CVE-2025-39459-Nuclei-Template

📄 Template de Nuclei para CVE-2025-39459 🚀 Descripción general Este repositorio contiene un template de Nuclei diseñado específicamente para detectar una Vulnerabilidad de Elevación de Privilegios No Autenticada CVE-2025-39459 en el Tema Real Estate 7 de WordPress. Este problema permite a atacant...

CVE-2024-43998

CVE-2024-43998 root@kitploit: Blogpoet = 1.0.2 - Missing Authorization via blogpoetinstallandactivateplugins Published: 2024-08-29 00:00:00 Classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N cvss-score: 5.3 cve-id: CVE-2024-43998 cpe: cpe:2.3:a:blogpoet:blogpoet::::::::...

CVE-2024-8682

CVE-2024-8682 - PoC de Registro No Autenticado en JNews JNews = 11.6.6 tiene una vulnerabilidad que permite el registro de usuarios no autenticados a través del endpoint ?ajax-request=jnews, incluso cuando el registro de WordPress está desactivado. Esto funciona obteniendo primero un jnewsnonce...

CVE-2024-32444

CVE-2024-32444 As of 24/01/25 this vulnerabiltiy does not have a patch hence this is simply a product detection template as all products associated with the RealHome wordpress theme are vulnerable. The theme allows users to register new accounts via the inspiryajaxregister function, however, it...

CVE-2024-10470

CVE-2024-10470 WPLMS Learning Management System pour WordPress = 4.962 – Lecture et suppression de fichiers arbitraires non authentifiées Description Le thème WPLMS Learning Management System pour WordPress, un thème WordPress LMS, est vulnérable à la lecture et à la suppression arbitraires de...

CVE-2026-13159

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user w...

CVE-2026-13159 Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user w...

CVE-2025-9049

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

CVE-2025-9049 Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

EUVD-2025-210856

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

CVE-2025-9049

Nokri – Job Board WordPress Theme (versions up to and including 1.6.4 ) is vulnerable to privilege escalation via account takeover due to a missing capability check on the nokri_account_member_permissions function. An authenticated attacker with Subscriber-level access can create new Subscriber u...

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

CVE-2026-85302

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

EUVD-2026-70596

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81281 WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-84815

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Kriesi Enfold WordPress theme, affecting versions 8.0 and earlier . The flaw stems from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in a victim's brows...

CVE-2026-66652

CVE-2026-66652 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeGoods Grand Tour WordPress theme, affecting versions from an unspecified start through 5.5.1 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with a network attack vector, low complexity, no required privileges, re...

CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

CVE-2026-18550

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...