CVE-2022-1329

CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...

CVE-2023-6700

CVE-2023-6700 Cookie Information | Free GDPR Consent Solution = 2.0.22 - Authenticated Subscriber+ Arbitrary Options Update Description: CVE-2023-6700 The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability che...

CVE-2020-12077

CVE-2020-12077 MapPress Maps Pro 2.53.9 - Remote Code Execution RCE due to Incorrect Access Control in AJAX Actions Description The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’,...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★ Description CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p Example python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u...

CVE-2024-9234

CVE-2024-9234 GutenKit = 2.1.0 - Unauthenticated Arbitrary File Upload Description The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the...

CVE-2024-52382

CVE-2024-52382 Matix Popup Builder = 1.0.0 - Unauthenticated Arbitrary Options Update Description The Matix Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a function in all versions u...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - Exécution SQL Arbitraire Non Authentifiée menant à une Exécution de Code à Distance CVE-2024-43918 Le plugin WBW Product Table Pro pour WordPress est vulnérable à une exécution SQL arbitraire non autorisée en raison d’un manque de vérification des capacit...

CVE-2023-45828

CVE-2023-45828 RumbleTalk Live Group Chat = 6.1.9 - Autorisation manquante via handleRequest Description: Le plugin RumbleTalk Live Group Chat pour WordPress est vulnérable à l'accès non autorisé aux données, à la modification des données et à la perte de données en raison d'un contrôle de capaci...

CVE-2024-50475

CVE-2024-50475 Signup Page = 1.0 - Unauthenticated Arbitrary Options Update Description: The Signup Page plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in all versions up to, and including, 1.0. This...

CVE-2024-56071

🚨 Simple Dashboard = 2.0 - Escalade de Privilèges Non Authentifiée 📄 Description Le plugin Simple Dashboard pour WordPress est vulnérable à l'Escalade de Privilèges dans toutes les versions jusqu'à la 2.0 incluse. Cela permet à des attaquants non authentifiés d'élever leurs privilèges à ceux d'un...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce = 1.5.0 - Téléchargement Arbitraire de Fichier Non Authentifié 💣 Pix for WooCommerce = 1.5.0 – Téléchargement Arbitraire de Fichier Non Authentifié CVE-2026-3891 👤 Nxploited 🧩 Description Le plugin Pix for WooCommerce pour WordPress est vulnérable à un...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Отсутствие авторизации, позволяющее аутентифицированным пользователям Подписчик+ произвольно устанавливать/активировать плагины Описание: Плагин Qode Essential Addons для WordPress уязвим к несанкционированной модификации данных из-за отсутствия...

CVE-2025-5288

🚨 REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - 인증 누락으로 인한 인증되지 않은 권한 상승 📋 설명 WordPress용 REST API | Custom API Generator For Cross Platform And Import Export In WP 플러그인은 1.0.0 2.0.3 버전에서 processhandler 함수에 대한 기능 점검 누락으로 인해 권한 상승 에 취약합니다. 이로 인해 인증되지 않은...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Proof of Concept This is a proof of concept PoC exploit for CVE-2023-3124, a vulnerability in WordPress Elementor Pro plugin. Description: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the...

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Exécution de code à distance Description Le plugin SEO LAT Auto Post pour WordPress est vulnérable à l'écrasement de fichier en raison d'un contrôle de capacité manquant sur l'action AJAX remoteupdate dans toutes les versions jusqu'à 2.2.1 incluse. Cela permet à des...

CVE-2026-85004

The Popup Maker WordPress plugin (versions through 1.4.5 ) is vulnerable to a missing authorization flaw due to a failure to perform a capability check on the sgpm_connect account-connection action. While the plugin verifies a nonce, it fails to restrict access to specific roles, allowing authent...

CVE-2024-12252

CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Отсутствие авторизации при перезаписи/загрузке файлов удалённое выполнение кода Описание Плагин SEO LAT Auto Post для WordPress уязвим к перезаписи файлов из-за отсутствия проверки прав на AJAX-действии remoteupdate во всех версиях до 2.2.1 включительно...