CVE-2026-8181

| 인증 필요 💥 CVE-2026-8181 - Burst Statistics 인증 우회 MainWP 인증 우회를 통한 비인증 권한 상승 👨‍💻 작성자 !0xTerrorhttps://assets.kitploit.com/production/public/readmes/50604/f036bd5517ab1ec023381e336e314b53384b618d5a934600f6128bbcc120a17f/e194c1d16ab6bf9d8e1e2e72b5aefe2482a37d8f3ddb259e82effd798bc6ac99-displ...

CVE-2016-15041-mainwp-dashboard

CVE-2016-15041 실습 - MainWP Dashboard 저장형 XSS CVE-2016-15041 취약점 실습: MainWP Dashboard WordPress 플러그인 = 3.1.2에서 인증 없이 발생하는 저장형 XSS 빠른 시작 docker compose up -d --build 자동 설정을 위해 약 30초 기다립니다. 준비가 완료되면 실습에서 배너를 출력합니다. docker compose logs -f wordpress 접근 리소스| URL / 자격 증명 ---|--- WordPress|...

CVE-2026-8181

CVE-2026-8181 익스플로잇 Burst Statistics WordPress 플러그인 — 인증 우회를 통한 관리자 권한 상승 CVE-2026-8181에 대한 익스플로잇으로, Chloe Chamberland와 PRISM이 발견했습니다. ⚠️ 고지 사항 이 저장소는 연구 및 방어적 보안 목적으로만 제공됩니다. 저자는 이 정보의 오용에 대해 책임을 지지 않습니다. 📌 개요 WordPress용 Burst Statistics – Privacy-Friendly WordPress Analytics 플러그인은 3.4.0부터...

MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting

MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to 3.1.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'mwpsetuppurchaseusername' parameter, letting unauthenticated attacke...

Exploit for CVE-2026-8181

💥 CVE-2026-8181 - Burst Statistics Authentication Bypass...

WordPress MainWP Child plugin < 6.1.2 - Unauthenticated Administrator Authentication Bypass vulnerability

Unauthenticated Administrator Authentication Bypass vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin MainWP Child versions 6.1.2...

CVE-2026-12255

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

CVE-2026-12255

The MainWP Child WordPress plugin, in versions before 6.1.2 , contains an unauthenticated authentication bypass vulnerability. The flaw exists because the site-registration request handler fails to verify the requester's identity when password authentication is disabled for a target account. An u...

CVE-2026-12255

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

EUVD-2026-49065

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

CVE-2026-12255 MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

CVE-2026-12255 MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

CVE-2026-12255: Improper Authentication

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

PT-2026-64832

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

📄 WordPress MainWP Child 5.3.3 Unauthenticated Administrator Session Takeover

WordPress MainWP Child plugin version 5.3.3 contains an unauthenticated administrator session takeover vulnerability through Rogue Site Registration. A remote attacker can obtain an authenticated administrator session and take control of the affected site. This proof of concept exploit demonstrat...

CVE-2026-15283

The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-15283

The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-15283 WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting

The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-15283 WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting

The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-15283

The CVE pertains to the WPvivid Backup for MainWP WordPress plugin. A stored XSS flaw exists in admin settings across all versions up to 0.9.33 due to insufficient input sanitization and output escaping. This affects multi-site installations and sites where unfiltered_html is disabled, allowing a...