329 matches found
CVE-2026-8181
| Authentication Required 💥 CVE-2026-8181 - Burst Statistics Authentication Bypass Unauthenticated Privilege Escalation via MainWP Authentication Bypass 👨💻 Author !0xTerrorhttps://assets.kitploit.com/production/public/readmes/50604/f036bd5517ab1ec023381e336e314b53384b618d5a934600f6128...
CVE-2016-15041-mainwp-dashboard
CVE-2016-15041 Lab - MainWP Dashboard Stored XSS Vulnerable lab for CVE-2016-15041: Unauthenticated stored XSS in MainWP Dashboard WordPress plugin = 3.1.2. Quickstart root@kitploit: docker compose up -d --build Wait 30 seconds for auto-setup. The lab prints a banner when ready: root@kitploit:...
MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to 3.1.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'mwpsetuppurchaseusername' parameter, letting unauthenticated attacke...
CVE-2026-8181
CVE-2026-8181 exploit Burst Statistics WordPress Plugin — Authentication Bypass to Administrator Privilege Escalation Exploit for the CVE-2026-8181 discovered by Chloe Chamberland and PRISM. ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author...
CVE-2026-12255
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
CVE-2026-12255
CVE-2026-12255 affects the MainWP Child WordPress plugin prior to 6.1.2. The site-registration request handler does not verify the requester’s identity when password authentication is disabled for the targeted account, enabling an unauthenticated attacker to obtain a valid authentication session ...
CVE-2026-12255
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
EUVD-2026-49065
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
CVE-2026-12255 MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
📄 WordPress MainWP Child 5.3.3 Unauthenticated Administrator Session Takeover
WordPress MainWP Child plugin version 5.3.3 contains an unauthenticated administrator session takeover vulnerability through Rogue Site Registration. A remote attacker can obtain an authenticated administrator session and take control of the affected site. This proof of concept exploit demonstrat...
CVE-2026-15283
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-15283
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-15283 WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-15283
The CVE pertains to the WPvivid Backup for MainWP WordPress plugin. A stored XSS flaw exists in admin settings across all versions up to 0.9.33 due to insufficient input sanitization and output escaping. This affects multi-site installations and sites where unfiltered_html is disabled, allowing a...
CVE-2026-57327
Subscriber Broken Access Control in MainWP = 6.1.1 versions...
EUVD-2026-40098
Subscriber Broken Access Control in MainWP = 6.1.1 versions...
CVE-2026-57327
The connected documents identify CVE-2026-57327 as a vulnerability in the WordPress MainWP plugin up to version 6.1.1 describing a Subscriber/Broken Access Control issue. The underlying root cause is described as broken access control, but the documents do not provide concrete technical details s...
CVE-2026-57327
Subscriber Broken Access Control in MainWP = 6.1.1 versions...