16407 matches found
Meta Box <= 5.11.1 - Arbitrary File Deletion
The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...
WordPress Core <6.5.2 - Cross-Site Scripting
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...
CVE-2024-3105-PoC
CVE-2024-3105 PoC Il plugin Woody code snippets – Insert Header Footer Code, AdSense Ads per WordPress è vulnerabile all'esecuzione di codice remoto in tutte le versioni fino alla 2.5.0 inclusa tramite lo shortcode 'insertphp'. Ciò è dovuto al fatto che il plugin non limita l'uso della funzionali...
EUVD-2026-68050
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...
CVE-2026-76546
The User Profile Builder WordPress plugin prior to version 4.0.1 is vulnerable to a Stored Cross-Site Scripting (XSS) attack caused by unescaped output in the Format Date shortcode . Any user with a role as low as contributor can inject malicious script that executes when any user—including admin...
CVE-2025-66849
CVE-2025-66849 Ghost CMS PoC di privilege escalation Riepilogo In Ghost CMS di Ghost Foundation fino alla versione 6.4.0, il blocco HTML all'interno dell'editor delle bozze dei post non sanifica né codifica correttamente il contenuto fornito dall'utente, causando una vulnerabilità di cross-site...
CVE-2026-28134
Relatório de Exploração CVE-2026-28134 JetEngine = 3.7.2 — Execução Remota de Código Autenticada Contribuidor+ via SSTI em Twig Data: 11 de março de 2026 Pontuação CVSS: 8.8 Alta Vetor CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Plugin Afetado: JetEngine = 3.7.2 Slug do Plugin: jet-engine...
CVE-2026-82227
Contributor SQL Injection in WPBulky = 1.2.2 versions...
CVE-2026-81759
Contributor Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-81284
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
misp-dashboard
misp-dashboard Una dashboard che mostra dati in tempo reale e statistiche dai feed ZMQ di una o più istanze MISP. La dashboard può essere utilizzata come strumento di situational awareness in tempo reale per raccogliere informazioni sulle minacce. misp-dashboard include uno strumento di...
EUVD-2026-67731
Contributor Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-81759
WpEvently is a WordPress plugin (by Mage EventPress) affected by a Broken Access Control vulnerability in versions
CVE-2026-81759 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Contributor Broken Access Control in WpEvently = 5.5.0 versions...
CVE-2026-82227
CVE-2026-82227 is a SQL Injection vulnerability in the WordPress plugin WPBulky (WP Bulk Edit Post Types), affecting versions 1.2.2 and earlier . The flaw requires Contributor-level privileges to exploit. CVSS 3.1 scores it 8.5 (HIGH) , with a changed scope, high impact on confidentiality, and lo...
EUVD-2026-67727
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
EUVD-2026-67726
Contributor SQL Injection in WPBulky = 1.2.2 versions...
CVE-2026-81284
CVE-2026-81284 affects the WordPress plugin ACF Extended in versions