nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 77,636 个用于 WordPress 安全扫描的 Nuclei 模板 🥳 让你的 WordPress 安全水平更上一层楼！本项目汇集了海量全新的 Nuclei 模板，用于 WordPress 扫描。扫描核心（Core）、插件和主题中的弱点——全部基于 Wordfence.com 的最新情报。 为什么说它是你的新好朋友： 海量模板库 ：无需再四处寻找单个模板，整个武器库尽在你的指尖。 始终与时俱进 ：这些模板会随最新威胁持续更新，让你永远不会落后于形势。 开源魔法 ：需要针对特定场景调整模板？没问题，你拥有完全的控制权。 如果你正在守护...

wpgarlic

wpgarlic 一个概念验证的WordPress插件模糊测试工具，该工具发现了近3000万个站点上安装的WordPress插件中的300多个漏洞。 所用技术描述于 https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html 如果你想继续研究，请从不太流行的插件开始——如果某个插件在2021年10月至2024年1月期间获得了至少1万次活跃安装，我大概率已经查看过模糊测试报告（并且重点关注那些至少有2万次活跃安装的插件）。由于模糊测试的工作方式存在大量随机性，这些插件中的某些漏洞可能仍然未被发现——但数量较少。...

wpbullet

wpBullet WordPressプラグイン/テーマ（およびPHP）の静的コード解析 インストール リポジトリをクローンし、依存関係をインストールしてスクリプトを実行します $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py 使い方 利用可能なオプション: root@kitploit: --path 必須 システムパスまたはダウンロードURL 例:...

wpBullet

wpBullet WordPressプラグイン/テーマ（およびPHP）向け静的コード解析ツール インストール リポジトリをクローンし、依存関係をインストールしてスクリプトを実行するだけです。...

wordpress-php-object-helper

wordpress-php-object-helper 关于 您有一个已知的带 PHP 对象漏洞的插件，但您需要确定使用哪个库来利用该问题并与 phpggc 配合运行。 这应该能帮到您。 示例输出 root@kitploit: $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

wp_hunter

wphunter WordPressプラグインの脆弱性を検索する静的解析ツール。 root@kitploit: / \ / \ / | \ / | \ // /| / \ | / \ / \ \ \ / | | \ Y / | / | \ | \ /| | / /\ / ||| /|/|| /| \ | / // / / / | 作者: @JosueEncinar プロセスを開始中 総プラグイン数 87509 分析を開始中 モジュールの追加方法...

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. "New plugins are reviewed before they enter the...

Wordfence Bug Bounty Program Monthly Report – May 2026

In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 278 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Last week, there were 274 vulnerabilities disclosed in 213 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 116 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 265 vulnerabilities disclosed in 202 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 144 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-14872

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

EUVD-2026-51762

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-14483

The CVE-2026-14483 entry describes an unauthenticated Arbitrary File Upload in the Realtyna Organic IDX plugin + WPL Real Estate (

EUVD-2026-51404

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Last week, there were 264 vulnerabilities disclosed in 210 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 117 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-15397

The CVE concerns the WordPress plugin Subscriptions for WooCommerce (versions ≤ 2.0.0). The issue is Missing Authorization in the AJAX handler wps_sfw_install_plugin_configuration , allowing authenticated users with shop manager-level access or higher to install and activate arbitrary WordPress.o...

CVE-2026-15393

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and...