Lucene search
+L

16025 matches found

CNNVD
CNNVD
added 2026/03/05 12:0 a.m.11 views

WordPress plugin UberSlider PerpetuumMobile 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. There is a...

7.1CVSS5.6AI score0.0018EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/03/05 12:0 a.m.13 views

WordPress plugin Site Suggest 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

6.5CVSS5.8AI score0.00242EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/03/05 12:0 a.m.10 views

WordPress plugin Wanderland 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

8.1CVSS5.8AI score0.00519EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/03/05 12:0 a.m.11 views

WordPress plugin Motorix 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

8.1CVSS5.8AI score0.00403EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/03/05 12:0 a.m.9 views

WordPress plugin Login with Salesforce 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

9.1CVSS5.8AI score0.00315EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/03/04 9:24 a.m.410 views

CVE-2023-7337 JS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied...

7.5CVSS0.01317EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/04 8:23 a.m.4 views

CVE-2026-1236

The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justifiedgallerytheme' parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS6AI score0.00193EPSS
SaveExploits0References5
Patchstack
Patchstack
added 2026/03/02 11:24 p.m.9 views

WordPress Blocksy plugin <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via blocksymeta Fields vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Theme Blocksy versions = 2.1.30...

6.4CVSS5.9AI score0.00194EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2026/02/28 12:0 a.m.13 views

PT-2026-22465

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.7 Description The Tutor LMS plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the coupon code parameter is not properly sanitized,...

7.5CVSS6AI score0.00461EPSS
SaveExploits1References9
RedhatCVE
RedhatCVE
added 2026/02/27 10:14 a.m.16 views

CVE-2026-28136

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue affects WP SMS: from n/a through = 6.9.12...

7.6CVSS6AI score0.00285EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/02/27 8:24 a.m.9 views

CVE-2026-2383

The Simple Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

6.4CVSS6AI score0.00197EPSS
SaveExploits0References5
CNNVD
CNNVD
added 2026/02/27 12:0 a.m.10 views

WordPress plugin WP Accessibility 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

6.4CVSS5.7AI score0.00205EPSS
SaveExploits0References7
Packet Storm
Packet Storm
added 2026/02/27 12:0 a.m.194 views

📄 WordPress RomethemeKit for Elementor 1.5.4 Privilege Escalation

Proof of concept exploit for an unauthorized privilege escalation vulnerability in WordPress RomethemeKit for Elementor plugin version 1.5.4 ============================================================================================================================================= | Title :...

9.9CVSS5.9AI score0.01823EPSS
SaveExploits2
Positive Technologies
Positive Technologies
added 2026/02/27 12:0 a.m.8 views

PT-2026-22328

The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS6AI score0.0024EPSS
SaveExploits0References4
Patchstack
Patchstack
added 2026/02/26 4:44 p.m.9 views

WordPress List category posts plugin <= 0.93.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jitlada in WordPress Plugin List category posts versions = 0.93.1...

5.9CVSS5.8AI score0.00172EPSS
SaveExploits0Affected Software1
EUVD
EUVD
added 2026/02/26 9:30 a.m.8 views

EUVD-2026-8845

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through = 1.4.4...

5.3CVSS5.3AI score0.00194EPSS
SaveExploits0References2
Patchstack
Patchstack
added 2026/02/26 7:13 a.m.9 views

WordPress OVRI Payment plugin 1.7.0 - Malicious .htaccess directive vulnerability

Malicious .htaccess directive vulnerability discovered by Marco Wotschka - Wordfence in WordPress Plugin OVRI Payment versions 1.7.0...

6.5CVSS5.3AI score0.00307EPSS
SaveExploits0References1Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/26 1:24 a.m.4 views

CVE-2026-1557

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information...

7.5CVSS5.6AI score0.01722EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/02/26 12:0 a.m.17 views

PT-2026-22154

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0 Description Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the...

5.4CVSS6AI score0.00151EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/02/25 12:30 p.m.9 views

EUVD-2026-8520

The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing nonce validation in the showPageContent function. This makes it possible for unauthenticated attackers to a...

4.3CVSS5.5AI score0.00131EPSS
SaveExploits0References5
Rows per page
Query Builder