CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wpajaxnoprivshortcodeApiAdd Description The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary...

CVE-2024-50498

CVE-2024-50498 WP Query Console body background-color: fff; color: 222; font-family: sans-serif; pre margin: 0; font-family: monospace; a:link color: 009; text-decoration: none; background-color: fff; a:hover text-decoration: underline; table...

CVE-2024-50473

CVE-2024-50473 Ajar in5 Embed = 3.1.3 - Unauthenticated Arbitrary File Upload Description: The Ajar in5 Embed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.1.3. This makes it possible for unauthenticated...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - Sensitive Information Exposure via Log File Description: The Cloud Templates & Patterns collection plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.2 via a log file with a...

CVE-2024-2242

CVE-2024-2242 Contact Form 7 history.pushState'', '', '/'; document.forms0.submit;...

CVE-2024-13489

CVE-2024-13489 LTL Freight Quotes – Old Dominion Edition = 4.2.10 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including,...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up...

CVE-2023-41652

CVE-2023-41652 RSVPMarker = 10.6.6 - Unauthenticated SQL Injection Description: The RSVPMarker plugin for WordPress is vulnerable to SQL Injection via the 'email' parameter in versions up to, and including, 10.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2022-45808

CVE-2022-45808 LearnPress Plugin = 5.0.1...

CVE-2024-50478

CVE-2024-50478 1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover Description: The 1-Click Login: Passwordless Authentication plugin for WordPress is vulnerable to authentication bypass in version 1.4.5. This is due to the plugin not properly verifying a...

CVE-2024-5084

Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...

CVE-2025-9209

🍔 RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 🛡️ CVE-2025-9209.py — Mass Automatic Exploit & Extraction Tool ⚠️ Vulnerability Overview RestroPress – Online Food Ordering System versions 3.0.0 to 3.1.9.2 are affected by an Unauthenticated Information Exposure leading to Authentication...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

CVE-2021-24959

CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...

CVE-2025-6389

CVE-2025-6389 Sneeit Framework 📡 Don't miss the next drop. Follow @KNxploited on Telegram — the definitive channel for freshly disclosed CVEs, working exploits, and elite security research. First to know. First to act. 🧠 Overview CVE-2025-6389 is a CVSS 9.8 Critical Remote Code Execution...

CVE-2025-5701

CVE-2025-5701 - Unauthenticated Privilege Escalation Exploit Severity: CRITICAL CVSS 9.8 Plugin Affected: HyperComments for WordPress Versions Affected: ≤ 1.2.2 📌 Vulnerability Summary The HyperComments plugin for WordPress is vulnerable to unauthorized modification of WordPress options due to a...

CVE-2025-3604

🚨 Flynax Bridge CVE : CVE-2025-3604 CVSS : 9.8 Critical Published : April 23, 2025 Last Updated : April 24, 2025 ⚙️ Script Output Example Detected plugin version: 2.2.0 Version is vulnerable. Attempting exploit... Exploit succeeded! Email changed to: [email protected] Exploit By Nxploited...