CVE-2025-9314

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

CVE-2025-15481

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2025-8945

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

CVE-2025-15490

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2025-15485

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2025-15692

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-3773

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2023-3360

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 WordPressプラグイン WPCode Lite Insert Headers and Footers v2.3.5 の リモートコード実行（RCE） 脆弱性をテストするためのエクスプロイトツールです。この脆弱性は、カスタム投稿タイプ（CPT）wpcode を、カスタム capabilitytype を定義せずに登録したことに起因します。この見落としにより、Author ロール（またはそれ以上）を持つ任意のユーザーがXML-RPCを介してサーバー上で任意のPHPコードを実行できます。 クレジット : t.me/FanatixLegion...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | 未認証の任意ファイルアップロード 研究者: Atomic Edge 深刻度: Critical | CVSS: 9.8 | 認証要件: なし ⚠️ v2 — 技術的修正を適用 （コミュニティからのフィードバックに基づく） 詳細は 変更履歴 を参照してください。 概要 BookingPress Pro WordPress プラグイン（バージョン ≤ 5.6）には、重大な未認証の任意ファイルアップロードの脆弱性が存在します。予約送信ハンドラー bookingpressbookappointmentbooking...

CVE-2026-6145

CVE-2026-6145 — WordPress用User Registration & Membership: 未認証の管理者承認バイパス CVE-2026-6145 の概念実証エクスプロイト。WordPress用 User Registration & Membership プラグイン（≤ 5.1.5）における認可欠落の脆弱性で、未認証の攻撃者が新規アカウント作成時の管理者承認要件をバイパスできるようにします。 概要...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

EUVD-2025-210834

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

CVE-2025-9314

The Developer Tools WordPress plugin through version 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in its bundled SWFUpload component. This allows a remote, unauthenticated attacker to upload arbitrary files over the network with low complexity, rated CVSS 3.1: 9.8 (Critic...