CVE-2024-25092

CVE-2024-25092 漏洞利用 概述 CVE-2024-25092 是一个影响 WordPress NextMove Lite 插件（版本 = 2.17.0）的高严重性漏洞。该漏洞允许订阅者级别及以上的用户在 WordPress 站点上安装和激活任意插件，原因是缺少授权检查。 详情 发布日期 : 2024-06-09 更新日期 : 2024-06-09 严重性 : 高 CVSS 分数: 8.8 CWE : CWE-862 - 缺少授权 受影响版本 : 从 n/a 到 2.17.0 的所有版本 CVSS 向量 CVSS 版本 : 3.1 向量字符串 :...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

CVE-2024-10728

CVE-2024-10728 PostX var ultpoptionpanel =...

CVE-2023-36531

CVE-2023-36531 LiquidPoll – 面向创作者和品牌的高级投票插件 = 3.3.68 - 通过 activateaddon 缺失授权 信息 需要一个订阅者级别的用户，并且插件需要被禁用。 这将激活你提供的插件。 用法 root@kitploit: usage: CVE-2023-36531.py -h -w URL -u USERNAME -p PASSWORD -a ADDON WordPress CVE-2023-36531 Exploit options: -h, --help 显示此帮助信息并退出 -w URL, --url URL WordPress 站点的...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

CVE-2025-1639

🔓 CVE-2025-1639 漏洞利用脚本 📝 描述 WordPress 的 Animation Addons for Elementor Pro 插件在所有版本（包括 1.6）中，由于 installelementorpluginhandler 函数缺少权限检查，导致存在未经授权安装任意插件的漏洞。这使得经过身份验证的攻击者（具有订阅者级别及以上的访问权限）能够安装和激活任意插件，当目标站点未激活 Elementor 时，该漏洞可被利用来进一步感染受害者。 🔍 漏洞详情 CVE ID： CVE-2025-1639 发布时间： 2025-03-04 更新时间： 2025-03-04...

CVE-2023-45657

CVE-2023-45657 Nexter = 2.0.3 - Authenticated Subscriber+ SQL Injection via 'to' and 'from' Description: The Nexter theme for WordPress is vulnerable to SQL Injection via the 'to' and 'from' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied...

CVE-2025-9049

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

CVE-2025-9049 Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

EUVD-2025-210856

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

EUVD-2026-71992

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-15550

The Ninja Forms – Save Progress WordPress plugin (versions ≤ 3.0.30) is affected by a missing authorization flaw rooted in the absence of capability checks and nonce verification within the bulk_actions function. Authenticated users holding subscriber-level or higher permissions can leverage this...

CVE-2026-15550 Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

EUVD-2026-71935

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcapsaveconnectorsettings, wcapsendmanualemail,...

CVE-2026-84935

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84934

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...

CVE-2026-15247

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-14975

The WP File Download WordPress plugin (all versions up to and including 6.3.8 ) is vulnerable to Directory Traversal via the remoteurl parameter, discovered by 0xd4rk5id3 (EnvoraSec). An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta va...

CVE-2026-14975 WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the...

CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...