Lucene search
+L

236791 matches found

Nuclei
Nuclei
added 2026/08/30 5:46 a.m.50 views

WordPress Church Admin <0.810 - Cross-Site Scripting

WordPress Church Admin plugin before 0.810 allows remote attackers to inject arbitrary web script or HTML via the address parameter via index.php/2015/05/21/churchadmin-registration-form/. id: CVE-2015-4127 info: name: WordPress Church Admin 0.810 - Cross-Site Scripting author: daffainfo severity...

4.3CVSS6AI score0.07495EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.51 views

WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting

A cross-site scripting vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter. id: CVE-2013-4117 info: name: WordPress Plugin Category Grid View Gallery 2.3.1 -...

4.3CVSS6AI score0.12974EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.58 views

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. id: CVE-2013-2287 info: name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting...

4.3CVSS6AI score0.09239EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.64 views

WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal

A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the dewfile parameter. id: CVE-2013-7240 info: name: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal author...

5CVSS7.4AI score0.19641EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.44 views

FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution

Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval, letting unauthenticated attackers execute arbitrary PHP code on the server. id: CVE-2026-6433 info: name: FlipperCode Custom CSS, JS & PHP = 2.0.7 -...

7.3CVSS7.5AI score0.01195EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.9 views

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

5.3CVSS5.7AI score0.0062EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.34 views

WordPress StageShow <5.0.9 - Open Redirect

WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshowredirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter. id: CVE-2015-5461 info: name:...

6.4CVSS6AI score0.06283EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.97 views

Magento Server MAGMI - Directory Traversal

Magento Server MAGMI aka Magento Mass Importer contains a directory traversal vulnerability in web/ajaxpluginconf.php. that allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. id: CVE-2015-2067 info: name: Magento Server MAGMI - Directory Traversal author:...

5CVSS7.4AI score0.39424EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.44 views

WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting

A cross-site scripting vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter. id: CVE-2013-4625 info: name: WordPress Plugin Duplicator 0.4.5 - Cross-Site Scripting...

4.3CVSS6AI score0.11102EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.22 views

WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

9.8CVSS6AI score0.04458EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.67 views

BJ Lazy Load (Timthumb) <= 0.7.5 - Remote File Inclusion

The BJ Lazy Load plugin v0.7.5 for WordPress has a Remote File Inclusion vulnerability via TimThumb. id: CVE-2015-9415 info: name: BJ Lazy Load Timthumb = 0.7.5 - Remote File Inclusion author: s4e-io severity: high description: | The BJ Lazy Load plugin v0.7.5 for WordPress has a Remote File...

7.5CVSS7.1AI score0.03399EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.30 views

WP Planet <= 0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in rss.class/scripts/magpiedebug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter. id: CVE-2014-4592 info: name: WP Planet = 0.1 - Cross-Site Scripting author:...

6.1CVSS6.5AI score0.04032EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.59 views

WordPress Spider Calendar <=1.4.9 - SQL Injection

WordPress Spider Calendar plugin through 1.4.9 is susceptible to SQL injection. An attacker can execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php, thus making it possible to obtain sensitive information, modify data, and/or execut...

7.5CVSS6.2AI score0.11182EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.55 views

WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting

WordPress sourceAFRICA plugin version 0.1.3 contains a cross-site scripting vulnerability. id: CVE-2015-6920 info: name: WordPress sourceAFRICA =0.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress sourceAFRICA plugin version 0.1.3 contains a cross-site scripting...

4.3CVSS5.8AI score0.0384EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.39 views

Last.fm Rotation 1.0 - Path Traversal

Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation lastfm-rotation plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the snode parameter. id: CVE-2014-5181 info: name: Last.fm Rotation 1.0 - Path Traversal author: DhiyaneshDK...

5CVSS6AI score0.04259EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.37 views

WordPress Plugin Tera Charts - Local File Inclusion

Multiple local file inclusion vulnerabilities in Tera Charts tera-charts plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. dot dot in the fn parameter to 1 charts/treemap.php or 2 charts/zoomabletreemap.php. id: CVE-2014-4940 info: name: WordPress Plugin Tera Charts...

5CVSS7.4AI score0.1927EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.58 views

wpForo Forum <= 2.4.14 - SQL Injection

wpForo Forum WordPress plugin = 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-1581 info: name: wpForo Forum = 2.4.14 - SQL Injection author: Shivam Kamboj...

7.5CVSS5.9AI score0.01727EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.16 views

YMC Filter - SQL Injection

YMC Filter = 3.11.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-54836 info: name: YMC Filter - SQL Injection author: theamanrawat severity: critical...

9.3CVSS6.1AI score0.01343EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.29 views

Webnus Inc. Modern Events Calendar - Broken Access Control

Webnus Inc. Modern Events Calendar = 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges. id: CVE-2026-32583 info: name: Webnus Inc. Modern Events...

5.3CVSS5.8AI score0.007EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/30 5:46 a.m.30 views

WordPress Contact Form by Supsystic - Server-Side Template Injection

Contact Form by Supsystic WordPress plugin = 1.7.36 contains a server-side template injection caused by unsandboxed TwigLoaderString and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters. id: CVE-2026-4257 info: name: WordPress Contact...

9.8CVSS6.1AI score0.41475EPSS
SaveExploits9References3
Rows per page
Query Builder