WP Helper Lite < 4.3 - Cross-Site Scripting

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. id: CVE-2023-0448 info: name: WP Helper Lite 4.3 - Cross-Site Scripting author: ritikchaddha severity: medium description: | T...

AP Pricing Tables Lite <= 1.1.6 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins. id: CVE-2023-0900 info: name: AP Pricing Tables Lite = 1.1.6 - SQL Injection author: r3Y3r53 severity: high description: ...

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting

WordPress Post Status Notifier Lite plugin before 1.10.1 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

WP Popups - Information Disclosure

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. id: CVE-2024-6555 info: name: WP Popups - Informatio...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler

Newsletters WordPress plugin 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts. id: CVE-2026-16268 info: name: Newsletters 4.16 -...

ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

CVE-2025-50110

CVE-2025-50110 Передача конфиденциальной информации в открытом виде в Android-приложении EagleEyes Lite 1. Обзор Название : EagleEyesLite Версия : 2.0.0 Поставщик : AVTECH CWE : CWE-319: Передача конфиденциальной информации в открытом виде, CWE-598: Использование метода GET с конфиденциальными...

KITT-Lite

KITT Penetration Testing Framework — Lite версия Больше не поддерживается, возможно, потребуются некоторые правки для работы Фреймворк для пентестинга KITT был разработан как решение с открытым исходным кодом для пентестеров и программистов, позволяющее объединить используемые ими инструменты с и...

CVE-2019-2215-HuaweiP20Lite

Портирование CVE-2019-2215 bad binder на Huawei P20lite Android 8.0.0 Описание Этот проект представляет собой эксплойт для CVE-2019-2215 на Huawei P20lite с версией Android 8.0.0. Ядро находится на версии 4.4.23. Данная уязвимость, вероятно, самая документированная руководства, реальное...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - Chyrp Lite ≤ 2026.01"Iriomote"에서의 인증된 RCE 체인 공격: uploadspath 블록리스트 우회CVE-2026-53768 + adminupdateupload의 파일 확장자 검증 누락CVE-2026-53767 → www-data 권한으로 원격 코드 실행 개요 Chyrp Lite ≤ 2026.01은 changesettings 및 editupload 권한기본값: 관리자을 가진 모든 사용자가 악용할 수 있는 인증...

CVE-2025-46408

CVE-2025-46408 EagleEyes Lite 안드로이드 애플리케이션의 부적절한 호스트명 검증 1. 개요 이름 : EagleEyesLite 버전 : 2.0.0 공급업체 : AVTECH CWE : CWE-297: 호스트 불일치 시 인증서의 부적절한 검증 CVSS : 9.8 치명적 벡터 문자열 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2. 요약 EagleEyes Lite 버전 2.0.0은 HTTPS 통신 중...

3DPrint-Lite-1.9.1.4

3DPrint-Lite-1.9.1.4 WordPress 플러그인 3DPrint Lite 1.9.1.4 - 임의 파일 업로드...

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

EXPLOIT-CVE-2026-8832

ЭКСПЛУАТАЦИЯ CVE-2026-8832 Инструмент эксплуатации для тестирования уязвимости удалённого выполнения кода RCE в плагине WordPress WPCode Lite Insert Headers and Footers v2.3.5. Эта уязвимость возникает из-за регистрации пользовательского типа записи CPT wpcode без определения собственного...

CVE-2026-7438

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7438

The Bold Timeline Lite WordPress plugin (all versions up to and including 1.2.8 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the supertitle and subtitle attributes of the bold_timeline_item shortcode. The root cause is insufficient input sanitization and output escaping o...