Lucene search
+L

237819 matches found

NVD
NVD
added 2026/09/02 3:17 p.m.7 views

CVE-2025-9314

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS0.00296EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.4 views

CVE-2025-15481

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

5.3CVSS0.00187EPSS
SaveExploits1References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

5.3CVSS0.00207EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.4 views

CVE-2025-15490

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

5.3CVSS0.0021EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2025-15485

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

8.2CVSS0.00204EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.6 views

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

5.3CVSS0.00193EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.6 views

CVE-2025-15692

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

3.5CVSS0.00173EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2024-3773

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

5.9CVSS0.00142EPSS
SaveExploits1References1
NVD
NVD
added 2026/09/02 3:17 p.m.5 views

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

3.3CVSS0.0015EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/02 2:58 p.m.4 views

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 WordPressプラグイン WPCode Lite Insert Headers and Footers v2.3.5 の リモートコード実行(RCE) 脆弱性をテストするためのエクスプロイトツールです。この脆弱性は、カスタム投稿タイプ(CPT)wpcode を、カスタム capabilitytype を定義せずに登録したことに起因します。この見落としにより、Author ロール(またはそれ以上)を持つ任意のユーザーがXML-RPCを介してサーバー上で任意のPHPコードを実行できます。 クレジット : t.me/FanatixLegion...

8.8CVSS5.3AI score0.01862EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/02 2:47 p.m.4 views

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | 未認証の任意ファイルアップロード 研究者: Atomic Edge 深刻度: Critical | CVSS: 9.8 | 認証要件: なし ⚠️ v2 — 技術的修正を適用 (コミュニティからのフィードバックに基づく) 詳細は 変更履歴 を参照してください。 概要 BookingPress Pro WordPress プラグイン(バージョン ≤ 5.6)には、重大な未認証の任意ファイルアップロードの脆弱性が存在します。予約送信ハンドラー bookingpressbookappointmentbooking...

9.8CVSS5.3AI score0.00696EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 2:39 p.m.5 views

CVE-2026-6145

CVE-2026-6145 — WordPress用User Registration & Membership: 未認証の管理者承認バイパス CVE-2026-6145 の概念実証エクスプロイト。WordPress用 User Registration & Membership プラグイン(≤ 5.1.5)における認可欠落の脆弱性で、未認証の攻撃者が新規アカウント作成時の管理者承認要件をバイパスできるようにします。 概要...

5.3CVSS5.3AI score0.00445EPSS
SaveExploits1
CVE
CVE
added 2026/09/02 2:25 p.m.10 views

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 2:25 p.m.7 views

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 2:25 p.m.29 views

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS0.00165EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 2:25 p.m.9 views

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 2:25 p.m.29 views

CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS0.00296EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/09/02 2:25 p.m.7 views

CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS5.9AI score0.00296EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 2:25 p.m.7 views

EUVD-2025-210834

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

9.8CVSS5.9AI score0.00296EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 2:25 p.m.15 views

CVE-2025-9314

The Developer Tools WordPress plugin through version 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in its bundled SWFUpload component. This allows a remote, unauthenticated attacker to upload arbitrary files over the network with low complexity, rated CVSS 3.1: 9.8 (Critic...

9.8CVSS5.9AI score0.00296EPSS
SaveExploits0References1
Rows per page
Query Builder