315458 matches found
EUVD-2026-95708
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...
CVE-2026-86851 Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...
CVE-2026-103329 Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature
The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...
WordPress Super Payments plugin < 1.43.1 - Unauthenticated Payment Confirmation Forgery vulnerability
Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Super Payments versions 1.43.1...
EUVD-2026-95707
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...
CVE-2026-87846
The Shipping for Nova Poshta WordPress plugin (versions 1.18.7 through 1.19.8 ) contains a vulnerability where an AJAX action lacks authorization, nonce, or ownership checks. This allows unauthenticated users to delete shipment records for arbitrary orders. Additionally, attackers can force the s...
CVE-2026-87846 Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...
EUVD-2026-95706
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...
EUVD-2026-95705
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...
CVE-2026-85348
The GDPR Data Request Form WordPress plugin (versions 1.5 through 1.7.1 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists because the plugin lacks CSRF protection when updating specific settings, such as the DPO Email . An attacker can execute a forged request to modify the...
CVE-2026-89235
The Testimonials by BestWebSoft WordPress plugin, versions 1.0.5 through 1.0.8 , is vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query . This allows unauthentic...
CVE-2026-85348 GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...
CVE-2026-89235 Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...
WordPress GDPR Data Request Form plugin 1.5-1.7.1 - DPO Email Update vulnerability
DPO Email Update vulnerability discovered by Shikhali Jamalzade in WordPress Plugin GDPR Data Request Form versions 1.5-1.7.1...
CVE-2024-2876
CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...
wordpress-cve-2024-10924-pentest
WordPress CVE-2024-10924 Penetration Testing Report 2FA Bypass Vulnerability in Really Simple SSL Plugin 📋 Table of Contents Executive Summary Target Information Methodology Timeline Reconnaissance Phase Vulnerability Analysis Attack Flow Exploitation Impact Assessment Remediation Tools Used...
CVE-2026-18143
CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...
WordPress-RCE-CVE-2019-8942
WordPress Crop Image RCE — CVE-2019-8942 / CVE-2019-8943 Python3 implementation of the authenticated WordPress crop-image exploitation chain. The repository is organized around two independent workflows: a manual OSCP-style script and a fully automated script with an integrated reverse-shell...
CVE-2020-12696
CVE-2020-12696 ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Iframe iframe src="javascript:confirmdocument.cookie" width="100%" height="500" Version plugin: 4.4 Tested on: WordPress 5.2.4 Researche...