Lucene search
+L

237561 matches found

Nuclei
Nuclei
added 2026/09/02 7:49 a.m.4 views

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation

Tutor LMS WordPress plugin 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output. id: CVE-2026-19092...

9.8CVSS5.9AI score0.01498EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.82 views

Member Hero <=1.0.9 - Remote Code Execution

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

9.8CVSS7.7AI score0.09436EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.148 views

Hash Form <= 1.1.0 - Arbitrary File Upload

The Hash Form Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on...

9.8CVSS7.7AI score0.50653EPSS
SaveExploits8References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.53 views

WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting

WordPress Emag Marketplace Connector plugin 1.0 contains a reflected cross-site scripting vulnerability because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly. id: CVE-2017-17043 info: name: WordPress Emag...

6.1CVSS6.3AI score0.05096EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.81 views

WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection

WordPress Paytm Donation plugin through 1.3.2 is susceptible to authenticated SQL injection. The plugin does not sanitize, validate, or escape the id GET parameter before using it in a SQL statement when deleting donations. An attacker can possibly obtain sensitive information, modify data, and/o...

7.2CVSS7.2AI score0.0654EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.72 views

WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery

WordPress Like Button Rating plugin before 2.6.32 is susceptible to server-side request forgery. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-24150 info: name: WordPress Like Button Rating 2.6.32 - Server-Side Request Forgery...

7.5CVSS7.2AI score0.04337EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.53 views

Chaty < 2.8.2 - Cross-Site Scripting

The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting. id: CVE-2021-25016 info: name: Chaty 2.8.2 - Cross-Site Scripting...

6.1CVSS6.4AI score0.01798EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.54 views

WordPress Ninja Forms <3.4.34 - Open Redirect

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wpajaxnfoauthconnect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive...

6.1CVSS6.4AI score0.01643EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.34 views

Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting

WordPress Marmoset Viewer plugin before 1.9.3 contains a cross-site scripting vulnerability. It does not property sanitize, validate, or escape the 'id' parameter before outputting back in the page. id: CVE-2021-24495 info: name: Wordpress Marmoset Viewer 1.9.3 - Cross-Site Scripting author:...

6.1CVSS6.3AI score0.03343EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.173 views

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections id: CVE-2021-24791 info: name: Header Footer Code Manag...

7.2CVSS7.2AI score0.05208EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.24 views

WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting

WordPress Securimage-WP-Fixed plugin 3.5.4 and prior contains a cross-site scripting vulnerability due to the use of $SERVER'PHPSELF' in the /securimage-wp.php file, which allows attackers to inject arbitrary web scripts. id: CVE-2021-34640 info: name: WordPress Securimage-WP-Fixed =3.5.4 -...

6.1CVSS6.4AI score0.02313EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.60 views

WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting

WordPress W3 Total Cache plugin before 2.1.4 is susceptible to cross-site scripting within the extension parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This can allow an attacker to convince an authenticated admin into clicking a link to run...

6.1CVSS6.3AI score0.01905EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.122 views

WordPress Popup Builder < 4.0.7 - Remote Code Execution

Popup Builder WordPress plugin before 4.0.7 contains a local file inclusion caused by unsanitized 'sgpbtype' parameter in require statement, letting attackers include arbitrary local files or execute code via wrappers like PHAR, exploit requires attacker to control 'sgpbtype' parameter. id:...

8.8CVSS7.4AI score0.05229EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.88 views

WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues. id: CVE-2021-24435 info: name: WordPress Titan Framework plugin =...

6.1CVSS6.4AI score0.01714EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.210 views

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

6.1CVSS6.3AI score0.01555EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.91 views

WordPress Asgaros Forum <1.15.13 - SQL Injection

WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

9.8CVSS7.4AI score0.12559EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.42 views

WordPress Automatic Plugin - Unauthenticated Options Change

WordPress Automatic Plugin versions 3.53.2 and below contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the processform.php script. The vulnerable script uses updateoption on all POST parameters without authentication or capability...

9.8CVSS7.4AI score0.16408EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.69 views

WordPress FoodBakery <2.2 - Cross-Site Scripting

WordPress FoodBakery before 2.2 contains an unauthenticated reflected cross-site scripting vulnerability. It does not properly sanitize the foodbakeryradius parameter before outputting it back in the response. id: CVE-2021-24389 info: name: WordPress FoodBakery 2.2 - Cross-Site Scripting author:...

6.1CVSS6.3AI score0.03753EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.86 views

WordPress Customize Login Image <3.5.3 - Cross-Site Scripting

WordPress Customize Login Image plugin prior to 3.5.3 contains a cross-site scripting vulnerability via the custom logo link on the Settings page. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2021-33851 info: name: WordPress Customi...

5.4CVSS6AI score0.01318EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.65 views

WordPress Transposh Translation <1.0.8 - Cross-Site Scripting

WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in...

6.1CVSS6.7AI score0.01567EPSS
SaveExploits4References5
Rows per page
Query Builder