The WPBot WordPress plugin before 8.5.7 fails to perform any authorization or nonce check on several AJAX actions that relay prompts to configured AI providers. This allows unauthenticated attackers to trigger those third-party API calls using the site's own configured API keys, thereby consuming...

CVE-2026-87916

The WPBot WordPress plugin (versions 8.4.9 through 8.5.9 ) is affected by an unauthenticated PII disclosure vulnerability. The root cause is a missing capability or nonce check on the AJAX action that lists stored chat sessions. An unauthenticated attacker can retrieve the name, email address, an...

CVE-2026-87797 Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 has a missing authorization check on the si_edit_private_note AJAX action. Because no capability or ownership verification is performed, any authenticated user with the subscriber role (or higher) can overwrite private notes belonging to other u...

EUVD-2026-76799

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other user...

lab-cve-2025-3515

CVE-2025-3515 WordPress Lab（用于Contact Form 7的拖放多文件上传） 快速搭建一个易受攻击的WordPress环境，以复现并验证CVE-2025-3515——插件drag-and-drop-multiple-file-upload-contact-form-7（≤ 1.3.8.9）中通过ddmuuploadfile实现的无限制文件上传。此实验环境已Docker化，可使用Nuclei快速、确定性地进行测试。 易受攻击的插件：drag-and-drop-multiple-file-upload-contact-form-7 v1.3.8.9...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Actualización arbitraria de opciones por Suscriptor+ Descripción El plugin de WordPress Content Mask anterior a la versión 1.8.4.1 no realiza comprobaciones de autorización y CSRF en varias acciones AJAX, y tampoco valida que la opción a actualizar pertenezca al...

CVE-2026-14962

CVE-2026-14962 Inyección SQL no autenticada en el plugin de WordPress ELEX WooCommerce Request a Quote ELEX WooCommerce Request a Quote plugin de WordPress elex-request-a-quote ≤ 2.4.0 — inyección SQL no autenticada a través de la acción AJAX pública elexraqaddtoquote. Solo para pruebas...

CVE-2024-50492

🚨 CVE-2024-50492 - Exploit RCE para ScottCart 🔥 Script de Exploit para ScottCart 🧑‍💻 Por Nxploit – Khaled Alenazi 📌 Descripción El plugin ScottCart para WordPress versiones ≤ 1.1 es vulnerable a Ejecución Remota de Código RCE. Esto permite a atacantes no autenticados ejecutar funciones PHP...

PT-2026-90600

🚨 CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw posts locator ajax info window loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on t...

CVE-2025-47646

CVE-2025-47646 PoC 针对 WordPress PSW 前端登录注册插件 ≤ 1.12 的未认证权限提升漏洞利用 📖 描述 此 Python 脚本是 CVE-2025-47646 的概念验证 PoC 漏洞利用，针对 WordPress PSW 前端登录注册插件 ≤ 1.12 中的漏洞。 该漏洞允许未经认证的攻击者通过暴露的 AJAX 操作注册新用户账户，而无需适当的验证或限制。 📌 使用方法 ▶️ 要求： Python 3 requests 库 pyfiglet 库 安装所需库： root@kitploit: pip install requests pyfiglet ▶️...

CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - 缺少授权导致已验证用户（订阅者+）可进行有限选项更新 描述 WordPress的NitroPack插件在包括1.17.0在内的所有版本中，由于'nitropackdismissnoticeforever' AJAX操作缺少权限检查，存在未经授权修改数据的风险。这使得经过身份验证的攻击者（至少拥有订阅者级别权限）能够将任意选项更新为固定值'1'，从而可能激活某些选项（例如启用用户注册）或以导致拒绝服务条件的方式修改某些选项。 详细信息 类型 : 插件 Slug : nitropack 受影响版本 : 1.17.0...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Ejecución Remota de Código Descripción El plugin SEO LAT Auto Post para WordPress es vulnerable a la sobrescritura de archivos debido a una falta de verificación de capacidad en la acción AJAX remoteupdate en todas las versiones hasta la 2.2.1 inclusive. Esto permite q...

CVE-2025-5781

Exploit de FreePBX CVE-2025-57819 Descripción Este script explota una vulnerabilidad en versiones de FreePBX anteriores a 16.0.26.0 CVE-2025-57819, permitiendo a atacantes remotos ejecutar código PHP arbitrario a través de una falla de inyección SQL en el endpoint de la API AJAX. El exploit crea...

CVE-2026-3891

🚀 CVE-2026-3891 – Subida de Archivos no Autenticada con RCE en Pix for WooCommerce Exploit de prueba de concepto para CVE-2026-3891 – subida arbitraria de archivos no autenticada que conduce a la ejecución remota de código en el plugin de WordPress Pix for WooCommerce ≤ 1.5.0. 📖 Resumen...

CVE-2026-15439

The GamiPress WordPress plugin (versions up to and including 7.9.7 ) is vulnerable to authenticated SQL injection via the q parameter in the wpForo integration AJAX action gamipress_wpforo_get_posts. The input is filtered only by $wpdb-&gt;esc_like() and interpolated directly into a single-quoted...

WordPress Simple Ajax Chat plugin <= 20260811 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HEI LAI SZE in WordPress Plugin Simple Ajax Chat versions = 20260811...