329 matches found
CVE-2026-8181
Exploit del CVE-2026-8181 Plugin Burst Statistics de WordPress — omisión de autenticación que conduce a la escalada de privilegios a administrador Exploit del CVE-2026-8181 descubierto por Chloe Chamberland y PRISM. ⚠️ Aviso legal Este repositorio se proporciona únicamente con fines de...
CVE-2026-8181
| Autenticación Requerida 💥 CVE-2026-8181 - Bypass de Autenticación de Burst Statistics Escalada de Privilegios No Autenticada mediante el Bypass de Autenticación de MainWP 👨💻 Autor !0xTerrorhttps://assets.kitploit.com/production/public/readmes/50604/f036bd5517ab1ec023381e336e314b5...
CVE-2016-15041-mainwp-dashboard
Lab CVE-2016-15041 - XSS almacenado en MainWP Dashboard Laboratorio vulnerable para CVE-2016-15041: XSS almacenado no autenticado en el plugin de WordPress MainWP Dashboard = 3.1.2. Inicio rápido root@kitploit: docker compose up -d --build Espere 30 segundos para la configuración automática. El...
MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to 3.1.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'mwpsetuppurchaseusername' parameter, letting unauthenticated attacke...
CVE-2026-12255
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
CVE-2026-12255
CVE-2026-12255 affects the MainWP Child WordPress plugin prior to 6.1.2. The site-registration request handler does not verify the requester’s identity when password authentication is disabled for the targeted account, enabling an unauthenticated attacker to obtain a valid authentication session ...
EUVD-2026-49065
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
CVE-2026-12255
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
CVE-2026-12255 MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...
📄 WordPress MainWP Child 5.3.3 Unauthenticated Administrator Session Takeover
WordPress MainWP Child plugin version 5.3.3 contains an unauthenticated administrator session takeover vulnerability through Rogue Site Registration. A remote attacker can obtain an authenticated administrator session and take control of the affected site. This proof of concept exploit demonstrat...
CVE-2026-15283
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-15283
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-15283 WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting
The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2026-15283
The CVE pertains to the WPvivid Backup for MainWP WordPress plugin. A stored XSS flaw exists in admin settings across all versions up to 0.9.33 due to insufficient input sanitization and output escaping. This affects multi-site installations and sites where unfiltered_html is disabled, allowing a...
CVE-2026-57327
Subscriber Broken Access Control in MainWP = 6.1.1 versions...
CVE-2026-57327
Subscriber Broken Access Control in MainWP = 6.1.1 versions...
CVE-2026-57327
The connected documents identify CVE-2026-57327 as a vulnerability in the WordPress MainWP plugin up to version 6.1.1 describing a Subscriber/Broken Access Control issue. The underlying root cause is described as broken access control, but the documents do not provide concrete technical details s...
EUVD-2026-40098
Subscriber Broken Access Control in MainWP = 6.1.1 versions...