CVE-2026-8181

CVE-2026-8181 Burst Statistics | 인증 우회를 통한 관리자 계정 탈취 설명 : Burst Statistics 3.4.0 - 3.4.1.1 - 인증 우회를 통한 관리자 계정 탈취 WordPress용 Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative 플러그인은 버전 3.4.0부터 3.4.1.1까지 인증 우회Authentication Bypass 취약점에 노출됩니다. 이는 Authorization 헤더의...

CVE-2022-1421

CVE-2022-1421 CVE-2022-1421에 대한 개념 증명PoC Discy 참고 자료 https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249 https://vulners.com/cve/CVE-2022-1421...

WordPress WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPFunnels versions = 3.12.13...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2: хранимый XSS через Cookie CVE-2026-5513 — Bookly ≤ 27.2: хранимый XSS через Cookie CVE CVSS Тип Auth https://t.me/FreeToolsCpa Файл CVE в группе Обзор Поле Значение CVE ID CVE-2026-5513 Уязвимость Хранимая межсайтовая подмена...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Denial vulnerability discovered by Wordfence PRISM in WordPress Plugin Awesome Support versions = 6.3.9...

WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Неаутентифицированная произвольная загрузка файлов Описание : Плагин User Registration Advanced Fields для WordPress версии до 1.6.20 включительно уязвим к неаутентифицированной произвольной загрузке файлов через AJAX-действие...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon 과제 프로젝트 NT205.P21.ANTT 사이버 공격 Zerologon에 취약한 Windows Server 2019를 악용하고, 클라이언트 머신에서 Garble, Chisel, Evil-WinRM, Impacket 및 취약한 WordPress 플러그인을 사용 비디오 데모: https://www.youtube.com/watch?v=t-GOHGlP1to...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL-инъекция Time-Based Blind Отказ от ответственности: Этот репозиторий предназначен только для авторизованного тестирования на проникновение, исследований в области безопасности и образовательных целей. Несанкционированный доступ к компьютерным системам незаконен и...

hdwebmobile-booking-appointments

HDWebmobile 예약 및 약속 WooCommerce를 통해 예약 가능한 서비스와 약속을 판매하세요. 슬롯별 수용 인원이 초과 판매되지 않도록 보장합니다. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ 요구 사항: WordPress 6.9+, WooCommerce, PHP 7.4+ 라이선스: GPLv2 이상 설명 HDWebmobile 예약 및 약속은 모든 단순 WooCommerce 상품을 예약 가능한 서비스로 전환합니다. 고객은 ...

CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate 인증 없는 원격 코드 실행RCE -red.svg 치명적인 인증 없는 원격 코드 실행 CVSS 10.0 — Realtyna Organic IDX + WPL Real Estate ≤ 5.2.0 이 도구는 Realtyna Organic IDX + WPL Real Estate WordPress 플러그인의 CVE-2026-57811 치명적인 취약점을 악용합니다. 이 취약점은 인증되지 않은 공격자 가 더 이상 사용되지 않는 모바일 API...

CVE-2022-4140

CVE-2022-4140 - WordPress 플러그인 Welcart e-Commerce 2.8.5 - 임의 파일 읽기 이 저장소에는 CVE-2022-4140에 대한 PoCProof of Concept 익스플로잇이 포함되어 있습니다. 면책 조항 이 프로젝트는 교육 목적과 승인된 보안 테스트용으로만 제공됩니다. 소유하지 않았거나 테스트 권한이 없는 시스템에 사용하지 마십시오. 개요 이 플러그인은 파일 내용을 출력하는 데 사용하기 전에 사용자 입력을 검증하지 않으므로, 인증되지 않은 공격자가 서버에서 임의의 파일을 읽을 수 있습니...

CVE-2026-8732-PoC

CVE-2026-8732 — WP Maps Pro 未授权创建管理员账户 English | Türkçe 中文 概述 CVE-2026-8732 是 WP Maps Pro wp-google-map-gold WordPress 插件（版本 = 6.1.0）中的一个严重漏洞（CVSS 9.8）。 未认证的攻击者可以通过滥用 wpgmptempaccessajax AJAX 操作来创建 WordPress 管理员账户。保护该端点的 nonce 被公开嵌入在前端页面中，使其无法作为有效的访问控制机制。 作者： fientix & quake 功能特性 单目标 URL...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 — это критическая уязвимость PHP Object Injection с рейтингом CVSS 9.8 без аутентификации в плагине WordPress Everest Forms CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Плагин: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder...