WordPress GeoDirectory plugin <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability discovered by OKISO - OKISO in WordPress Plugin GeoDirectory versions = 2.8.192...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.7...

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rodrigo Cabo Igneva Solutions, S.L. in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...

CVE-2021-24750

How to use Start mysql, wordpress and wordpress-cli using docker-compose docker-compose -f docker-compose.yaml up -d Install wordpress, activate the plugin and create a user with the role subscriber using wordpress-cli docker-compose run --rm wp-cli install-wp Start the exploit script with an sql...

WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Alex J. in WordPress Plugin Ajax Search Lite versions = 4.14.5...

WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by GOOKBOB in WordPress Plugin Strong Testimonials versions = 3.3.12...

CVE-2026-7537

MDJM Event Management = 1.7.8.3 - Authenticated Administrator+ Arbitrary File Upload via 'mdjmemailuploadfile' Parameter The WordPress MDJM Event Management plugin version 1.7.8.3 and prior contains an arbitrary file upload vulnerability that allows authenticated administrators to upload maliciou...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in thewdkgenerateautologinlink function. This is due to the feature using a...

WP-CVE-2023-28121

WP-CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff : https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072/...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

WordPress WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents plugin <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WSP MCP AI Agents Connector versions = 2.9.5...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin HivePress versions = 1.7.32...

WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin WP EasyPay versions = 4.5.4...

WordPress Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by nudien, nudien in WordPress Plugin Tourfic versions = 3.0.1...

WordPress Hide My WP Ghost – Security & Firewall plugin <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Hide My WP Ghost versions = 7.0.12...

WordPress Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin Salon booking system versions = 10.31.9...

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin Profile Builder versions = 4.0.3...

WordPress WebberZone Top 10 — Popular Posts plugin <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Top 10 versions = 4.5.2...

WordPress Search Regex plugin <= 3.5 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by R3D in WordPress Plugin Search Regex versions = 3.5...

WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...