Lucene search
+L

2313 matches found

Nuclei
Nuclei
added 2026/09/13 4:24 p.m.29 views

WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting

The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in ...

6.1CVSS7.4AI score0.00952EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.153 views

Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled. id: CVE-2020-13125 info...

9.9CVSS7.3AI score0.08565EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.42 views

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

9.8CVSS6.5AI score0.39159EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.175 views

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE

The plugin does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains. id: CVE-2023-0159 info:...

7.5CVSS7.3AI score0.55459EPSS
SaveExploits3References5
Kitploit
Kitploit
added 2026/09/13 4:09 p.m.11 views

faraday_addon

About Faraday Addon is a simple addon for automate reporting vulnerabilities through the browsed to your own Faraday instance. Faraday Addon intercepts every single request from the browser, adding a functionality for accessing each one of them treating them as a vulnerability. In this way, a...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 2:45 p.m.9 views

CVE-2024-9935

CVE-2024-9935 - PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Overview The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf...

7.5CVSS8AI score0.0749EPSS
SaveExploits3References1
Kitploit
Kitploit
added 2026/09/13 1:20 p.m.4 views

CVE-2024-9935

CVE-2024-9935 PDF Generator Addon for Elementor Page Builder = 1.7.5 - Descarga de archivos arbitraria sin autenticación Uso python CVE-2024-9935.py http://example.com...

7.5CVSS8.1AI score0.0749EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/13 12:21 p.m.99 views

bucky

Project is on temporary hold. Bucky Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular ExpressionRegex to match the S3 bucket...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 10:10 a.m.8 views

CVE-2024-0710

CVE-2024-0710 Vulnerabilidad: CVE-2024-0710 Modificación no autenticada del ID único de envío CVSS: 5.3 Medio Software: GP Unique ID gp-unique-id Versiones afectadas: = 1.5.5 Versión parcheada: 1.5.6 Desarrollador: Gravity Wiz Investigador: Karl Emil Nikka, Nikka Systems Publicado públicamente:...

5.3CVSS5.9AI score0.0103EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 6:18 a.m.5 views

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published:...

9.8CVSS6.7AI score0.39159EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 1:28 a.m.6 views

CVE-2024-9935

CVE-2024-9935 Complemento Generador de PDF para Elementor Page Builder = 1.7.5 - Descarga Arbitraria de Archivos no Autenticada Descripción El complemento PDF Generator Addon para Elementor Page Builder de WordPress es vulnerable a Path Traversal en todas las versiones hasta la 1.7.5 inclusive a...

7.5CVSS8.2AI score0.0749EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/12 6:04 p.m.8 views

CVE-2025-2594

CVE-2025-2594 Registro de Usuario y Membresía = 4.1.2 - Bypass de Autenticación ¡Descargo de responsabilidad! La información presentada en este informe de CVE Common Vulnerabilities and Exposures es solo con fines educativos e informativos. Los detalles proporcionados se basan en recursos...

8.1CVSS8.2AI score0.0906EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/12 6:04 p.m.34 views

zap-scripts

zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: root@kitploit: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to u...

5.6AI score
SaveExploits0References2
Patchstack
Patchstack
added 2026/09/11 2:02 p.m.7 views

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

10CVSS0.00442EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/09/11 7:16 a.m.9 views

CVE-2026-14562

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data...

5.3CVSS0.00206EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/11 7:16 a.m.9 views

CVE-2026-14559

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address...

9.8CVSS0.00277EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/11 7:16 a.m.11 views

CVE-2026-14560

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

10CVSS0.00442EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/11 6:00 a.m.9 views

EUVD-2026-75959

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

10CVSS0.00442EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/11 6:00 a.m.6 views

CVE-2026-14560 Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server...

0.00442EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/11 6:00 a.m.18 views

CVE-2026-14559

CVE-2026-14559 affects the teddy-bear-customize-addon WordPress plugin through version 1.0.5 . The root cause is the absence of password verification before user authentication, allowing an unauthenticated attacker to log in as any registered user—including administrators—by supplying only that u...

9.8CVSS0.00277EPSS
SaveExploits0References1
Rows per page
Query Builder