Lucene search
+L

9590 matches found

Kitploit
Kitploit
added 2026/09/13 2:50 p.m.7 views

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Ejecución arbitraria de shortcode no autenticada Descripción: El plugin MDTF – Meta Data and Taxonomies Filter para WordPress es vulnerable a la ejecución arbitraria de shortcodes en todas las versiones hasta la 1.3.3.4...

9.8CVSS5.9AI score0.01175EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 6:27 a.m.8 views

CVE-2024-13346

CVE-2024-13346 Avada Theme 7.11.14 - Ejecución arbitraria de shortcodes no autenticada CVE-2024-13346 script de explotación Código de instalación root@kitploit: git clone https://github.com/tausifzaman/CVE-2024-13346.git root@kitploit: cd CVE-2024-13346 root@kitploit: pip install -r...

9.8CVSS8.2AI score0.02297EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 4:53 a.m.9 views

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia para WordPress, BuddyPress y bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

8.8CVSS5.9AI score0.01405EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 2:25 a.m.8 views

CVE-2025-7431

Proof of Concept – CVE-2025-7431 Knowledge Base = 2.3.1 - Authenticated Administrator+ Stored Cross-Site Scripting via Plugin Slug...

4.4CVSS5.9AI score0.00261EPSS
SaveExploits0
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.44 views

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

9.8CVSS8.3AI score0.01933EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.35 views

WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

7.3CVSS6.4AI score0.01458EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.29 views

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

9.8CVSS6AI score0.03225EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.57 views

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

9.8CVSS6.4AI score0.52266EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.71 views

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

7.3CVSS8.3AI score0.01888EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/13 2:04 a.m.56 views

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

6.1CVSS6.3AI score0.01165EPSS
SaveExploits2References3
Kitploit
Kitploit
added 2026/09/12 6:04 p.m.5 views

CVE-2024-6386

CVE-2024-6386 - RCE via Twig SSTI en WPML PoC PoC en Python+Selenium Investigación detallada en ruso: CVE-2024-6386 CVSS Puntuación base: 9.9 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Resumen En WPML tienes disponible el uso de Shortcodes de WordPress específicos que te permiten crear...

9.9CVSS8.4AI score0.25533EPSS
SaveExploits3References1
Kitploit
Kitploit
added 2026/09/12 4:31 p.m.5 views

CVE-2024-3105-PoC

CVE-2024-3105 PoC El plugin Woody code snippets – Insert Header Footer Code, AdSense Ads para WordPress es vulnerable a Ejecución Remota de Código en todas las versiones hasta, e incluyendo, la 2.5.0 a través del shortcode 'insertphp'. Esto se debe a que el plugin no restringe el uso de la...

9.9CVSS6.2AI score0.02778EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/12 4:16 p.m.10 views

CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Shortcode Addons = 3.2.5 – Authenticated Admin+ Arbitrary File Upload CVE ID: CVE-2024-31114 CVSS Score: 9.1 Critical 🛠️ Vulnerability Description The Shortcode Addons – with Visual Composer, Divi, Beaver Builder, and Elementor Extension...

9.1CVSS8.1AI score0.01353EPSS
SaveExploits1
EUVD
EUVD
added 2026/09/12 7:39 a.m.9 views

EUVD-2026-76831

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

6.5CVSS0.00287EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/12 7:39 a.m.18 views

CVE-2026-85198

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin is vulnerable to SQL injection via URL path in versions up to and including 4.2.1 , caused by insufficient escaping and lack of prepared statements on a user-supplied parameter. Despite the title referencing...

6.5CVSS0.00287EPSS
SaveExploits0References8
NVD
NVD
added 2026/09/12 6:16 a.m.11 views

CVE-2026-87919

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

4.9CVSS0.00193EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/12 6:16 a.m.12 views

CVE-2026-86790

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

6.8CVSS0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/12 6:16 a.m.11 views

CVE-2026-83532

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

6.8CVSS0.00235EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/12 6:00 a.m.10 views

EUVD-2026-76807

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...

4.9CVSS0.00193EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/12 6:00 a.m.17 views

CVE-2026-87919

The Product XML Feed Manager for WooCommerce WordPress plugin (versions before 3.1.1 ) contains a missing access-control flaw in its product shortcode handler. The plugin neither restricts which object method the shortcode may invoke nor validates the user's capability over the targeted product. ...

4.9CVSS0.00193EPSS
SaveExploits0References1
Rows per page
Query Builder