EUVD-2025-210829

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

EUVD-2024-55747

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2023-3360 Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, enabling PHP object injection when a high-privilege user imports a malicious file and a suitable gadget chain exists on the blog. The vulnerability is rated CVSS 3.3 (LOW) with high attack complexity...

CVE-2023-3360 Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

EUVD-2023-60614

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - Ejecución Remota de Código Autenticada Este repositorio contiene un exploit funcional para CVE-2021-44967 , una vulnerabilidad de Ejecución Remota de Código autenticada en LimeSurvey. 🎯 Compatibilidad Probado y confirmado funcionando en: LimeSurvey 5.2.x LimeSurv...

CVE-2026-5415

CVE-2026-5415 CVE-2026-5415 WP Captcha PRO Exploit de Omisión de Autenticación Autenticada...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — Escalada de Privilegios No Autenticada mediante Inyección de Rol 🔥 Resumen de la Vulnerabilidad El plugin de WordPress Doctreat Core versiones = 1.6.8 es vulnerable a una vulnerabilidad de escalada de privilegios no autenticada. Esta falla crítica permite a...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-70047

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-70046

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83547

Xpro Addons (WordPress plugin) versions 1.6.0 through 1.7.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain widget settings are not properly escaped before being rendered within HTML attributes . An attacker with the Contributor role or higher can inject malic...

CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment

The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-82884

The All in One SEO WordPress plugin before 5.0.0.1 fails to sanitise and escape content stored in the ai-assistant Block within posts before rendering it in the post editor. This allows users with the contributor role or higher to inject a Stored Cross-Site Scripting (XSS) payload that executes w...

CVE-2026-82884 All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...