1776 matches found
CVE-2020-36708
CVE-2020-36708 – WordPress Epsilon Framework 函数注入 PoC 概述 CVE-2020-36708 是 WordPress 的 Epsilon Framework 中的一个漏洞，它允许未经身份验证的攻击者通过 AJAX 操作 epsilonframeworkajaxaction 调用任意 PHP 类方法。 此问题被归类为函数注入漏洞 ，因为攻击者可以同时控制： 要调用的类 （例如 Requests） 要调用的方法 （例如 requestmultiple） 要提供的参数 实际上，攻击者可以指示框架执行本不应暴露的 PHP 函数或库调用。...
CVE-2022-0739
CVE-2022-0739 BookingPress 1.0.11 - 未认证的 SQL 注入 该插件在将用户提供的 POST 数据用于动态构造的 SQL 查询之前，未能正确过滤这些数据， 攻击者可通过 bookingpressfrontgetcategoryservices AJAX 操作（未认证用户亦可访问）触发该查询， 导致未认证的 SQL 注入。 CVE-2022-0739 https://plugins.trac.wordpress.org/changeset/2684789 来源：...
EUVD-2026-71873
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...
EUVD-2026-71849
The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...
CVE-2025-39459-Nuclei-Template
📄 CVE-2025-39459 的 Nuclei 模板 🚀 概述 本仓库包含一个专为检测 Real Estate 7 WordPress 主题 中的 未认证权限提升漏洞 CVE-2025-39459 而设计的 Nuclei 模板。该漏洞允许未认证的攻击者通过存在缺陷的 AJAX 操作注册为管理员。 🔍 漏洞描述 CVE-2025-39459 源于 Real Estate 7 WordPress 主题 版本 3.5.2 及更早版本中对 ctaddnewmember AJAX 操作缺少授权检查。这允许未认证的攻击者通过操控 ctuserrole 参数以管理员权限注册。 🛑 受影响版本 Re...
WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...
Youzify < 1.2.0 - Unauthenticated SQLi
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection id: CVE-2022-1950 info: name: Youzify 1.2.0 - Unauthenticated SQLi author:...
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...
WordPress KiviCare <2.3.9 - SQL Injection
WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajaxpost AJAX action with the getdoctordetails route. An attacker can possibly obtain sensitive information, modify...
WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting
WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...
CVE-2026-16281
The Classified Listing WordPress plugin before 6.1.1 suffers from an IDOR (Insecure Direct Object Reference) in its AI image-editing AJAX action. The plugin fails to verify that the caller owns or can edit the target listing before performing media operations, allowing any authenticated user—incl...
CVE-2024-12849-Poc
CVE-2024-12849-Poc 📜 描述 Error Log Viewer By WP Guru 这个 WordPress 插件在 1.0.1.3 及之前的所有版本中，通过 wpajaxnoprivelvwplogdownload AJAX 操作存在任意文件读取漏洞。这使未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 ⚙️ 安装所需的软件包 root@kitploit: pip install requests ⚙ 检查版本并下载默认文件 示例命令 root@kitploit: python CVE-2024-12849.py -u...
js-jobs
js-jobs JS Job Manager 要激活插件（此处存在一个限制：插件必须包含 /.php 文件，否则将无法激活）： root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest...
CVE-2024-12594
CVE-2024-12594 ALL In One Custom Login Page input...
CVE-2024-12849
CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - 缺少授权导致未认证的任意文件读取 描述 WordPress 的 Error Log Viewer By WP Guru 插件在 1.0.1.3 及之前的所有版本中，通过 wpajaxnoprivelvwplogdownload AJAX 操作存在任意文件读取漏洞。这使得未认证的攻击者能够读取服务器上任意文件的内容，其中可能包含敏感信息。 详情 类型 : 插件 Slug : error-log-viewer-wp 受影响版本 : 1.0.1.3 CVSS 分数 : 7.5 CVSS...
Web Directory Free < 1.7.0 - SQL Injection
The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...
CVE-2021-24499
CVE-2021-24499 | Workreap - 自由职业者市场和目录 WordPress 主题 2.2.2 - 任意文件上传 WordPress 主题 Workreap 2.2.2 - 未认证文件上传导致远程代码执行 一个功能强大且精准的大规模利用工具，针对 WordPress Workreap 主题中的 CVE-2021-24499 漏洞。该利用程序允许未经认证的文件上传，从而可能导致远程代码执行（RCE）。 📝 描述 CVE-2021-24499 是 WordPress Workreap 主题（2.2.2 及以下版本）中的一个严重漏洞，它允许未经认证的用户通过...
CVE-2025-14364
CVE-2025-14364 Demo Importer Plus Suscriptor autenticado → Administrador mediante la acción AJAXdo-reinstall 〔 1 〕 Vulnerabilidad Causa raíz: Ajax::handlerequest registra la acción AJAX demoimporterplus sin llamar a currentusercan. Cualquier suscriptor autenticado puede enviar...
