CVE-2021-38314

CVE-2021-38314 Python エクスプロイト 詳細 WordPress 用の Gutenberg Template Library & Redux Framework プラグイン PoC の例 - https://youtu.be/n1e4aFmXvOk リンク CVE-2021-38314...

CVE-2021-38314

CVE-2021-38314 脆弱性の概要 WordPress用プラグイン「Gutenberg Template Library & Redux Framework」バージョン4.2.11以下は、redux-core/class-redux-core.php の includes...

CVE-2021-38314

未经身份验证的敏感信息泄露 CVE-2021-38314 CVE-2021-38314的Python利用脚本 使用: python3 cve-2021-38314.py http://www.target.com Gutenberg Template Library & Redux Framework 插件 = 4.2.11 for WordPress 在 "redux-core/class-redux-core.php" 文件的 "includes" 函数中注册了多个 AJAX actions，这些 actions 可供未经身份验证的用户访问。这些 actions...

cve-2021-38314

cve-2021-38314 - 未認証の機密情報開示 WordPress用のGutenberg Template Library & Redux Framework プラグイン（= 4.2.11）は、redux-core/class-redux-core.php の includes 関数内で、未認証ユーザーが利用可能ないくつかのAJAXアクションを登録していました。これらのアクションは、特定のサイトに固有である一方、サイトURLのmd5ハッシュ（既知のソルト値 '-redux' を使用）と、その直前のハッシュのmd5ハッシュ（既知のソルト値 '-support'...

WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

WordPress Redux Framework plugin <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Redux Framework versions = 4.5.14...

CVE-2026-90992

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2026-90992 Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

EUVD-2026-90562

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2026-90992

The Redux Framework plugin for WordPress (versions up to and including 4.5.14 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping during the 'User Meta Merge' process via the 'user-mediaurl' media field. Authenticated attack...

WordPress Redux Framework plugin <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Attachment Deletion vulnerability discovered by Eunho Kim in WordPress Plugin Redux Framework versions = 4.5.14...

CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.14 . The root cause is a failure to properly verify user authorization for specific actions. Authenticated attackers with subscriber-level access and above can exploit this to...

CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-90501

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

cve-2021-38314

CVE-2021-38314 Python エクスプロイト 詳細 Gutenberg Template Library & Redux Framework プラグイン = 4.2.11 for WordPress は、redux-core/class-redux-core.php の includes 関数内で、認証されていないユーザーからアクセス可能ないくつかの AJAX アクションを登録していました。これらのアクションは特定のサイトに固有ですが、既知のソルト値 '-redux' を使用したサイト URL の md5 ハッシュと、既知のソルト値 '-support'...

WordPress Redux Framework plugin <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting vulnerability

Authenticated Subscriber+ Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13...

WordPress Redux Framework plugin <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam in WordPress Plugin Redux Framework versions = 4.5.13...

CVE-2026-5410

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the usermetasave function scalar values bypass the sanitization logic that on...