Lucene search
+L

9678 matches found

Kitploit
Kitploit
added 2026/08/26 1:06 a.m.1 views

CVE-2024-7703

CVE-2024-7703 root@kitploit: Эксплойт CVE-2024-7703: Сохранённый межсайтовый скриптинг XSS через загрузку SVG-файлов в плагине ARMember для WordPress Обзор Этот репозиторий содержит PoC-эксплойт для уязвимости, обозначенной как CVE-2024-7703. Уязвимость затрагивает плагин ARMember для WordPress, ...

6.4CVSS5.2AI score0.01142EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/26 12:45 a.m.1 views

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 任意ファイル削除 PoC ★ 説明 CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar = 5.7.0.1 – 認証済み(購読者以上)ユーザーによる欠落した認可に起因する任意ファイル削除 研究者 : Arkadiusz Hydzik 説明 : WordPress用プラグイン「MP3 Audio Player – Music Player, Podcast Player & Radio by...

8.1CVSS6.7AI score0.19326EPSS
SaveExploits1
Patchstack
Patchstack
added 2026/08/25 5:49 p.m.4 views

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

6.4CVSS5.1AI score0.00201EPSS
SaveExploits0References1Affected Software1
Kitploit
Kitploit
added 2026/08/25 1:43 p.m.2 views

CVE-2023-47504-POC

CVE-2023-47504 POC Эксплойт для CVE-2023-47504. Согласно NIST, эта уязвимость должна позволять неаутентифицированным пользователям получать доступ к функциям плагина Elementor Website Builder. Основываясь на моём исследовании уязвимости, а также судя по URL-адресу от Patchstack, описывающему...

9.8CVSS8.1AI score0.01452EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/25 1:24 p.m.1 views

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC Плагин InfiniteWP Client для WordPress версий до 1.11.1 включительно уязвим к утечке конфиденциальной информации. Эта уязвимость позволяет аутентифицированным злоумышленникам с правами подписчика или выше извлекать конфиденциальные данные, включая детали...

7.5CVSS6.8AI score0.23987EPSS
SaveExploits2
Cvelist
Cvelist
added 2026/08/25 11:27 a.m.12 views

CVE-2026-18547 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

6.4CVSS
SaveExploits0References8
CVE
CVE
added 2026/08/25 11:27 a.m.14 views

CVE-2026-18547

CVE-2026-18547 affects the Ultimate Member WordPress plugin in all versions up to and including 2.12.1 . Authenticated attackers with subscriber-level access or above can exploit a stored XSS (DOM-based) by injecting malicious JavaScript through a textarea profile field with HTML support. The roo...

6.4CVSS5.8AI score
SaveExploits0References8
Kitploit
Kitploit
added 2026/08/25 10:14 a.m.1 views

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - Повышение привилегий через REST API до RCE PoC Полный Затронутые версии: с 5.0.0 по 7.2.0 Требование к пользователю: подписчик Subscriber Метод: повышение привилегий до администратора и запуск RCE через REST API Конечная точка: /v1/members/me. Как использовать...

9CVSS0.13521EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/25 8:53 a.m.1 views

CVE-2025-14172-Nuclei-Template

📄 CVE-2025-14172 的 Nuclei 模板 🚀 概述 本仓库包含一个专门用于检测 WP Page Permalink Extension WordPress 插件中 缺失授权漏洞 CVE-2025-14172 的 Nuclei 模板。该漏洞允许经过身份验证的攻击者通过存在漏洞的 AJAX 操作远程刷新站点的重写规则。 🔍 漏洞描述 CVE-2025-14172 源于 WP Page Permalink Extension WordPress 插件中,cwpptriggerflushrewriterules 函数在挂接到...

6.5CVSS5.2AI score0.00382EPSS
SaveExploits1
NVD
NVD
added 2026/08/25 8:18 a.m.7 views

CVE-2026-18512

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

6.4CVSS0.00235EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/25 7:39 a.m.7 views

CVE-2026-18512

The TranslatePress WordPress plugin (multilingual/AI translation) is vulnerable to Stored XSS in all versions up to and including 3.2.6 . The root cause is insufficient input sanitization and output escaping of approved comment body content rendered in the Translation Editor Strings Dropdown comp...

6.4CVSS5.6AI score0.00235EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/25 7:39 a.m.5 views

EUVD-2026-65317

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

6.4CVSS5.5AI score0.00235EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/25 7:39 a.m.14 views

CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

6.4CVSS0.00235EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/25 7:39 a.m.7 views

CVE-2026-16601

CM Map Locations for WordPress (all versions ≤ 2.1.8 ) is vulnerable to limited arbitrary file upload via the cmloc_route_image_upload AJAX action. The uploadMedia function performs incomplete extension filtering without MIME-type checks or upload capability verification before calling move_uploa...

8.8CVSS6.4AI score0.00627EPSS
SaveExploits0References9
Kitploit
Kitploit
added 2026/08/25 7:32 a.m.3 views

ros2_CVE-2024-28231

Этот репозиторий содержит уязвимый Docker-образ ros2 iron на основе ubuntu 22 и соответствующий эксплойт. Мы эксплуатируем уязвимость в fastrtps версии 2.10.3, позволяющую осуществить отказ в обслуживании удаленного подписчика через переполнение буфера в куче. Уязвимый базовый образ Fast RTPS...

9.6CVSS5.2AI score0.00942EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/08/25 6:30 a.m.2 views

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Отсутствие авторизации для аутентифицированных Subscriber+ произвольных обновлений опций Описание Плагин Quietly Insights для WordPress уязвим к несанкционированному изменению данных, что может привести к повышению привилегий из-за отсутствия проверки пра...

8.8CVSS8.8AI score0.00765EPSS
SaveExploits0
NVD
NVD
added 2026/08/25 6:19 a.m.9 views

CVE-2026-78467

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

4.3CVSS0.00161EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/25 6:19 a.m.8 views

CVE-2026-78470

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

6.5CVSS0.00228EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.24 views

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

6.5CVSS5.6AI score0.01101EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/08/25 5:31 a.m.1 views

CVE-2025-15260

CVE-2025-15260: Отсутствие авторизации / Нарушенный контроль доступа в плагине MyRewards – баллы лояльности и вознаграждения для WooCommerce Отказ от ответственности: Этот репозиторий создан только для образовательных целей и этичного раскрытия. Уязвимость была ответственно сообщена разработчику ...

6.5CVSS5.8AI score0.00274EPSS
SaveExploits2
Rows per page
Query Builder