Lucene search
+L

10139 matches found

Nuclei
Nuclei
added 2026/09/02 7:49 a.m.57 views

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

6.1CVSS6.8AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.7 views

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

6.1CVSS6AI score0.00473EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.87 views

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS6.9AI score0.00845EPSS
SaveExploits1References4
CVE
CVE
added 2026/09/02 7:39 a.m.7 views

CVE-2026-75528

CVE-2026-75528 affects the Broken Link Checker plugin for WordPress in all versions up to and including 2.4.13 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping in the Comment Author URL / Link Log functionality. An unauthenti...

7.2CVSS6AI score
SaveExploits0References13
Kitploit
Kitploit
added 2026/09/02 1:42 a.m.7 views

CVE-2026-2002-poc

Resumen El complemento Forminator Forms – Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro formname en todas las versiones hasta la 1.50.2 inclusive, debido a una sanitización insuficiente de entrada y escape de...

4.4CVSS5.9AI score0.00166EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 12:44 a.m.4 views

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit El script CVE-2024-10793.yaml es necesario para buscar un plugin. El script CVE-2024-10793.sh es el exploit en sí. Para post-explotación, puedes usar beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log El plugin WP Activity Log para...

7.2CVSS7.3AI score0.01369EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/01 11:23 p.m.6 views

CVE-2025-0924-different

CVE-2025-0924 분석 중 나온 다른 취약점 01. Stored XSS와 WordPress,WP Activity Log 개요 1 Stored XSS와 WordPress,WP Activity Log 개요 Stored XSS는 악성 스크립트가 서버에 저장되어, 이후 다른 사용자들이 해당 페이지를 열 때 자동으로 실행되는 취약점이며 CWE-79Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'로 지정 되어있는 공격의 일종 입니다...

7.2CVSS7.2AI score0.01347EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/01 5:33 p.m.5 views

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Exigimos el regreso seguro de todos los ciudadanos que han sido tomados como rehenes por el grupo terrorista Hamás. No descansaremos hasta que cada rehén sea liberado y regrese a casa sano y salvo. Puedes ayudar a traerlos de vuelta a...

7.2CVSS7.2AI score0.70822EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/01 2:37 p.m.5 views

rcno-reviews

Reseñas de Libros Recencio Un plugin de WordPress para gestionar y mostrar reseñas de libros. Tipo de contenido personalizado, 7 taxonomías, 13 shortcodes, 7 widgets, 6 plantillas, 5 extensiones. Todos los datos almacenados en metadatos estándar de WordPress — sin tablas personalizadas...

6.5CVSS5.9AI score0.0037EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 12:31 p.m.11 views

CVE-2026-7877

WP Recipe Maker Premium for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in the wprm-call-to-action shortcode, affecting all versions up to and including 10.5.0 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes. Attackers with cont...

6.4CVSS6AI score
SaveExploits0References2
NVD
NVD
added 2026/09/01 10:17 a.m.7 views

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00334EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/01 10:17 a.m.6 views

CVE-2026-16788

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00334EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/01 9:28 a.m.8 views

EUVD-2026-69000

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

6.4CVSS6AI score0.00317EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/01 9:28 a.m.28 views

CVE-2026-15101 WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

6.4CVSS0.00317EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/01 9:28 a.m.9 views

EUVD-2026-68999

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6AI score0.00334EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/01 9:28 a.m.5 views

EUVD-2026-68998

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6AI score0.00334EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/01 9:28 a.m.27 views

CVE-2026-16786 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00334EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/01 6:16 a.m.10 views

CVE-2026-75964

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

6.1CVSS0.00219EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/01 6:16 a.m.10 views

CVE-2026-18488

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00329EPSS
SaveExploits0References11
EUVD
EUVD
added 2026/09/01 5:30 a.m.5 views

EUVD-2026-68985

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

6.1CVSS6AI score0.00219EPSS
SaveExploits0References6
Rows per page
Query Builder