1009 matches found
cve-2019-9787_csrf_poc
CVE-2019-9787 CSRF PoC Overview PoC of CVE-2019-9787 CSRF WordPress Version 5.0 refference Do not use this except for test purpose. Installation $ docker-compose up -d 1. access http://localhost:8080/ and install WordPress. you only have to create WP admin account. 2. access...
CVE-2026-65515
Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.35.0 versions...
CVE-2026-65577
WordPress Advice theme,
CVE-2026-65574 WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65541
The CVE concerns WordPress Plugin “Staff Training” versions
CVE-2026-65507
Summary: CVE-2026-65507 affects the WordPress AIWU plugin versions <= 1.5.6 and is described as an unauthenticated privilege escalation. What is affected: WordPress AIWU plugin (
EUVD-2026-53961
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
EUVD-2026-53942
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-18510 TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content URL-encoded gettext markers in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This make...
CVE-2026-18997 cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization
A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack...
CVE-2026-18895
A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
WordPress PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin <= 11.2.1 - Unauthenticated Sensitive Information Exposure vulnerability
Unauthenticated Sensitive Information Exposure vulnerability discovered by Win3 in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions = 11.2.1...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.5 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin Bookly versions = 27.5...
CVE-2026-66428
Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-65436 WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...