By-Poloss..-..CVE-2026-15038-POC

🚨 CVE-2026-15038 — InfiniteWP Client Admin Takeover Unauthenticated Admin Account Takeover in WordPress Multisite 📋 Overview InfiniteWP Client plugin for WordPress getoption'iwpclientactionmessageid' && !$iwpmmbcore-getoption'iwpclientpublickey' Reader : Uses getsiteoption → reads from...

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...

CVE-2026-75957

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...

CVE-2026-75957 Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...

CVE-2026-75957 Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...

CVE-2026-75957

The Ultimate Multisite WordPress plugin (versions ↜ 2.15.0 ) is vulnerable to an Authentication Bypass via the checkout_form parameter in the login_customer_after_checkout function. The publicly accessible wu_ajax_nopriv_wu_validate_form AJAX handler accepts a freely obtainable nonce. When the ch...

EUVD-2026-90546

The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the checkoutform parameter of the logincustomeraftercheckout function. This is due to the publicly accessible...

WordPress Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin <= 2.15.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by zickzick2 in WordPress Plugin Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions = 2.15.0...

EUVD-2025-209820

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.67 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform proper capability checks when saving specific fields and lacks sufficient output escaping . Th...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

EUVD-2026-89635

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

BIT-WORDPRESS-MULTISITE-2026-87902

An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...

tvsz

CVE-2018-6389 PoC node js multisite with proxy This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time. !!! IMPORTANT BEFORE YOU CONTINUE !!!...

WordPress Malcure Malware Shield — Removal, Repair, Monitor plugin < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability

Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability discovered by Charles Vosburgh in WordPress Plugin Malcure Malware Scanner versions 19.9.7...

CVE-2026-96896 Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem,...

CVE-2026-96896 Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem,...