ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

js-jobs

js-jobs JS Job Manager 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation Description The jsjobsajax AJAX action of the plugin available to both authenticated and unauthenticated users does not have proper authorisation and CSRF checks, in particular when using the...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - 通过 activateplugin 授权缺失 描述 WordPress 的 Square 主题在 2.0.0 及之前版本中存在未授权激活插件的漏洞，原因是通过 AJAX 操作调用的 activateplugin 函数缺少权限检查。这使得具有订阅者级别及以上访问权限的已认证攻击者能够激活任意插件。 root@kitploit: Missing Authorization CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE CVE-2023-30486 CVS...

CVE-2024-25092

CVE-2024-25092 NextMove Lite 2.18.0 - 订阅者及以上任意插件安装/激活 描述： NextMove Lite – WooCommerce 感谢页插件 for WordPress 存在因缺少对 'xladdoninstallation' 函数的能力检查而导致的数据未授权修改漏洞，影响版本直至 2.17.0（含）。该漏洞使得经过身份验证的攻击者（具有订阅者及以上权限）能够安装并激活任意插件。 root@kitploit: Severity: medium CVE ID: CVE-2024-25092 CVSS Score: 6.5 CVSS Metrics:...

CVE-2023-36531

CVE-2023-36531 LiquidPoll – 面向创作者和品牌的高级投票插件 = 3.3.68 - 通过 activateaddon 缺失授权 信息 需要一个订阅者级别的用户，并且插件需要被禁用。 这将激活你提供的插件。 用法 root@kitploit: usage: CVE-2023-36531.py -h -w URL -u USERNAME -p PASSWORD -a ADDON WordPress CVE-2023-36531 Exploit options: -h, --help 显示此帮助信息并退出 -w URL, --url URL WordPress 站点的...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The CVE concerns the Everest Forms WordPress plugin (Contact/Payment Form, Quiz, Survey & Custom Form Builder with AI) with authorization bypass in all versions up to 3.5.2. The root cause is inadequate verification of a user’s authorization to perform actions, enabling authenticated attackers wi...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-59862

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

PT-2026-73083

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS...

CVE-2026-1372

The CVE concerns the WordPress plugins Tutor LMS Elementor Addons (

CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-1372

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...

CVE-2026-12153

CVE-2026-12153 affects the WordPress WP Learn Manager plugin up to version 1.1.8. The vulnerability is an authorization bypass in the jslearnmanager_ajax AJAX action, allowing unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on affected sites. ...

EUVD-2026-42172

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activat...

CVE-2026-12153

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activat...

CVE-2026-12471

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activateplugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set o...

CVE-2026-12471 Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activateplugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set o...