Lucene search
+L

10139 matches found

Kitploit
Kitploit
added 2026/09/02 1:15 p.m.7 views

CVE-2026-2002-poc

概述 Forminator Forms – Contact Form, Payment Form & Custom Form Builder 插件(WordPress)在所有版本中(包括 1.50.2)存在存储型跨站脚本漏洞,该漏洞通过 formname 参数触发,原因是输入清理和输出转义不足。这使得拥有管理员级别权限的认证攻击者能够在页面中注入任意 Web 脚本,当用户访问被注入的页面时脚本将执行。该插件允许管理员将表单管理权限授予较低级别的用户,因此订阅者等用户也有可能利用此漏洞。 根因 该根因需要对逻辑漏洞的敏锐意识: (位于文件 /fields/html.php 中的函数)...

4.4CVSS5.9AI score0.00166EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.7 views

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

6.1CVSS6AI score0.00473EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.57 views

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

6.1CVSS6.8AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.87 views

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS6.9AI score0.00845EPSS
SaveExploits1References4
CVE
CVE
added 2026/09/02 7:39 a.m.7 views

CVE-2026-75528

CVE-2026-75528 affects the Broken Link Checker plugin for WordPress in all versions up to and including 2.4.13 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping in the Comment Author URL / Link Log functionality. An unauthenti...

7.2CVSS6AI score
SaveExploits0References13
Kitploit
Kitploit
added 2026/09/02 12:44 a.m.4 views

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 PoC 漏洞利用 CVE-2024-10793.yaml 脚本用于搜索插件。 CVE-2024-10793.sh 脚本是漏洞利用脚本本身。 在后渗透阶段,你可以使用 beef-xss。 Google dork: inurl:wp-content/plugins/wp-security-audit-log WordPress 的 WP Activity Log 插件在 5.2.1 及之前的所有版本中,由于对 userid 参数的输入清理和输出转义不足,存在存储型跨站脚本(Stored Cross-Site...

7.2CVSS7.3AI score0.01369EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/01 11:23 p.m.6 views

CVE-2025-0924-different

CVE-2025-0924分析中出现的其他漏洞 01. 存储型XSS与WordPress、WP Activity Log 概述 1 存储型XSS与WordPress、WP Activity Log 概述 存储型XSS是一种恶意脚本存储在服务器上,之后其他用户打开相应页面时自动执行的漏洞,属于CWE-79(网页生成过程中输入未正确中和('跨站脚本'))指定的攻击类型。 WordPress是全球最受欢迎的开源内容管理系统(CMS),使用户能够轻松构建和管理网站及博客。即使用户没有代码知识,也可以通过各种插件和主题扩展和定制网站。 WP Activity...

7.2CVSS7.2AI score0.01347EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/01 5:33 p.m.5 views

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我们要求所有被恐怖组织哈马斯劫持的公民安全返回。在所有被劫持者获释并安全回家之前,我们决不罢休。你可以帮助他们回家。https://stories.bringthemhomenow.net/ CVE-2024-4439 漏洞利用:WordPress 核心中的未经过身份验证的存储型跨站脚本漏洞 🔐 CVE 编号: CVE-2024-4439 📝 描述: 在 WordPress Core 6.5.1 及以下版本中发现了一个严重的安全漏洞,编号为 CVE-2024-4439。该漏洞是一个存储型跨站脚本 XSS...

7.2CVSS7.2AI score0.70822EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/01 2:37 p.m.5 views

rcno-reviews

Reseñas de Libros Recencio Un plugin de WordPress para gestionar y mostrar reseñas de libros. Tipo de contenido personalizado, 7 taxonomías, 13 shortcodes, 7 widgets, 6 plantillas, 5 extensiones. Todos los datos almacenados en metadatos estándar de WordPress — sin tablas personalizadas...

6.5CVSS5.9AI score0.0037EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 12:31 p.m.11 views

CVE-2026-7877

WP Recipe Maker Premium for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in the wprm-call-to-action shortcode, affecting all versions up to and including 10.5.0 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes. Attackers with cont...

6.4CVSS6AI score
SaveExploits0References2
NVD
NVD
added 2026/09/01 10:17 a.m.7 views

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00334EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/01 10:17 a.m.6 views

CVE-2026-16788

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00334EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/01 9:28 a.m.8 views

EUVD-2026-69000

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

6.4CVSS6AI score0.00317EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/01 9:28 a.m.29 views

CVE-2026-15101 WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

6.4CVSS0.00317EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/01 9:28 a.m.9 views

EUVD-2026-68999

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6AI score0.00334EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/01 9:28 a.m.5 views

EUVD-2026-68998

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS6AI score0.00334EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/01 9:28 a.m.28 views

CVE-2026-16786 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00334EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/01 6:16 a.m.10 views

CVE-2026-75964

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

6.1CVSS0.00219EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/01 6:16 a.m.10 views

CVE-2026-18488

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00329EPSS
SaveExploits0References11
EUVD
EUVD
added 2026/09/01 5:30 a.m.5 views

EUVD-2026-68985

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

6.1CVSS6AI score0.00219EPSS
SaveExploits0References6
Rows per page
Query Builder