7678 matches found
CVE-2024-3293-Poc
CVE-2024-3293-Poc rtMedia para WordPress, BuddyPress y bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...
CVE-2024-3105-PoC
CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...
CVE-2026-10148
The Amelia (Booking for Appointments and Events Calendar) WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.9 . The root cause is insufficient input sanitization and output escaping on the load_manually parameter within the render() methods of...
CVE-2026-87919
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...
CVE-2026-83532
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-87919
The Product XML Feed Manager for WooCommerce WordPress plugin (versions before 3.1.1 ) contains a missing access-control flaw in its product shortcode handler. The plugin neither restricts which object method the shortcode may invoke nor validates the user's capability over the targeted product. ...
CVE-2026-87919 Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...
EUVD-2026-76807
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by...
CVE-2026-83532
The Custom Menu Wizard Widget WordPress plugin through version 3.3.1 fails to sanitize and escape several shortcode attributes before rendering them into HTML. This allows users with contributor-level access or higher to perform a stored cross-site scripting (XSS) attack, injecting arbitrary web ...
CVE-2026-83532 Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
EUVD-2026-76817
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-62138
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
CVE-2026-62111
Contributor Cross Site Scripting XSS in Simple Payment = 2.5.4 versions...
CVE-2026-62138
A Contributor-level Cross Site Scripting (XSS) vulnerability affects the Visual Composer Website Builder WordPress plugin in versions ≤ 45.16.1 . The flaw, discovered by sungbyeongchan, allows an attacker with Contributor privileges to inject malicious scripts via user interaction. The CVSS 3.1 s...
EUVD-2026-76199
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
CVE-2026-62134
An Insecure Direct Object References (IDOR) vulnerability was identified in the WordPress Starter Templates plugin (versions ≤ 4.7.5 ). The flaw allows a contributor-level authenticated user to manipulate objects they should not have access to, resulting in a low integrity impact (CVSS 4.3, MEDIU...
CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...