191 matches found
EUVD-2026-53908
Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...
WP < 7.0.3 - Subscriber+ Arbitrary Site Creation on Multisite
Description WordPress does not enforce the network registration policy in some cases, which could allow any authenticated user to create new sites on a multisite network where site registration is disabled...
CVE-2026-12720
The Kirki WordPress plugin (versions before 6.0.13 ) is vulnerable to PHP Object Injection because it fails to restrict which classes can be instantiated during the deserialization of data that unauthenticated users can store. This vulnerability is triggered when an administrator reviews the stor...
Exploit for Interpretation Conflict in Wordpress
wp2shell-hestia-scanner Read-only WordPress security scanner...
CVE-2026-65564
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...
EUVD-2026-49237
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...
BIT-WORDPRESS-MULTISITE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...
NPM: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
NPM: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...
Linux Distros Unpatched Vulnerability : CVE-2026-60137
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL...
WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE
Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
WordPress vulnerabilities can be addressed through Automattic.
There are two vulnerabilities present in WordPress Core 6.8.6, 6.9.5, and 7.0.2. An unauthorized malicious individual can exploit these vulnerabilities to execute arbitrary code remotely. To do this, a malicious HTTP request must be sent to the batch API of a WordPress site. Since vulnerabilities...
Exploit for CVE-2026-63030
wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...
wp2shell-poc
wp2shell PoC The first ever poc of the pre-auth timing-based...
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been published, a persistent-object-cache condition has surfaced, and a working proof-of-concept is public. The story below reflects all of it. An anonymous HTTP request can run code on a WordPress site. The bug is in...
VulnCheck KEV: CVE-2026-60137
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations...
NPM: OpenClaw: Embedded runner policy could be confused by provider aliases
NPM: OpenClaw: Embedded runner policy could be confused by provider aliases vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.24...
NPM: OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
NPM: OpenClaw's marketplace runtime extension metadata could point at unscanned payloads vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
CVE-2026-27402
Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...
