CVE-2021-42362

CVE-2021-42362 Il plugin WordPress Popular Posts di WordPress è vulnerabile a caricamenti arbitrari di file a causa di una validazione insufficiente del tipo di file in ingresso, individuata nel file /src/Image.php, che consente ad attaccanti con accesso di livello contributor o superiore di...

CVE-2025-11926

CVE-2025-11926 Wordpress-Related-Posts-Lite-plugin-XSS-PoC per il PoC: https://github.com/prabhatverma47/Wordpress-Related-Posts-Lite-plugin-XSS-PoC...

CVE-2026-81574

creationtimestamp| type| source ---|---|--- 2026-08-27 11:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu2p267o7c2l 2026-08-27 11:01:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ibazv6h46utsr...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e इस मॉड्यूल के लिए Metasploit आवश्यक है: वर्तमान स्रोत: MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q इस एक्सप्लॉइट के लिए Metasploit के पास एक FQDN होना चाहिए और पोर्ट 80, 443, या 8080 पर पेलोड वेब सर्वर चलाने की क्षमता होनी चाहिए। FQD...

CVE-2025-54352

CVE-2025-54352 PoC Verwendung Schritte zur Installation und zum Testen des WordPress PoC: 1. Installieren Sie eine frische Version von WordPress mit Docker: 1.1 Starten Sie den MySQL-Datenbankcontainer: root@kitploit: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e...

0x00sec_code

Codice sorgente per i post su 0x00sec.org Questo repository contiene il codice sorgente dei miei post su 0x00sec.org. Shell remota Post disponibile su: Parte I : https://0x00sec.org/t/remote-shells-part-i/269/1 Parte II. Cripta il tuo link:...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Iniezione di oggetti PHP non autenticata Descrizione Il plugin My Geo Posts Free per WordPress è vulnerabile all'iniezione di oggetti PHP nelle versioni fino alla 1.2 inclusa, tramite deserializzazione di input non attendibili. Ciò consente ad attaccanti n...

CVE-2026-13172

Eventin (WP Event Solution) WordPress plugin versions before 4.1.22 fail to restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending, and private posts belonging to other users, including the pa...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

CVE-2026-78683

creationtimestamp| type| source ---|---|--- 2026-08-25 02:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtuqytwvum2e 2026-08-25 02:34:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6kw3zehwcdngz 2026-08-25 04:08:25+00:00| seen|...

CVE-2026-78380 Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which...

CVE-2025-32579

⚠️ CVE-2025-32579 - RCE Critica tramite il Plugin Sync Posts WordPress 📦 Interessa: Sync Posts 🧨 Punteggio CVSS: 9.9 CRITICA 📁 Vettore CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Panoramica della Vulnerabilità Il plugin WordPress Sync Posts di SoftClever Limited è vulnerabile a una...

CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

CVE-2026-55704 Discourse: Shared-draft titles and excerpts leak through group post serialization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This...