12741 matches found
WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by lqc in WordPress Plugin Super Socializer versions = 7.14.5...
Gitea Public Registration Enabled Detection
A misconfiguration in Gitea allows arbitrary users to sign up and read code hosted on the service. !/usr/bin/env python3 -- coding: utf-8 -- """A misconfiguration in Gitea allows arbitrary users to sign up and read code hosted on the service.""" from kittysploit import from...
Gitea Public Registration Enabled Detection
A misconfiguration in GlitchTip allows arbitrary users to sign up. !/usr/bin/env python3 -- coding: utf-8 -- """A misconfiguration in GlitchTip allows arbitrary users to sign up.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...
Lottie Player - Backdoor Detection
Detectes vulnerable compormised version of lottie-player JS Library that were compormised with a Web3 wallet pop-up backdoor. !/usr/bin/env python3 -- coding: utf-8 -- """Detectes vulnerable compormised version of lottie-player JS Library that were compormised with a Web3 wallet p.""" from...
T-Up OpenFrame Detection
Detects T-Up OpenFrame. !/usr/bin/env python3 -- coding: utf-8 -- """Detects T-Up OpenFrame.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'T-Up OpenFrame Detection', 'description': 'Detects T-Up OpenFrame.',...
WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin AffiliateWP versions = 2.35.0...
WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.10...
WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by qdtad in WordPress Plugin AIWU versions = 1.5.6...
CVE-2026-13161 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-13161
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...
CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by daroo in WordPress Theme Betheme versions = 28.4.2...
CVE-2026-16585
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...
CVE-2026-16811 ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-49658
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
PT-2026-65445
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message popup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and...
WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.1 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tutor LMS versions = 4.0.1...
CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...