CVE-2023-26852-Textpattern-v4.8.8-and-

CVE-2023-26852-Textpattern-v4.8.8-and version below Textpattern v4.8.8 and Below are vulnerable to Unrestricted File Upload – Dangerous File Content Leading to Remote Code Execution This is my first repo. Don't beat me if i didn't explain well... Textpattern is a free and open-source content...

CVE-2015-4133

CVE-2015-4133 usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH wp-content/uploads sub...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Auth Bypass PoC Proof-of-concept for CVE-2026-15013 : unauthenticated authentication bypass via SAML Signature Algorithm Confusion HMAC-SHA1 in the miniOrange SAML Single Sign On – SSO Login WordPress plugin versions up to and including 5.4.3. Authoriz...

WordPress-KeepInMind-CVE-2026-9271-Exploit

KIM-Guardian Pro CVE-2026-9271 — WordPress KeepInMind Stored XSS Assessment Authorized security assessment tool for CVE-2026-9271 Author: Sudeepa Wanigarathna · Tool: KIM-Guardian Pro v1.0 Main script: CVE-2026-9271.py !IMPORTANT Authorized use only. This tool is for security research, education,...

CVE-2026-21962-o

CVE-2026-21962 It is my first CVSS 10.0 CVE! 👍✅💯㊗️🀄️🈵 Summary Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. IMPORTANT: Message from orignal Finder Consider the potential damage to...

CVE-2025-2294

Kubio Page Builder LFI Exploit CVE-2025-2294 Local File Inclusion LFI exploit for Kubio Page Builder WordPress plugin versions ≤ 2.5.1. 📌 Description This tool exploits an unauthenticated LFI vulnerability in Kubio Page Builder plugin CVE-2025-2294, allowing attackers to read sensitive files on...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

CVE-2026-103882: acadlix: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to…

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postdeleteassessmentfilebyid function in all versions up to, and including, 1.1.9. This makes it possible for...

CVE-2025-11455: tigroumeow: The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access an...

PT-2026-134432

Name of the Vulnerable Software and Affected Versions Mapster WP Maps WordPress plugin versions prior to 2.0.6 Description An authorization bypass exists in a REST API route used for writing post data. This allows unauthenticated attackers to overwrite the titles of arbitrary posts, create new...

CVE-2026-118437: Unknown BuddyForms: The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded…

The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors...

PT-2026-134482

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions prior to 2.4.13 Description Unauthenticated attackers can extract personally identifiable information of staff members, including full names, email addresses,...

Security update for perl-Dancer2-Plugin-Auth-Extensible (critical)

openSUSE security update: security update for perl-dancer2-plugin-auth-extensible ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22190-1 Rating: critical References: bsc1275272 Cross-References: CVE-2026-15689 Affected Products: openSUSE Leap 16.0...

Fedora 45 : GitPython / python-mkdocs-rss-plugin (2026-3fa772c573)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3fa772c573 advisory. Update to 3.2.1 Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, GHSA-fx3j-rwgx-fr94, and...

Fedora 45 : gnome-shell-extension-gsconnect (2026-508badc038)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-508badc038 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

CVE-2026-118638: Unknown Mapster WP Maps: The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that…

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-116535: rainbowgeek SEOPress – AI SEO Plugin & On-site SEO: The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-116752: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-134476

Name of the Vulnerable Software and Affected Versions SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress versions prior to 10.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Sit...