Lucene search
+L

92690 matches found

Kitploit
Kitploit
added 2026/09/14 6:24 a.m.6 views

CVE-2025-24587

CVE-2025-24587 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente Email Subscription Popup Versión vulnerable = 1.2.23 Slug del componente email-subscribe Enlace del componente https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Clase de...

7.6CVSS8AI score0.32237EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/14 6:23 a.m.9 views

CVE-2025-12674

CVE-2025-12674 KiotViet Sync = 1.8.5 - Carga Arbitraria de Archivos No Autenticada 🐚 KiotViet Sync = 1.8.5 - Carga Arbitraria de Archivos No Autenticada 📝 Descripción El plugin KiotViet Sync para WordPress versiones hasta 1.8.5 inclusive es vulnerable a la carga arbitraria de archivos, debido a l...

9.8CVSS5.9AI score0.00782EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/14 6:11 a.m.7 views

CVE-2024-54292

CVE-2024-54292 Appsplate = 2.1.3 - Inyección SQL no autenticada Descripción El plugin Appsplate para WordPress es vulnerable a la inyección SQL en versiones hasta la 2.1.3 inclusive, debido al escape insuficiente del parámetro proporcionado por el usuario y a la falta de preparación suficiente de...

9.3CVSS8.2AI score0.0079EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/14 6:00 a.m.7 views

CVE-2025-2011

CVE-2025-2011 - Vulnerabilidad de Inyección SQL en el Plugin Depicter Referencia CVE: CVE-2025-2011 Este repositorio contiene un entorno de prueba de concepto para probar la vulnerabilidad de inyección SQL en el plugin Depicter Slider & Popup Builder versiones 3.6.2. Requisitos previos Docker...

7.5CVSS8.2AI score0.46373EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/14 5:57 a.m.11 views

CVE-2021-25076

CVE-2021-25076-Exploit Plugin de WordPress WP User Frontend 3.5.26 - Inyección SQL Autenticado Descripción del CVE: El plugin de WordPress WP User Frontend anterior a la versión 3.5.26 no valida ni escapa el parámetro status antes de usarlo en una sentencia SQL en el panel de Suscriptores, lo que...

8.8CVSS7.9AI score0.1712EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/14 5:41 a.m.6 views

CVE-2023-40600

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Exposición de Información Sensible no Autenticada a través del Registro de Depuración Descripción El plugin EWWW Image Optimizer para WordPress es vulnerable a la Exposición de Información Sensible en todas las versiones hasta la 7.2.0 incluida, a...

7.5CVSS7.7AI score0.02036EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/14 5:34 a.m.6 views

CVE-2026-3300

CVE-2026-3300 - Everest Forms Pro Unauthenticated Stored Cross-Site Scripting Quick Usage root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: CRITICAL CVSS: 9.8 Impact: Confidentiality, Integrity, Availability Published:...

9.8CVSS6.7AI score0.39159EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/14 5:32 a.m.8 views

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Inyección SQL no autenticada a través del parámetro orderby Descripción El plugin Events Manager – Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a una inyección SQL basada en tiempo a través del parámetro 'orderby' en todas las versione...

7.5CVSS6AI score0.65562EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/14 5:23 a.m.7 views

CVE-2024-5084

Wordpress Hash Form – Drag & Drop Form Builder = 1.1.0 - Subida Arbitraria de Archivos No Autenticada que Permite Ejecución Remota de Código CVE-2024-5084 El plugin Hash Form – Drag & Drop Form Builder para WordPress es vulnerable a la subida arbitraria de archivos debido a la falta de validación...

9.8CVSS8.5AI score0.50653EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/09/14 5:20 a.m.14 views

fubucker

Fubucker | CVE-2022-1386 - Fusion Builder Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh Install JQ Linux : command apt-get install jq -y Windows : For WSL just d...

9.8CVSS8.1AI score0.71427EPSS
SaveExploits6References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.53 views

Duplicator < 1.4.7.1 - Information Disclosure

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. id: CVE-2022-2552 info: name: Duplicator 1.4.7.1 - Information Disclosure author:...

5.3CVSS5.9AI score0.11298EPSS
SaveExploits5References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.22 views

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...

6.5CVSS6.6AI score0.01153EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.31 views

WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Cross-Site Scripting

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability. id: CVE-2022-0429 info: name: W...

6.1CVSS6.3AI score0.01157EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.45 views

Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler

Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...

9CVSS6.2AI score0.02374EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.38 views

WP Google Maps < 9.0.48 - Cross-Site Scripting

WP Google Maps WordPress plugin 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads. id: CVE-2025-11307 info: name: WP Google Maps 9.0.48 - Cross-Site Scripting author: 0xAkoko severity:...

8.8CVSS6AI score0.01846EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.44 views

IP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure

IP2Location Country Blocker plugin for WordPress up to version 2.38.8 contains a regular information exposure caused by missing capability checks on admininit, letting unauthenticated attackers view plugin settings, exploit requires no special conditions. id: CVE-2025-1361 info: name: IP2Location...

7.5CVSS7.8AI score0.01287EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.46 views

Broadstreet WordPress plugin - Reflected XSS

Broadstreet WordPress plugin 1.51.8 contains a reflected XSS caused by unsanitised and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires victim interaction. id: CVE-2025-4652 info: name: Broadstreet WordPress plugin -...

6.1CVSS5.9AI score0.00514EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.40 views

RestroPress 3.0.0-3.2.1 - Authentication Bypass

RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including...

9.8CVSS7.9AI score0.02334EPSS
SaveExploits6References2
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.30 views

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

6.1CVSS6AI score0.00686EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/14 5:13 a.m.20 views

System Dashboard < 2.8.15 - Admin+ Path Traversal

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server id: CVE-2024-10708 info: name: System Dashboard 2.8.15 - Admin+ Path...

4.9CVSS8AI score0.0203EPSS
SaveExploits1References3
Rows per page
Query Builder