CVE-2020-36708

CVE-2020-36708 – Preuve de concept d'injection de fonctions dans le framework Epsilon pour WordPress Aperçu CVE-2020-36708 est une vulnérabilité dans le framework Epsilon pour WordPress qui permet à des attaquants non authentifiés d'invoquer des méthodes de classes PHP arbitraires via l'action AJ...

EUVD-2026-94175

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmptempaccessajax AJAX action being registered with wpajaxnopriv and protected only by a nonce check using the...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

Youzify < 1.2.0 - Unauthenticated SQLi

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection id: CVE-2022-1950 info: name: Youzify 1.2.0 - Unauthenticated SQLi author:...

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

WordPress KiviCare <2.3.9 - SQL Injection

WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajaxpost AJAX action with the getdoctordetails route. An attacker can possibly obtain sensitive information, modify...

TranslatePress <= 3.3.1 - Unauthenticated Account Takeover

TranslatePress WordPress plugin = 3.3.1 contains a sensitive information exposure caused by the 'trpgettranslationsregular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string savi...

CVE-2025-13486-POC

CVE-2025-13486 Preuve de concept Un exploit de preuve de concept PoC pour CVE-2025-13486, une vulnérabilité d'exécution de code à distance dans le plugin WordPress Advanced Custom Fields: Extended ACFE. Aperçu de la vulnérabilité Cette vulnérabilité existe dans les versions d'ACFE 0.9.0.5 à...

CVE-2026-86786

The Slider Pro WordPress plugin (versions through 1.0.0 ) is vulnerable to an Unauthenticated Sensitive Data Disclosure due to a lack of capability or authorization checks on one of its AJAX actions. An unauthenticated attacker can exploit this to retrieve the title, excerpt, and permalink of non...

CVE-2026-15282

CVE-2026-15282 — Exploit RCE de masse pour Instant Appointment filegetcontents pré-authentification + fileputcontents → Webshell PHP Aperçu CVE-2026-15282 est une vulnérabilité critique CVSS 9.8 de téléversement arbitraire de fichier sans authentification dans le plugin WordPress Instant...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Отсутствие авторизации через activateplugin Описание Тема Square для WordPress уязвима к несанкционированной активации плагинов из-за отсутствия проверки прав доступа в функции activateplugin, вызываемой через AJAX-действие в версиях до 2.0.0 включительно. Это...

CVE-2025-39459-Nuclei-Template

📄 Template Nuclei pour CVE-2025-39459 🚀 Présentation Ce dépôt contient un template Nuclei spécialement conçu pour détecter une Vulnérabilité d'Élévation de Privilèges Non Authentifiée CVE-2025-39459 dans le Thème WordPress Real Estate 7. Ce problème permet à des attaquants non authentifiés de...

CVE-2025-4380

CVE-2025-4380 - Эксплойт Local File Inclusion LFI для плагина Ads Pro = 4.89 Описание Этот Python-эксплойт нацелен на плагин Ads Pro ≤ 4.89 для WordPress, уязвимый к Local File Inclusion LFI через AJAX-действие bsapreviewcallback. Неаутентифицированный злоумышленник может использовать эту...

CVE-2025-5815-Nuclei-Template

📄 Template Nuclei pour CVE-2025-5815 🚀 Aperçu Ce dépôt contient un template Nuclei spécialement conçu pour détecter une Vulnérabilité de Désactivation Non Authentifiée de la Journalisation des Bots CVE-2025-5815 dans le plugin WordPress Traffic Monitor. Ce problème permet à des attaquants non...

CVE-2025-5287

CVE-2025-5287 PoC Exploit d'injection SQL non authentifiée pour WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Description Ce script Python est un exploit de preuve de concept PoC pour CVE-2025-5287 , ciblant une vulnérabilité dans le WordPress Likes and Dislikes Plugin ≤ 1.0.0. La vulnérabilité...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit CVE-2025-0316 Эксплойт-тулкит 🚨 Эксплойт обхода аутентификации для WordPress-плагина WP Directorybox Manager 🔥 Автоматизированный скрипт эксплойта для CVE-2025-0316 — обход аутентификации через уязвимое AJAX-действие. ⚠️ Правовое уведомление Этот инструмент предназначен строг...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

CVE-2024-11728

CVE-2024-11728 KiviCare – Clinic & Patient Management System EHR WordPress Plugin: PoC неаутентифицированной SQL-инъекции Этот репозиторий содержит PoC-скрипт для эксплуатации уязвимости SQL-инъекции в плагине KiviCare – Clinic & Patient Management System EHR WordPress Plugin, версиях до 3.6.4...

CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Неаутентифицированная SQL-инъекция Плагин не обеспечивает надлежащую очистку пользовательских POST-данных перед их использованием в динамически создаваемом SQL-запросе через AJAX-действие bookingpressfrontgetcategoryservices доступное неаутентифицированным...