CVE-2024-12542-PoC

CVE-2024-12542-PoC Mancanza di autorizzazione all'esposizione non autenticata di informazioni sensibili Descrizione della vulnerabilità Il plugin linkID per WordPress è vulnerabile all'accesso non autorizzato ai dati a causa della mancanza di un controllo delle capacità quando include la funzione...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 – Remote-Codeausführung Beschreibung Das SEO-LAT-Auto-Post-Plugin für WordPress ist anfällig für Dateiüberschreibung aufgrund einer fehlenden Berechtigungsprüfung bei der remoteupdate-AJAX-Aktion in allen Versionen bis einschließlich 2.2.1. Dadurch können nicht...

CVE-2024-10674

Exploit CVE-2024-10674 - Th Shop Mania = 1.4.9 🚀 Panoramica Questo repository contiene un exploit per la vulnerabilità identificata come CVE-2024-10674 nel tema WordPress Th Shop Mania. La vulnerabilità consente a utenti autenticati con almeno accesso a livello di Abbonato di installare e attivar...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 Dieses Repository enthält einen Proof-of-Concept-Exploit für das GPX-Viewer-Plugin für WordPress, das anfällig für die Erstellung beliebiger Dateien CVE-2024-10629 ist. Die Schwachstelle erlaubt authentifizierten Angreifern mit Subscriber-Zugriff und höher,...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Instalação Não Autenticada de Plugin Arbitrário Descrição O tema Pubnews para WordPress é vulnerável à instalação não autorizada de plugins arbitrários devido à falta de verificação de capacidade na função pubnewsimporterpluginactionfornotice em todas as versões...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - Esecuzione SQL arbitraria non autenticata a esecuzione di codice remoto CVE-2024-43918 Il plugin WBW Product Table Pro per WordPress è vulnerabile a esecuzione SQL arbitraria non autorizzata a causa di una mancanza di controllo delle capacità su una...

CVE-2026-79996

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-12514

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

CVE-2026-79996

The User Registration & Membership WordPress plugin versions before 5.2.6 lack a capability check when saving login settings. An authenticated user with the plugin's management capability (but not full administrator access) can modify arbitrary site options to escalate privileges to administrator...

EUVD-2026-67575

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-12514

The Shared Files WordPress plugin (before 1.7.67 ) and shared-files-pro (before 1.7.70 ) lack a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce rendered on public pages. An unauthenticated visitor can therefore upload file...

EUVD-2026-67566

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page input...

CVE-2024-2782-PoC

CVE-2024-2782-PoC CVE-2024-2782 प्रूफ-ऑफ-कॉन्सेप्ट वर्डप्रेस के लिए क्विज़, सर्वे और ड्रैग एंड ड्रॉप WP फॉर्म बिल्डर प्लगइन के लिए फ्लुएंट फॉर्म्स द्वारा कॉन्टैक्ट फॉर्म प्लगइन, /wp-json/fluentform/v1/global-settings REST API एंडपॉइंट पर क्षमता जांच की कमी के कारण डेटा में अनधिकृत संशोधन की चपेट...

CVE-2024-2771-PoC

CVE-2024-2771-PoC CVE-2024-2771 Prova di concetto Il plugin Contact Form di Fluent Forms per Quiz, Sondaggi e Drag & Drop WP Form Builder per WordPress è vulnerabile all'escalation dei privilegi a causa della mancanza di un controllo delle capacità sull'endpoint REST API...

CVE-2022-0236

CVE-2022-0236 Das WP Import Export WordPress Plugin ist anfällig für die Offenlegung sensibler Daten ohne Authentifizierung, da eine fehlende Berechtigungsprüfung in der Download-Funktion wpieprocessfiledownload in der Datei /includes/classes/class-wpie-general.php vorhanden ist. Dies ermöglichte...

PoC_CVE-2025-2568

PoC CVE-2025-2568 Überblick Das Vayu Blocks – Gutenberg Blocks Plugin für WordPress & WooCommerce ist anfällig für unautorisierten Zugriff und Modifikation von Daten, da in den Versionen 1.0.4 bis 1.2.1 fehlende Berechtigungsprüfungen in den Funktionen vayublocksgettoggleswitchvaluescallback und...

CVE-2026-78138

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...