CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - 認証済み（購読者以上）ユーザーによる限定的オプション更新を可能にする認可欠如 説明 WordPress用NitroPackプラグインは、バージョン1.17.0までの全バージョンにおいて、'nitropackdismissnoticeforever'...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Ejecución Remota de Código Descripción El plugin SEO LAT Auto Post para WordPress es vulnerable a la sobrescritura de archivos debido a una falta de verificación de capacidad en la acción AJAX remoteupdate en todas las versiones hasta la 2.2.1 inclusive. Esto permite q...

EUVD-2026-83367

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-93870

Cotonti through 1.0.0 has a Cross-Site Request Forgery (CSRF) vulnerability in the ratings plugin AJAX handler (ratings.ajax.php). The root cause is a failure to validate anti-CSRF tokens, allowing an attacker to craft a malicious page that auto-submits POST requests to modify stored rating data ...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2025-5781

FreePBX CVE-2025-57819 エクスプロイト 説明 このスクリプトは、FreePBX 16.0.26.0 未満のバージョン（CVE-2025-57819）の脆弱性を悪用し、AJAX API エンドポイントの SQL インジェクションの欠陥を介して、リモート攻撃者が任意の PHP コードを実行できるようにします。このエクスプロイトは、ウェブシェルと自動起動するリバースシェルの両方を作成します。 脆弱性の詳細 CVE : CVE-2025-57819 影響を受けるバージョン : FreePBX 16.0.26.0 影響 : リモートコード実行 RCE ベクトル : AJAX...

CVE-2026-3891

🚀 CVE-2026-3891 – Pix for WooCommerce 未認証ファイルアップロードによる RCE CVE-2026-3891 の概念実証（PoC）エクスプロイト – WordPress プラグイン Pix for WooCommerce （≤ 1.5.0）における未認証の任意ファイルアップロードからリモートコード実行に至る脆弱性です。 📖 概要 CVE-2026-3891 は、Pix for WooCommerce プラグインにおける深刻な脆弱性で、1.5.0 までの全バージョンに影響します。このプラグインは AJAX ハンドラー...

CVE-2026-90978

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-87771

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87775

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87770

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87767

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data...

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-81810

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site...

CVE-2026-90978 Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

EUVD-2026-82682

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

EUVD-2026-82673

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87767

CVE-2026-87767 affects the WP Shortcut Link and Advertisement Banner WordPress plugin through version 1.2.0 . The plugin fails to sanitize and escape the url parameter before using it in a SQL query within an AJAX action accessible to unauthenticated users , enabling SQL injection that can be use...

EUVD-2026-82671

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin (through 1.8.1 ) is vulnerable to unauthenticated SQL injection via the week parameter. A parameter is not sanitized or escaped before being used to build a SQL query in an AJAX action accessible without authentication, allowing attackers to extract s...