295273 matches found
VivisectION
VivisectION Emulation-Driven Reversing Toolset VivisectION is the cross-section of GUI Reversing, Emulation and Debugging, with an emphasis on using Emulation and other powerful Vivisect toys to aid in Reverse Engineering and Vulnerability Research. Among other things, VivisectION aka Ion is a...
CVE-2024-7135
CVE-2024-7135 The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated...
CVE-2026-118638
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-3228
CVE-2026-3228 - NextScripts WordPress Plugin Stored XSS Scanner & Exploit https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/WordPress-Plugin-red Author: NULL200OK A comprehensive Python tool to scan for and exploit...
CVE-2025-12189
Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents CSRF Attack function exploit const form = document.createElement'form'; form.action = 'http://TARGETSITE.COM/wp-admin/admin-ajax.php'; form.method = 'POST'; form.enctype = 'multipart/form-data';...
CVE-2024-5084
Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...
CVE-2022-3689
CVE-2022-3689 Analysis Report Overview CVE-2022-3689 is an SQL injection vulnerability found in a specific WordPress plugin, which allows an attacker to exploit security vulnerabilities in web applications to insert malicious SQL code into the database. This can lead to serious security issues su...
CVE-2024-54385
CVE-2024-54385 Radio Player = 2.0.82 - Unauthenticated Server-Side Request Forgery Description The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This...
CVE-2026-118629 All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID...
CVE-2026-82214 Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...
CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-118638
The Mapster WP Maps WordPress plugin versions before 2.0.6 is vulnerable to an unauthenticated arbitrary post modification vulnerability. The root cause is a missing authorization check on a REST API route used to write post data (specifically identified in some records as the save-mapmaker route...
CVE-2026-118629
The All-in-One Video Gallery WordPress plugin (versions before 5.0.0 ) contains a vulnerability where it fails to verify a video's publication status before rendering it on its player page. This allows unauthenticated users to access and view the titles and source URLs of private, draft, pending,...
EUVD-2026-114588
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-118629 All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player page, allowing unauthenticated users to view the title and source URLs of private, draft, pending, scheduled and trashed videos by their ID...
CVE-2026-118638 Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...
CVE-2026-82214 Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...
WordPress Payment Forms for Paystack plugin < 4.0.6 - Contributor+ Sensitive Information Disclosure vulnerability
Contributor+ Sensitive Information Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Payment Forms for Paystack versions 4.0.6...
CVE-2019-9978
CVE-2019-9978 WordPress Plugin Social Warfare RCE Vulnerability 3.5.3 🐞 Minimal simulated from vulnerable plugin and exploit it 🥰 Installation Of Vulnerable Plugin Install dependencies: docker-compose build Start vulnerable and attacker server containers docker-compose up or docker-compose up -d...
CVE-2026-63030
CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...