Lucene search
+L

19661 matches found

Kitploit
Kitploit
added 2026/09/15 10:27 a.m.7 views

CVE-2025-5394

CVE-2025-5394 – Tema Alone de WordPress = 7.8.3 - Carga Arbitraria de Archivos No Autenticada mediante Instalación de Plugins 🔥 Resumen de la Vulnerabilidad El tema de WordPress Alone versiones = 7.8.3 es vulnerable a una vulnerabilidad de carga arbitraria de archivos no autenticada. Esta falla...

9.8CVSS6.3AI score0.52758EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/15 8:50 a.m.8 views

CVE-2024-13346

CVE-2024-13346 Avada Theme 7.11.14 - Ejecución arbitraria de shortcodes no autenticada CVE-2024-13346 script de explotación Código de instalación root@kitploit: git clone https://github.com/tausifzaman/CVE-2024-13346.git root@kitploit: cd CVE-2024-13346 root@kitploit: pip install -r...

9.8CVSS8.2AI score0.02297EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/15 8:27 a.m.7 views

cve-2025-50946

cve-2025-50946 Script de explotación para CVE-2025-50946 OliveTin get-theme RCE. Los requisitos de caracteres son exigentes y muchos comandos que incluyen múltiples argumentos pueden no ejecutarse correctamente. No he dedicado tiempo a investigar la causa raíz ni a hacer el script más robusto...

6.5CVSS8.2AI score0.013EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/09/15 8:00 a.m.13 views

WordPress-XStore-theme-SQL-Injection

WordPress-XStore-tema-SQL-Injection CVE-2024-33559 XStore tema-SQL Injection CVE-2024-33551 es una vulnerabilidad de inyección SQL encontrada en 8theme XStore, una plataforma de comercio electrónico construida sobre WordPress. Esta vulnerabilidad permite a los atacantes ejecutar comandos SQL...

9.8CVSS8.2AI score0.03553EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/15 7:43 a.m.5 views

CVE-2024-25600_Nuclei-Template

CVE-2024-25600Nuclei-Template 关于CVE-2024-25600的Nuclei模板和PoC信息 描述 📝 WordPress的Bricks主题在所有版本(包括1.9.6)中存在远程代码执行漏洞。这使得未经身份验证的攻击者能够在服务器上执行代码。 此模板 🛠️ 旨在使用nuclei检测Bricks Builder插件中发现的CVE-2024-25600漏洞 🕳️。该漏洞允许对受影响的网站进行未经身份验证的远程代码执行 💻。 概念验证(PoC) 📝...

10CVSS8.4AI score0.88234EPSS
SaveExploits19References1
Kitploit
Kitploit
added 2026/09/15 7:13 a.m.47 views

raven

Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Structure Offline - Demo Firefox, Chrome or Safari Live - Regression 500 attacks at onc...

5.8AI score
SaveExploits0References11
Patchstack
Patchstack
added 2026/09/15 6:46 a.m.8 views

WordPress Consulting - Business, Finance WordPress Theme theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation vulnerability

WordPress Consulting - Business, Finance WordPress Theme theme = 6.7.16 - Authenticated Subscriber+ Privilege Escalation vulnerability discovered by lhking in WordPress Theme Consulting versions = 6.7.16...

8.8CVSS
SaveExploits0References1Affected Software1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.75 views

WordPress JNews Theme <8.0.6 - Cross-Site Scripting

WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory. id: CVE-2021-24342 info: name: WordPress JNews Theme =8.0.6 to mitigate the XSS...

6.1CVSS6.2AI score0.01975EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.29 views

WordPress 15Zine <3.3.0 - Cross-Site Scripting

WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cbsa AJAX action. id: CVE-2020-36510 info: name: WordPress 15Zine 3.3.0 - Cross-Site Scripting author: veshraj...

6.1CVSS6.2AI score0.0259EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.21 views

Yellow Pencil Visual Theme Customizer < 7.2.1 - Privilege Escalation

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access. id: CVE-2019-11886 info: name: Yellow Pencil Visual Theme Customizer 7.2.1 - Privilege...

8.8CVSS7.7AI score0.0189EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.51 views

ScoreMe Theme - Cross-Site Scripting

WordPress ScoreMe theme through 2016-04-01 contains a reflected cross-site scripting vulnerability via the s parameter which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

5.4CVSS6.3AI score0.02796EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.31 views

Newspaper Theme 6.4–6.7.1 - Privilege Escalation

Newspaper Theme versions 6.4 to 6.7.1 for WordPress lacked proper options access control through tdajaxupdatepanel, which led to a Privilege Escalation vulnerability. id: CVE-2016-10972 info: name: Newspaper Theme 6.4–6.7.1 - Privilege Escalation author: pussycat0x severity: critical description:...

9.8CVSS8.1AI score0.09268EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.94 views

WordPress Jannah Theme <5.4.4 - Cross-Site Scripting

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. id: CVE-2021-24364 info: name: WordPress Jannah Theme 5.4.4 - Cross-Sit...

6.1CVSS6.2AI score0.01975EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.22 views

WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. id: CVE-2019-17231 info: name: WordPress OneTone theme = 3.0.6 – Unauthenticated Stored XSS author: daffainfo severity: medium description: | includes/theme-functions.php in the OneTone...

6.1CVSS6.2AI score0.01216EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.54 views

WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator- from n/a through 1.0.9. id: CVE-2023-47873 info: name: WordPress WP Child Theme Generator 1.1.3 - Arbitrary File Upload author: cysamu,Crux severity...

9.1CVSS8AI score0.02276EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.16 views

WordPress OneTone theme <= 3.0.6 – Unauthenticated Options Changes

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes. id: CVE-2019-17230 info: name: WordPress OneTone theme = 3.0.6 – Unauthenticated Options Changes author: daffainfo severity: medium description: | includes/theme-functions.php in...

5.3CVSS5.9AI score0.02362EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.17 views

WordPress tagDiv Composer < 3.5 - Authentication Bypass

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address id:...

9.8CVSS7.9AI score0.03828EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.284 views

WordPress Newspaper < 12 - Cross-Site Scripting

WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized...

6.1CVSS6.1AI score0.01018EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.131 views

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to chan...

9.8CVSS8.2AI score0.15524EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.33 views

WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery

The CAS WordPress theme through version 1.0.0 is vulnerable to Server-Side Request Forgery SSRF via the 'url' parameter in the getremotedata.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs. id: CVE-2024-4399 info: name: WordPre...

9.1CVSS6AI score0.01821EPSS
SaveExploits2References2
Rows per page
Query Builder