Lucene search
+L

237819 matches found

Nuclei
Nuclei
added 2026/09/03 2:10 a.m.144 views

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

8.3CVSS7AI score0.54872EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.81 views

WordPress Simple Job Board <2.9.4 - Local File Inclusion

WordPress Simple Job Board prior to version 2.9.4 is vulnerable to arbitrary file retrieval vulnerabilities because it does not validate the sjbfile parameter when viewing a resume, allowing an authenticated user with the downloadresume capability such as HR users to download arbitrary files from...

7.7CVSS7.2AI score0.30479EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.81 views

WordPress Canto 1.3.0 - Blind Server-Side Request Forgery

WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative...

5.3CVSS6.2AI score0.27771EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.215 views

User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation

The User Registration & Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'preparemembersdata' function. This makes it possible for unauthenticated attackers to create newuser...

8.1CVSS7.2AI score0.46384EPSS
SaveExploits7References3
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.35 views

Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

7.5CVSS7.2AI score0.46858EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.66 views

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

9.8CVSS7.5AI score0.62903EPSS
SaveExploits9References2
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.98 views

Magento Server MAGMI - Directory Traversal

Magento Server MAGMI aka Magento Mass Importer contains a directory traversal vulnerability in web/ajaxpluginconf.php. that allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. id: CVE-2015-2067 info: name: Magento Server MAGMI - Directory Traversal author:...

5CVSS7.4AI score0.39424EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.55 views

404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. id: CVE-2015-9323 info: name: 404 to 301 = 2.0.2 - Authenticated Blind SQL Injection author: Harsh severity: critical description: | The 404 to 301 –...

9.8CVSS7.3AI score0.46125EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.142 views

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

9.8CVSS7.4AI score0.728EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.9 views

Photo Gallery WordPress v1.6.3 - SQL Injection

Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $POST'filtertag' parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests. id: CVE-2022-1281 info: name: Photo Gallery WordPress v1.6.3 -...

9.8CVSS7.5AI score0.43036EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.59 views

WordPress Gift Voucher <4.1.8 - Blind SQL Injection

WordPress Gift Vouchers plugin before 4.1.8 contains a blind SQL injection vulnerability via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative...

9.8CVSS7.4AI score0.49918EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.81 views

W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal

WordPress plugin W3 Total Cache before version 0.9.4 allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data via pub/sns.php. id: CVE-2019-6715 info: name: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal autho...

7.5CVSS7.3AI score0.19396EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.79 views

WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion

WordPress Nevma Adaptive Images plugin before 0.6.67 allows remote attackers to retrieve arbitrary files via the $REQUEST'adaptive-images-settings''sourcefile' parameter in adaptive-images-script.php. id: CVE-2019-14205 info: name: WordPress Nevma Adaptive Images 0.6.67 - Local File Inclusion...

7.5CVSS7.3AI score0.63375EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.54 views

WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion

WordPress Wechat Broadcast plugin 1.2.0 and earlier allows Directory Traversal via the Image.php url parameter. id: CVE-2018-16283 info: name: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion author: 0x240x23elu severity: critical description: WordPress Wechat Broadcast plugin 1.2.0...

9.8CVSS7.2AI score0.6307EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.168 views

User Profile Builder < 3.11.8 - File Upload

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. id: CVE-2024-6366 info: name: User Profile Builder 3.11.8 - File Upload author: s4e-io severity: high...

9.1CVSS5.9AI score0.28993EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.42 views

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

10CVSS7.6AI score0.2872EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.148 views

Hash Form <= 1.1.0 - Arbitrary File Upload

The Hash Form Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on...

9.8CVSS7.7AI score0.50653EPSS
SaveExploits8References3
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.55 views

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

9.8CVSS6.2AI score0.52266EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.54 views

WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1. id: CVE-2024-28000 info: name: WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin...

9.8CVSS7.4AI score0.68266EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/03 2:10 a.m.108 views

WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion

WordPress Delightful Downloads Jquery File Tree versions 2.1.5 and older are susceptible to local file inclusion vulnerabilities via jqueryFileTree. id: CVE-2017-1000170 info: name: WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion author: dwisiswant0 severity: high...

7.5CVSS7.1AI score0.59063EPSS
SaveExploits7References5
Rows per page
Query Builder