318411 matches found
CVE-2026-109207
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...
CVE-2026-109990
The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107758
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-103518
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-104745
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...
Wordpresscan
Wordpresscan A simple Wordpress scanner written in python based on the work of WPScan Ruby version, some features are inspired by WPSeku. Disclaimer The authors of this github are not responsible for misuse or for any damage that you may cause! You agree that you use this software at your own ris...
wordpress-exploit-framework
WordPress Exploit Framework A Ruby framework designed to aid in the penetration testing of WordPress systems. Installation To install the latest stable build, run gem install wpxf. After installation, you can launch the WordPress Exploit Framework console by running wpxf. What do I need to run it...
EUVD-2026-102618
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
EUVD-2026-102619
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
CVE-2026-109207 RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...
CVE-2026-107758
The Colibri Page Builder plugin for WordPress (versions ≤ 1.0.390 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter. The root cause is insufficient input sanitization and output escaping, where the comment allow-list permits SVG elements with arbitrary data-* attribut...
CVE-2026-109207
The RSS Aggregator by Feedzy WordPress plugin (versions
CVE-2026-89280
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress (versions up to and including 5.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a lack of validation on a user-controlled key within the 'password' parameter of the /wp-js...
CVE-2026-107758 Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
EUVD-2026-102617
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...
CVE-2026-89280 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key...
EUVD-2026-102614
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-104769 Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...
CVE-2026-104745 Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...
EUVD-2026-102615
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...