Lucene search
+L

16140 matches found

Kitploit
Kitploit
added 2026/08/28 12:06 p.m.2 views

SSI-CVE-2022-21661

SSI-CVE-2022-21661 Secondo compito di Sicurezza dei Sistemi Informativi Studiare e sfruttare la vulnerabilità CVE-2022-21661 che consente SQL Injection tramite richieste POST dei plugin alle versioni di WordPress inferiori alla 5.8.3. Configurazione dell'ambiente Per avviare e configurare...

8CVSS8.1AI score0.97795EPSS
SaveExploits14References3
Kitploit
Kitploit
added 2026/08/28 8:55 a.m.4 views

CVE-2023-6553

CVE-2023-6553 Sviluppo di exploit per CVE-2023-6553 sul plugin Backup in WordPress Questa è una CVE critica con un punteggio CVSS di 9.8 La vulnerabilità consente a un attaccante di inviare comandi al server che esegue la versione vulnerabile del plugin Versione vulnerabile Backup = 1.3.7...

9.8CVSS7.2AI score0.97846EPSS
SaveExploits16
Kitploit
Kitploit
added 2026/08/28 7:57 a.m.1 views

wpscvn

wpscvn ist ein Tool für Pentester und Website-Betreiber, um zu testen, ob ihre Websites anfällige Plugins oder Themes haben. Der Autor übernimmt keinerlei Verantwortung für den Missbrauch dieses Tools. Denken Sie daran, dass Angriffe ohne vorherige Zustimmung illegal und strafbar sind. Erfordert:...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/28 7:03 a.m.2 views

CVE-2026-0920

Scanner CVE-2026-0920 Scanner basato su Python per rilevare e validare l'esposizione a CVE-2026-0920 in siti WordPress che utilizzano versioni vulnerabili del plugin LA-Studio Element. Panoramica Questo strumento è progettato per automatizzare l'identificazione di target WordPress potenzialmente...

9.8CVSS6.1AI score0.01097EPSS
SaveExploits5
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.95 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS4.7AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.25 views

WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure

Jordy Meow Perfect Images Manage Image Sizes, Thumbnails, Replace, Retina versions up to 6.4.5 contain a vulnerability that exposes sensitive information to unauthorized actors, letting attackers access confidential data, exploit requires no specific conditions. id: CVE-2023-44982 info: name:...

7.5CVSS7.8AI score0.01425EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.18 views

WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion

The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. id: CVE-2024-6460 info:...

9.8CVSS5.7AI score0.04826EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.57 views

LearnPress < 4.2.6.8.1 - Information Disclosure

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by incorrect implementation of getitemspermissionscheck function in all versions up to 4.2.6.8, letting unauthenticated attackers extract user emails and basic information. id: CVE-2024-5483 info: name: LearnPress...

5.3CVSS5.1AI score0.01008EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.24 views

Push Notification for Post and BuddyPress <= 1.93 - SQL Injection

Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to SQL Injection via the 'onesignalexternalid' and 'onesignalgetsubscriptionoptionsid' paramters in all versions up to, and including, 1.93 due to insufficient escaping on the user supplied parameter and lack of sufficie...

9.8CVSS5.9AI score0.02758EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.86 views

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

7.5CVSS7.4AI score0.02437EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.21 views

WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

9.8CVSS5.7AI score0.04458EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.83 views

Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

7.5CVSS9AI score0.02667EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.22 views

WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the album's name before outputting it in pages or posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting XSS attacks even when the unfiltered-html capabilit...

4.8CVSS5AI score0.009EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.17 views

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. id: CVE-2019-17232 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated Options Import and Export author: daffainfo severity: high description: |...

7.5CVSS8.1AI score0.03518EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.17 views

WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)

The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the "themestylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability. id: CVE-2025-6174 info: name: WordPress Qwizcards alert'randstr'" matchers...

6.1CVSS5.2AI score0.0046EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.24 views

WordPress Backup Migration <= 1.3.6 - Path Traversal

WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handledownloading function, letting unauthenticated attackers download backup files containing sensitive information. id: CVE-2023-6266 info: name: WordPress Backup Migration = 1.3.6 - Pat...

7.5CVSS7.8AI score0.02072EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.65 views

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.1CVSS7AI score0.01317EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.47 views

WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kunal Nagar Custom 404 Pro allows Reflected XSS.This issue affects Custom 404 Pro: from n/a through 3.11.1. id: CVE-2024-39646 info: name: WordPress Custom 404 Pro = 3.11.1 - Reflected XSS...

7.1CVSS5.2AI score0.00624EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.46 views

Podcast Channels < 0.28 - Cross-Site Scripting

The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability. id: CVE-2014-4544 info: name: Podcast Channels 0.28 - Cross-Site Scripting author: daffainfo severity: medium description: The Podcast Channels WordPress plugin was...

6.1CVSS5.7AI score0.03779EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.37 views

WP Responsive Images <= 1.0 - Arbitrary File Read

WP Responsive Images plugin for WordPress = 1.0 contains a path traversal caused by improper sanitization of the 'src' parameter, letting unauthenticated attackers read arbitrary files on the server. id: CVE-2026-1557 info: name: WP Responsive Images = 1.0 - Arbitrary File Read author: Shivam...

7.5CVSS5.5AI score0.01722EPSS
SaveExploits0References2
Rows per page
Query Builder