CVE-2023-47668

CVE-2023-47668 描述 StellarWP Membership Plugin – Restrict Content 插件 结果示例 root@kitploit: Log file content: 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003311 successful. 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003312 successful. 2024-12-24 20:47:19 - wprcpdiscounts...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 认证绕过 PoC CVE-2026-15013 的概念验证：通过 miniOrange SAML Single Sign On – SSO Login WordPress 插件（版本截至并包括 5.4.3 ）中的 SAML 签名算法混淆 （HMAC-SHA1）实现未认证认证绕过。 仅限授权测试。 仅在你拥有或已获得明确许可的系统上使用此代码。未经授权访问计算机系统是违法的。 Credits 角色| ---|--- 漏洞发现者| lhking（在 CVE 记录中被署名） CVE / CNA|...

CVE-2018-6574

Código y cosas...

CVE-2026-21962-o

CVE-2026-21962 ¡Es mi primer CVE con CVSS 10.0! 👍✅💯㊗️🀄️🈵 Resumen Una vulnerabilidad fácilmente explotable permite que un atacante no autenticado con acceso a la red a través de HTTP comprometa Oracle HTTP Server y el complemento de proxy de Oracle WebLogic Server. IMPORTANTE: Mensaje del...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - 未经认证的任意插件安装 描述 Pubnews WordPress 主题在所有版本（包括 1.0.7）中，由于 pubnewsimporterpluginactionfornotice 函数缺少权限检查，导致存在未经授权的任意插件安装漏洞。此漏洞允许拥有订阅者级别及以上的已认证攻击者安装任意插件，进而可利用这些插件来利用其他漏洞。 CWE CWE-434: 危险类型文件的不受限制上传 CVSS 评分: 8.8 高危 版本: 3.1 向量字符串:...

CVE-2026-84780 WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-84780

WP Go Maps is a WordPress plugin affected by an unauthenticated Denial of Service vulnerability in versions ≤ 10.1.08 , as reported by researcher Asim Alshaya via Patchstack. The CVSS 3.1 score is 5.3 (Medium) with a network attack vector, low complexity, and no privileges required, resulting in ...

EUVD-2026-69942

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-84775

CVE-2026-84775 affects the Really Simple SSL WordPress plugin, versions 9.8.0 and earlier . The vulnerability allows an unauthenticated Denial of Service attack, meaning a remote attacker with no prior access can disrupt service availability. The CVSS 3.1 base score is 5.3 (MEDIUM) , with the pri...

CVE-2026-84775 WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Really Simple SSL = 9.8.0 versions...

CVE-2026-84771

This unauthenticated IDOR vulnerability affects the WordPress PublishPress Permissions plugin in versions 4.8.3 and earlier . Discovered by Brobicho and assigned by Patchstack , it allows a remote attacker with no privileges to access resources they should not, resulting in a low confidentiality ...

CVE-2026-84772 WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84772

A Server-Side Request Forgery (SSRF) vulnerability was identified in the Broken Link Checker WordPress plugin, affecting versions ≤ 2.4.14 . The flaw is exploitable by users with Editor privileges, allowing them to forge server-side requests. The CVSS 3.1 score is 5.5 (Medium) with a changed scop...

EUVD-2026-69940

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

EUVD-2026-69938

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-84770

CVE-2026-84770 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the Mang Board WP WordPress plugin, affecting versions ≤ 2.3.8 . The vulnerability was discovered by John Ryan Albon and is rated CVSS 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning a ...

EUVD-2026-69937

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84764 WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...