CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - activateplugin을 통한 인가 누락 설명 WordPress용 Square 테마는 AJAX 액션을 통해 호출되는 activateplugin 함수에 대한 권한 확인이 누락되어, 2.0.0을 포함한 이전 버전에서 허가되지 않은 플러그인 활성화에 취약합니다. 이로 인해 구독자 수준 이상의 액세스 권한을 가진 인증된 공격자가 임의의 플러그인을 활성화할 수 있습니다. Missing Authorization CVSS Vector...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

CVE-2024-25092

CVE-2024-25092 NextMove Lite 2.18.0 - Subscriber+ 권한으로 임의 플러그인 설치/활성화 설명: WordPress용 NextMove Lite – Thank You Page for WooCommerce 플러그인은 2.17.0 이하의 모든 버전에서 'xladdoninstallation' 함수에 대한 기능 권한 검사가 누락되어 데이터 무단 수정에 취약합니다. 이로 인해 구독자Subscriber 이상의 인증된 공격자가 임의의 플러그인을 설치하고 활성화할 수 있습니다. Severity: medium...

CVE-2023-36531

CVE-2023-36531 LiquidPoll – 제작자와 브랜드를 위한 고급 설문조사 = 3.3.68 - activateaddon을 통한 인증 누락 정보 구독자 수준의 사용자가 필요하며 플러그인이 비활성화되어 있어야 합니다. 이는 제공한 플러그인을 활성화합니다. 사용법 usage: CVE-2023-36531.py -h -w URL -u USERNAME -p PASSWORD -a ADDON WordPress CVE-2023-36531 Exploit options: -h, --help show this help message a...

js-jobs

js-jobs JS Job Manager 플러그인을 활성화하려면 여기에는 제한이 있습니다. 플러그인에 /.php 파일이 있어야 하며, 그렇지 않으면 활성화되지 않습니다: POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With:...

WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite

Description WordPress does not properly restrict plugin activation on Multisite in some cases, which could allow site administrators to activate an installed plugin network-wide...

WordPress Dokan plugin < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API vulnerability

Shop Manager+ Arbitrary Plugin Installation/Activation via REST API vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Dokan versions 5.0.14...

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin = 3.5.2 - Missing Authorization to Authenticated Delegated+ Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability discovered by skyv3il in WordPress Plugin Everest Forms...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The CVE concerns the Everest Forms WordPress plugin (Contact/Payment Form, Quiz, Survey & Custom Form Builder with AI) with authorization bypass in all versions up to 3.5.2. The root cause is inadequate verification of a user’s authorization to perform actions, enabling authenticated attackers wi...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-59862

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

PT-2026-73083

Name of the Vulnerable Software and Affected Versions Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI versions prior to 3.5.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372

The CVE concerns the WordPress plugins Tutor LMS Elementor Addons (

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...