Lucene search
+L

237705 matches found

NVD
NVD
added 2026/09/02 3:17 p.m.4 views

CVE-2025-15481

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

5.3CVSS0.00187EPSS
SaveExploits1References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

5.3CVSS0.00207EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.4 views

CVE-2025-15485

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

8.2CVSS0.00204EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.4 views

CVE-2025-15490

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

5.3CVSS0.0021EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.6 views

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

5.3CVSS0.00193EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.6 views

CVE-2025-15692

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

3.5CVSS0.00173EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2024-3773

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

5.9CVSS0.00142EPSS
SaveExploits1References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

3.3CVSS0.0015EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/02 2:58 p.m.4 views

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 一个用于测试 WordPress 插件 WPCode Lite Insert Headers and Footers v2.3.5 中 远程代码执行 RCE 漏洞的利用工具。该漏洞源于注册自定义文章类型 CPT wpcode 时未定义自定义的 capabilitytype。这一疏忽允许任何拥有 作者 Author 角色(或更高角色)的用户通过 XML-RPC 在服务器上执行任意 PHP 代码。 致谢 :基于 t.me/FanatixLegion 的漏洞分析创建。 ⚠️ 免责声明 仅限授权的安全测试。...

8.8CVSS5.8AI score0.01862EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/02 2:47 p.m.4 views

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Carga Arbitraria de Archivos sin Autenticación Investigación por: Atomic Edge Severidad: Crítica | CVSS: 9.8 | Autenticación Requerida: Ninguna ⚠️ v2 — Correcciones técnicas aplicadas según los comentarios de la comunidad. Consulte el Registro de cambios...

9.8CVSS5.8AI score0.00696EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 2:39 p.m.5 views

CVE-2026-6145

CVE-2026-6145 — User Registration & Membership for WordPress: 未认证管理员审批绕过 针对 CVE-2026-6145 的概念验证漏洞利用,这是一个存在于 WordPress 插件 User Registration & Membership(≤ 5.1.5)中的缺失授权漏洞,允许未认证攻击者在创建新账户时绕过管理员审批要求。 摘要 | ---|--- CVE ID| CVE-2026-6145 CNA| Wordfence 漏洞类型| 缺失授权 — 管理员审批绕过 CWE| CWE-862(缺失授权) CVSS 3.1| 5....

5.3CVSS5.8AI score0.00445EPSS
SaveExploits1References1
CVE
CVE
added 2026/09/02 2:25 p.m.10 views

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 2:25 p.m.7 views

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 2:25 p.m.29 views

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS0.00165EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 2:25 p.m.8 views

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 2:25 p.m.29 views

CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS0.00296EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 2:25 p.m.6 views

CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS5.9AI score0.00296EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 2:25 p.m.14 views

CVE-2025-9314

The Developer Tools WordPress plugin through version 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in its bundled SWFUpload component. This allows a remote, unauthenticated attacker to upload arbitrary files over the network with low complexity, rated CVSS 3.1: 9.8 (Critic...

9.8CVSS5.9AI score0.00296EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 2:25 p.m.7 views

EUVD-2025-210834

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS5.9AI score0.00296EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 2:25 p.m.7 views

EUVD-2025-210833

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

5.3CVSS5.9AI score0.00207EPSS
SaveExploits0References1
Rows per page
Query Builder