CVE-2026-19855

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

WordPress YITH WooCommerce Waitlist Premium plugin <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin vulnerability

Authenticated Subscriber+ Privilege Escalation to Admin vulnerability discovered by Michele Genito in WordPress Plugin YITH WooCommerce Waitlist Premium versions = 3.35.0...

WordPress WP plugin Web plugin <= 2.3.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by sorin vasile in WordPress Plugin WP Plugin Web versions = 2.3.5...

WordPress WP plugin Crazy Domains plugin <= 2.5.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by sorin vasile in WordPress Plugin WP Plugin Crazy Domains versions = 2.5.2...

WordPress WP Module Data plugin <= 2.9.7 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by sorin vasile in WordPress Plugin WP Module Data versions = 2.9.7...

WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint vulnerability

Unauthenticated Authentication Bypass via Default 'token' Fallback in REST Migration Endpoint vulnerability discovered by Samuele Santonicola in WordPress Plugin Next-Cart Store to WooCommerce Migration versions = 3.9.8...

CVE-2026-3844

CVE-2026-3844 Mass Exploit CVE-2026-3844 – Breeze Cache WordPress =2.4.4 allows unauthenticated file upload via fetchgravatarfromremote when local gravatar hosting is enabled. Installation Download repository root@kitploit: git clone https://github.com/im-hanzou/CVE-2026-3844 Go to repository...

EUVD-2026-74726

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2016-15041-mainwp-dashboard

CVE-2016-15041 Lab - MainWP Dashboard Stored XSS Vulnerable lab for CVE-2016-15041: Unauthenticated stored XSS in MainWP Dashboard WordPress plugin = 3.1.2. Quickstart root@kitploit: docker compose up -d --build Wait 30 seconds for auto-setup. The lab prints a banner when ready: root@kitploit:...

cve-2019-14206-poc

CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File Deletion 📋 Index 1. About the Vulnerability 2. Prerequisites 3. Installation 4. Testing Methods Quick Test Full Test with Docker Test with Nuclei Manual Test 5. Interpreting Results 6. Cleanup 7. Troubleshooting 8. Mitigation 9. Legal...

CVE-2025-62950-PoC

Description This proof of concept PoC describes a Cross-Site Request Forgery CSRF vulnerability found in the Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2 plugin. The issue allows an attacker to trick an authenticated user into executing a crafted request that...

EUVD-2026-74724

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85117

Contact Form 7 Captcha WordPress plugin versions 0.1.7 through 0.1.8 are affected by an unauthenticated arbitrary shortcode execution vulnerability. The root cause is that the plugin runs the shortcode parser over the entire rendered Contact Form 7 form, including values submitted by a visitor du...

CVE-2026-85117 Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-83537 WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-80440 Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...

CVE-2026-19855 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

WordPress Hustle plugin < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Hustle versions 7.8.14.2...

EUVD-2026-74721

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

EUVD-2026-74722

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...