237819 matches found
CVE-2026-10821
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...
CVE-2025-9314
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...
CVE-2025-8945
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...
CVE-2025-15481
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
CVE-2025-15490
The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...
CVE-2025-15485
The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...
CVE-2025-15489
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2025-15692
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-3773
The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...
CVE-2023-3360
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...
EXPLOIT-CVE-2026-8832-
EXPLOIT-CVE-2026-8832 WordPress 플러그인 WPCode Lite Insert Headers and Footers v2.3.5 의 원격 코드 실행 RCE 취약점을 테스트하기 위한 익스플로잇 도구입니다. 이 취약점은 사용자 정의 게시글 유형CPT wpcode를 등록할 때 사용자 정의 capabilitytype을 정의하지 않아 발생합니다. 이 결함으로 인해 Author 역할또는 상위을 가진 모든 사용자가 XML-RPC를 통해 서버에서 임의의 PHP 코드를 실행할 수 있습니다. 크레딧 :...
CVE-2026-6960
CVE-2026-6960 — BookingPress Pro ≤ 5.6 | 인증되지 않은 임의 파일 업로드 연구: Atomic Edge 심각도: Critical | CVSS: 9.8 | 인증 필요: 없음 ⚠️ v2 — 기술적 수정 적용 커뮤니티 피드백 반영 자세한 내용은 변경 로그를 참조하세요. 개요 BookingPress Pro WordPress 플러그인버전 ≤ 5.6에 중요한 인증되지 않은 임의 파일 업로드 취약점이 존재합니다. 예약 제출 핸들러 bookingpressbookappointmentbooking은 서명 사용자 정의...
CVE-2026-6145
CVE-2026-6145 — User Registration & Membership for WordPress: 인증되지 않은 관리자 승인 우회 CVE-2026-6145 에 대한 개념 증명 익스플로잇으로, WordPress용 User Registration & Membership 플러그인≤ 5.1.5에서 인증되지 않은 공격자가 새 계정 생성 시 관리자 승인 요구 사항을 우회할 수 있는 인가 누락 취약점입니다. 요약...
CVE-2026-2811
The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...
EUVD-2026-70050
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...
CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...
CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...
CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...
CVE-2025-9314 Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...