Lucene search
+L

2387 matches found

Kitploit
Kitploit
added 2026/09/15 10:17 a.m.8 views

CVE-2024-2876

CVE-2024-2876 脆弱性の説明: Icegram ExpressのEmail Subscribers – Email Marketing, Newsletters, Automation for WordPress &...

9.8CVSS8.4AI score0.80596EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/15 5:47 a.m.12 views

CVE-2021-25076

CVE-2021-25076-エクスプロイト Wordpress プラグイン WP User Frontend 3.5.26 - SQLインジェクション 認証済み CVE 説明: バージョン3.5.26以前のWordpressプラグインWP User Frontendは、SubscribersダッシュボードでSQL文で使用する前にstatusパラメータを検証およびエスケープしないため、SQLインジェクションが発生します。サニタイズとエスケープの欠如により、これは反射型クロスサイトスクリプティング(XSS)にもつながる可能性があります。...

8.8CVSS7.9AI score0.1712EPSS
SaveExploits6References1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.301 views

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

9.8CVSS8AI score0.80596EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.87 views

Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash

Email Subscribers by Icegram Express = 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter. id: CVE-2024-4295 info: name: Email Subscribers by Icegram Express = 5.7.20 - Unauthenticated SQL Injection via Hash author: iamnoooob,rootxharsh,pdresearch severity:...

9.8CVSS8AI score0.10161EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.31 views

Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting

The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. id: CVE-2017-18502 info: name: Subscriber by BestWebSoft 1.3.5 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. impact: |...

6.1CVSS6.2AI score0.01652EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.50 views

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

8.8CVSS7.7AI score0.04156EPSS
SaveExploits3References2
Kitploit
Kitploit
added 2026/09/15 4:11 a.m.10 views

CVE-2024-4295-Poc

CVE-2024-4295-PoC CVE-2024-4295 Icegram Express の Email Subscribers editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

9.8CVSS8.2AI score0.10161EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/15 3:50 a.m.8 views

CVE-2024-2876

CVE-2024-2876 - Email Subscribers by Icegram Express における SQL インジェクションの脆弱性 概要 CVE-2024-2876 は、WordPress 用プラグイン「Email Subscribers by Icegram Express」で発見された重大なセキュリティ脆弱性です。この脆弱性は 5.7.14 以前のすべてのバージョンに影響し、90,000 以上のウェブサイトに重大なリスクをもたらします。 脆弱性の詳細 CVE-ID : CVE-2024-2876 CVSS スコア : 9.8(緊急) 影響を受けるバージョン :...

9.8CVSS8.4AI score0.80596EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/15 1:50 a.m.7 views

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

9.8CVSS8.2AI score0.10161EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/14 10:43 p.m.4 views

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT WordPressプラグイン「Email Subscribers & Newsletters」のバージョン4.3.1以前には、ハッシュパラメータを介してデータベースにSQL文を渡すことが可能な脆弱性(ブラインドSQLインジェクション)が存在していました。 このスクリプトは、@KBA@SOGETIESECによって作成されたexploit-db.comで入手可能なオリジナルスクリプトの「sanized-version」です。オリジナルバージョンはRaidForums.comでサナタイズされました。 コマンド $ git clone...

9.8CVSS7.7AI score0.8511EPSS
SaveExploits7References1
Kitploit
Kitploit
added 2026/09/13 11:00 p.m.3 views

CVE-2024-2876

CVE-2024-2876 - Email Subscribers by Icegram Express 插件中的 SQL 注入漏洞 概述 CVE-2024-2876 是在 WordPress 的 "Email Subscribers by Icegram Express" 插件中发现的一个严重安全漏洞。该漏洞影响 5.7.14 及更早版本,对超过 90,000 个网站构成重大风险。 漏洞详情 CVE 编号 :CVE-2024-2876 CVSS 评分 :9.8(严重) 受影响版本 :5.7.14 及更早版本 已修复版本 :5.7.15 及以上版本 描述 该漏洞是一个 SQL...

9.8CVSS0.80596EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/12 3:47 p.m.11 views

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ ブラインドSQLインジェクション 必須条件 sqlmapがインストールされていることと、subscriber+権限を持つ有効なユーザー名とパスワードが必要です。 使用方法 root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w...

8.8CVSS7.7AI score0.04156EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/12 12:46 p.m.8 views

CVE-2023-5070

CVE-2023-5070 Social Media Share Buttons & Social Sharing Icons = 2.8.5 - 情報漏洩 説明: WordPress用プラグイン Social Media Share Buttons & Social Sharing Icons は、バージョン2.8.5以前において、sfsisaveexport関数を介して機密情報漏洩の脆弱性があります。これにより、購読者がソーシャルメディアの認証トークンやシークレット、さらにアプリパスワードを含むプラグイン設定をエクスポートできる可能性があります。 root@kitploit:...

6.5CVSS7AI score0.01201EPSS
SaveExploits1
NVD
NVD
added 2026/09/11 7:16 a.m.10 views

CVE-2026-86781

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

5.3CVSS0.00118EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/11 6:00 a.m.17 views

CVE-2026-86781

SSL Zen — SSL Certificate Installer & HTTPS Redirects, a WordPress plugin, is vulnerable to TLS private key disclosure in versions before 4.7.40 . The root cause is missing capability or nonce checks on a certificate-file download routine that executes early in the WordPress admin request lifecyc...

5.3CVSS0.00118EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 5:41 a.m.10 views

wordpress-exploits

wordpress-exploits ランダムなWordPressエクスプロイト。動作する場合と動作しない場合があります。 CVE-2019-19985 情報 root@kitploit: Description: Unauthenticated File Download w/ Information Disclosure CVE ID: CVE-2019-19985 CVSS v3.0 Score: 5.8 Medium CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Affected Plugin:...

5.8CVSS6.5AI score0.71399EPSS
SaveExploits4
CVE
CVE
added 2026/09/10 1:05 p.m.13 views

CVE-2026-88871

WWBN AVideo 's CustomizeUser plugin (enabled by default) contains a CSRF vulnerability in the setSubscribers.json.php endpoint, affected through commit c3edcc274c (master, 2026-08-23). The endpoint reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without re...

5.3CVSS0.00137EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/09/08 8:12 a.m.6 views

WordPress Email Subscribers & Newsletters plugin <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability

Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability discovered by Sander Horsman - Conda Security in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.27...

6.5CVSS0.00331EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/09/07 2:16 p.m.5 views

CVE-2026-12757

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

6.5CVSS0.00331EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/09/07 1:28 p.m.30 views

CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

6.5CVSS0.00331EPSS
SaveExploits0References9
Rows per page
Query Builder