318321 matches found
WordPress TranslatePress β Translate Multilingual sites with AI Translation plugin <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.7...
CVE-2026-3844
CVE-2026-3844 Mass Exploit CVE-2026-3844 β Breeze Cache WordPress =2.4.4 allows unauthenticated file upload via fetchgravatarfromremote when local gravatar hosting is enabled. Installation Download repository git clone https://github.com/im-hanzou/CVE-2026-3844 Go to repository folder cd...
WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Rodrigo Cabo Igneva Solutions, S.L. in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...
CVE-2021-24750
How to use Start mysql, wordpress and wordpress-cli using docker-compose docker-compose -f docker-compose.yaml up -d Install wordpress, activate the plugin and create a user with the role subscriber using wordpress-cli docker-compose run --rm wp-cli install-wp Start the exploit script with an sql...
WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Alex J. in WordPress Plugin Ajax Search Lite versions = 4.14.5...
WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by GOOKBOB in WordPress Plugin Strong Testimonials versions = 3.3.12...
Mass-CVE-2026-23550-Exploit
π₯ CVE-2026-23550 Modular DS Scanner Multi-threaded Python scanner for CVE-2026-23550 CVSS 10.0 WordPress Modular DS plugin β€2.5.1 vulnerability affecting 40k+ sites. Detects unauthenticated admin takeover via getLogin bypass with full wp-admin access verification. Features β¨ π₯ Full admin access...
CVE-2026-7537
MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...
CVE-2025-13390
CVE-2025-13390 WP Directory Kit The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in thewdkgenerateautologinlink function. This is due to the feature using a...
WP-CVE-2023-28121
WP-CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff : https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072/...
CVE-2024-6624
CVE-2024-6624 | JSON API User = 3.9.3 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2024-6624 vulnerability in the JSON API User = 3.9.3 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileges to...
mitigation-cve-2019-9787
mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...
WordPress WSP MCP β Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents plugin <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability
Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WSP MCP AI Agents Connector versions = 2.9.5...
WordPress HivePress β Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin HivePress versions = 1.7.32...
WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin WP EasyPay versions = 4.5.4...
WordPress Tourfic β AI Powered Travel Booking, Hotel Booking & Car Rental plugin <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by nudien, nudien in WordPress Plugin Tourfic versions = 3.0.1...
WordPress Hide My WP Ghost β Security & Firewall plugin <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Hide My WP Ghost versions = 7.0.12...
WordPress Salon Booking System β Appointment Booking for Salons, Barbershops & Spas plugin <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin Salon booking system versions = 10.31.9...
WordPress User Profile Builder β Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin Profile Builder versions = 4.0.3...
WordPress WebberZone Top 10 β Popular Posts plugin <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Top 10 versions = 4.5.2...