CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Suscriptor + Instalación Arbitraria de Plugins Descripción La falta de comprobaciones de capacidad y una comprobación de nonce insuficiente en la acción AJAX del plugin, hizo posible que usuarios autenticados instalaran plugins...

CVE-2025-1562

CVE-2025-1562 root@kitploit: POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124...

CVE-2024-25092

Exploit CVE-2024-25092 Resumen CVE-2024-25092 es una vulnerabilidad de alta gravedad que afecta al plugin NextMove Lite de WordPress versiones = 2.17.0. Esta vulnerabilidad permite a un usuario con nivel suscriptor o superior instalar y activar plugins arbitrarios en un sitio de WordPress debido ...

CVE-2025-2807

CVE-2025-2807: Motors Plugin Exploit By: Nxploited | Khaled Alenazi ⚠️ Vulnerability Summary Plugin: Motors 📅 Expected to be mass-exploited due to its simplicity and critical impact. 🚫 Technical Details Vulnerable Endpoint: /wp-admin/admin-ajax.php...

CVE-2024-10728

CVE-2024-10728 PostX var ultpoptionpanel =...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Falta de autorización para la instalación/activación arbitraria de plugins por parte de usuarios autenticados Suscriptor+ Descripción: El plugin Qode Essential Addons para WordPress es vulnerable a la modificación no autorizada de datos debido a una...

CVE-2025-25101

🚀 CVE-2025-25101 - Complemento Munk Sites de WordPress = 1.0.7 - CSRF para instalación arbitraria de complementos 📌 Resumen CVE-2025-25101 es una vulnerabilidad de Cross-Site Request Forgery CSRF en el complemento MetricThemes Munk Sites para WordPress versiones ≤ 1.0.7. Esta vulnerabilidad permi...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – Asistente de escritura de contenido con IA = 1.0.18 - Autorización faltante para instalación/activación arbitraria de plugins por parte de usuarios autenticados Suscriptor+ Descripción Descripción El plugin 10Web AI Assistant – Asistente de escritura de contenid...

CVE-2025-32641

🛡️ Anant Addons for Elementor = 1.1.5 - CSRF para instalación arbitraria de plugins 🧨 CVE-2025-32641 Vulnerabilidad de falsificación de solicitudes entre sitios CSRF en anantaddons ' Anant Addons for Elementor Este problema afecta a las versiones: desde una versión desconocida hasta la 1.1.5...

CVE-2025-30911

Exploit for CVE-2025-30911 – WordPress RomethemeKit = 1.5.4 This script exploits a critical vulnerability in the RomethemeKit For Elementor WordPress plugin = v1.5.4 that allows authenticated arbitrary plugin installation and activation , potentially leading to Remote Code Execution RCE. 🛠️...

CVE-2024-10674

CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Overview This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitra...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Instalación no autenticada de plugins arbitrarios Descripción El tema Pubnews para WordPress es vulnerable a la instalación no autorizada de plugins arbitrarios debido a una falta de comprobación de capacidades en la función pubnewsimporterpluginactionfornotice e...

CVE-2026-81766

The Really Simple Security WordPress plugin (aka Really Simple SSL) before 9.8.0 contains a missing permission check in the rsp_upgrade_install_plugin function, which allows a subsite administrator on a WordPress multisite network to install and execute arbitrary code from a user-supplied URL int...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

CVE-2026-16576

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 contains an improper access control flaw in its admin REST API routes. The affected endpoints check only for a WooCommerce management capability rather than the required Dokan-installation capability...

EUVD-2026-63818

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

PT-2026-8222

Name of the Vulnerable Software and Affected Versions CleanTalk versions up to and including 6.71 Description The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress has a flaw that allows unauthorized Arbitrary Plugin Installation. This is due to an authorization bypass via...

CVE-2025-1562

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

CVE-2022-3881

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and...