WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 es una vulnerabilidad crítica de inyección de objetos PHP no autenticada con CVSS 9.8 en el plugin Everest Forms de WordPress CVE-2026-3296 — Escáner de Inyección de Objetos PHP en Everest Forms Plugin: Everest Forms – Formulario de contacto, formulario de pago,...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF a Sobrescritura Arbitraria de Archivos en el Plugin Optimole de WordPress Resumen Una vulnerabilidad de Cross-Site Request Forgery CSRF en el plugin Optimole para WordPress versiones = 4.2.5 permite a atacantes no autenticados sobrescribir silenciosamente activos existentes d...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE 利用与缓解措施 CVE-2020-25213 📌 项目概述 本项目是为 IE4012 – 进攻性黑客战术与策略 模块开发的。 它在受控实验环境中演示了完整的网络安全攻击生命周期，包括： 社会工程攻击 恶意软件模拟 漏洞利用 VAPT 分析 安全补丁实施 🎯 目标漏洞 CVE 编号： CVE-2020-25213 漏洞： WordPress 文件管理器插件远程代码执行 严重性： 严重 CVSS 9.8 类型： 未认证文件上传 → 远程代码执行 🧪 实验环境...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability

Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

CVE-2026-2942

ProSolution WP Client — 未认证文件上传与RCE扫描器 插件: prosolution-wp-client 受影响版本: 漏洞类型: 未认证任意文件上传 → 远程代码执行 风险等级: 🔴 严重 CVSS 9.8 前置条件: 包含 prosolfrontend 短代码的公开页面 📌 关于漏洞 ProSolution WP Client 插件的 proSolfileUploadProcess AJAX 动作， 检查上传文件的 MIME 类型，但不验证扩展名。 攻击者可以将 .php 文件伪装成 image/jpeg MIME 类型发送， 从而在无需身份验证...

WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...

CVE-2026-0740-mass

CVE-2026-0740 — Motor de Explotación Masiva Autor: 0xNuts Colaborador: Cursor Repositorio: https://github.com/ExDev994/CVE-2026-0740-mass PoC para CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Subida Arbitraria de Archivos sin Autenticación que puede llevar a RCE. La vulnerabilidad inicial f...

WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WPAdverts versions = 2.3.3...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: DnD Upload CF7 插件中的未认证文件上传至远程代码执行漏洞 CVE-2026-5718 — DnD CF7 文件上传 RCE 扫描器 插件: Contact Form 7 的拖放式多文件上传插件 插件标识名: drag-and-drop-multiple-file-upload-contact-form-7 CVE ID: CVE-2026-5718 CVSS 评分: 8.1（高危） CVSS 向量: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 漏洞类型: 未认证任意文件上...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-2520

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...