92448 matches found
CVE-2026-57811
CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate 未认证远程代码执行 -red.svg 严重未认证远程代码执行漏洞（CVSS 10.0）— Realtyna Organic IDX + WPL Real Estate ≤ 5.2.0 该工具利用 CVE-2026-57811 ，这是 Realtyna Organic IDX + WPL Real Estate WordPress 插件中的一个严重漏洞，允许未认证攻击者 通过一个已弃用的移动 API 端点上传恶意 Web Shell，并以 Web 服务器用户身份执行任意系统命令。...
CVE-2022-4140
CVE-2022-4140 - WordPress 插件 Welcart e-Commerce -f --disable-version-check python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd 示例 root@kitploit: └─$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd 正在检查目标是否存在漏洞 + 检测到插件版本：2.8.4 + 目标存在漏洞 正在尝试读取任意文件...
CVE-2026-8732-PoC
CVE-2026-8732 — WP Maps Pro 未授权创建管理员账户 English | Türkçe 中文 概述 CVE-2026-8732 是 WP Maps Pro wp-google-map-gold WordPress 插件（版本 = 6.1.0）中的一个严重漏洞（CVSS 9.8）。 未认证的攻击者可以通过滥用 wpgmptempaccessajax AJAX 操作来创建 WordPress 管理员账户。保护该端点的 nonce 被公开嵌入在前端页面中，使其无法作为有效的访问控制机制。 作者： fientix & quake 功能特性 单目标 URL...
WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...
WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...
WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability
Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability
Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...
WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...
WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...
CVE-2026-3296
CVE-2026-3296 CVE-2026-3296 是 Everest Forms WordPress 插件中的一个 CVSS 9.8 严重级别的未认证 PHP 对象注入漏洞 CVE-2026-3296 — Everest Forms PHP 对象注入扫描器 插件： Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder 插件别名（Slug）： everest-forms CVE ID： CVE-2026-3296 CVSS 评分： 9.8（严重） CVSS 向量：...
CVE-2026-11784-Optimole-CSRF
CVE-2026-11784: Optimole WordPressプラグインにおけるCSRFから任意ファイル上書きへの脆弱性 概要 WordPress用Optimoleプラグイン（バージョン4.2.5以下）におけるクロスサイトリクエストフォージェリ（CSRF）の脆弱性により、nonce検証の欠如のため、認証されていない攻撃者がwpajaxoptmlreplacefile AJAXアクションを介して既存のメディアライブラリアセットをサイレントに上書きすることが可能です。 CVE ID : CVE-2026-11784 脆弱性タイプ : クロスサイトリクエストフォージェリ（CSRF）...
wordpress-rce-vapt-cve-2020-25213
WordPress: Explotación y Mitigación de RCE CVE-2020-25213 📌 Resumen del Proyecto Este proyecto fue desarrollado como parte del módulo IE4012 – Tácticas y Estrategias de Hacking Ofensivo. Demuestra un ciclo de vida completo de un ataque cibernético en un entorno de laboratorio controlado,...
WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability
Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...
WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability
Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...
WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability
Captcha Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...
CVE-2026-2942
ProSolution WP Client — 未认证文件上传与RCE扫描器 插件: prosolution-wp-client 受影响版本: 漏洞类型: 未认证任意文件上传 → 远程代码执行 风险等级: 🔴 严重 CVSS 9.8 前置条件: 包含 prosolfrontend 短代码的公开页面 📌 关于漏洞 ProSolution WP Client 插件的 proSolfileUploadProcess AJAX 动作， 检查上传文件的 MIME 类型，但不验证扩展名。 攻击者可以将 .php 文件伪装成 image/jpeg MIME 类型发送， 从而在无需身份验证...
WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability
Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...
CVE-2026-0740-mass
CVE-2026-0740 — Motor de Explotación Masiva Autor: 0xNuts Colaborador: Cursor Repositorio: https://github.com/ExDev994/CVE-2026-0740-mass PoC para CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Subida Arbitraria de Archivos sin Autenticación que puede llevar a RCE. La vulnerabilidad inicial f...