Lucene search
+L

16125 matches found

Nuclei
Nuclei
added 2026/08/21 2:28 a.m.9 views

WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion

The Age Gate plugin for WordPress up to version 3.5.3 contains a local PHP file inclusion caused by the 'lang' parameter, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication. id: CVE-2025-2505 info: name: WordPress Age Gate = 3.5.3 -...

9.8CVSS9AI score0.04104EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.51 views

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

6.1CVSS6AI score0.01165EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.52 views

Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Uncanny Automator - Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...

8.8CVSS8.8AI score0.02474EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.18 views

Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lknpixforwoocommercec6savesettings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated...

9.8CVSS6.5AI score0.2506EPSS
SaveExploits12References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.75 views

WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting

The Easy Forms for Mailchimp plugin before version 6.8.9 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the sqlerror parameter before outputting it back in the page when the debug option is enabled, which could allow attackers to execute...

6.1CVSS6.2AI score0.01092EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.53 views

WordPress Symposium <=15.8.1 - Cross-Site Scripting

WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2015-9414 info: name:...

6.1CVSS5.8AI score0.03605EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.39 views

WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

9.8CVSS5.3AI score0.14608EPSS
SaveExploits12References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.19 views

SquirrelMail Address Add 1.4.2 - Cross-Site Scripting

SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

4.3CVSS5.5AI score0.03436EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.79 views

WP Google Maps < 7.10.43 - Cross-Site Scripting

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO. id: CVE-2019-9912 info: name: WP Google Maps 7.10.43 - Cross-Site Scripting author: ritikchaddha severity: medium description: | The wp-google-maps plugin before 7.10.43 for WordPress has XSS via t...

6.1CVSS5.9AI score0.03151EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.41 views

WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting

The WP-Lister Lite for Amazon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.6.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

7.1CVSS5.6AI score0.00624EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.29 views

WordPress GamiPress <= 2.5.7 - SQL Injection

The GamiPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.7 due to insufficient escaping on the user supplied parameter '$qv$fieldid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

9.8CVSS9.1AI score0.0257EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.28 views

MemberSpace WordPress - Cross-Site Scripting

MemberSpace WordPress plugin 2.1.14 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting unauthenticated attackers execute scripts, exploit requires no authentication. id: CVE-2024-13727 info: name: MemberSpace WordPress - Cross-Site Scripting author: Sourabh-Sah...

6.1CVSS8.7AI score0.0062EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.52 views

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

6.1CVSS5.6AI score0.03419EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.25 views

Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...

5.3CVSS6.6AI score0.03852EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/08/21 2:28 a.m.56 views

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. id: CVE-2022-2373 info: name: WordPress Simply Schedu...

5.3CVSS5.6AI score0.01475EPSS
SaveExploits2References5
NVD
NVD
added 2026/08/20 12:16 p.m.7 views

CVE-2026-66594

Subscriber SQL Injection in WordPress Persistent Login = 3.1.0 versions...

8.5CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/20 12:07 p.m.7 views

EUVD-2026-63310

Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...

6.5CVSS5.1AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/20 12:07 p.m.24 views

CVE-2026-66605 WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

7.1CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/20 12:06 p.m.35 views

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

9.8CVSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/08/20 7:55 a.m.8 views

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

5.4CVSS5.1AI score0.00162EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder