Lucene search
+L

236791 matches found

Nuclei
Nuclei
added 2026/08/31 5:18 a.m.161 views

EventON Lite < 2.1.2 - Arbitrary File Download

The plugin does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the numeric id of the post. id:...

5.3CVSS6.7AI score0.07521EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.45 views

WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting

The WP-Optimize WordPress plugin before 3.2.13 and SrbTransLatin WordPress plugin before 2.4.1 are vulnerable to cross-site scripting due to a third-party library that improperly handles HTML character escaping. id: CVE-2023-1119 info: name: WP-Optimize WordPress plugin 3.2.13 - Cross-Site...

6.1CVSS6.7AI score0.01244EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.90 views

Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting

Image Optimizer by 10web before 1.0.26 is susceptible to cross-site scripting via the iowdtabsactive parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can...

6.1CVSS6.7AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.65 views

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

7.1CVSS6.8AI score0.01317EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.34 views

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

9.1CVSS5.9AI score0.01834EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.24 views

WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload

The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server. id: CVE-2020-36728 info: name: WordPress Plugin Adning Advertising 1.5.6 - Arbitrary File Upload author: iamnoooob,pdresearch...

9.8CVSS7.3AI score0.03159EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.57 views

Nova Lite < 1.3.9 - Cross-Site Scripting

Nova Lite before 1.3.9 for WordPress is susceptible to reflected cross-site scripting via search.php. id: CVE-2020-17362 info: name: Nova Lite 1.3.9 - Cross-Site Scripting author: daffainfo severity: medium description: Nova Lite before 1.3.9 for WordPress is susceptible to reflected cross-site...

6.1CVSS6.3AI score0.02873EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.24 views

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

6.1CVSS6.5AI score0.02072EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.21 views

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

10CVSS7.3AI score0.08975EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.149 views

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the poststatus parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

7.1CVSS7AI score0.38768EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.21 views

WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection id: CVE-2023-0037 info: name: WordPress 10Web Map...

9.8CVSS7.3AI score0.03911EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.146 views

Ultimate Addons for Elementor <= 1.24.1 - Registration Bypass

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled. id: CVE-2020-13125 info...

9.9CVSS6.7AI score0.08565EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.70 views

Download Monitor < 4.4.5 - SQL Injection

The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...

7.2CVSS7.1AI score0.17348EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.17 views

WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)

The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the "themestylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability. id: CVE-2025-6174 info: name: WordPress Qwizcards alert'randstr'" matchers...

6.1CVSS5.9AI score0.0046EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.61 views

WordPress OrderConvo < 14 - Path Traversal

WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely id: CVE-2025-10162 info: name: WordPress OrderConvo 14 - Path Traversal autho...

7.5CVSS5.9AI score0.03632EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.9 views

Photo Gallery WordPress v1.6.3 - SQL Injection

Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $POST'filtertag' parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests. id: CVE-2022-1281 info: name: Photo Gallery WordPress v1.6.3 -...

9.8CVSS7.5AI score0.43036EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.65 views

WordPress Formality Plugin <= 1.5.9 - Local File Inclusion

Michele Giorgi Formality = 1.5.9 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires crafted input. id: CVE-2025-48157 info: name: WordPress Formality Plugin = 1.5.9 - Local File...

8.1CVSS5.9AI score0.02188EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.48 views

WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure

WP Directory Kit plugin for WordPress = 1.4.9 contains a sensitive information exposure caused by improper access control in wdkpublicaction AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles. id: CVE-2025-13920 info: name: WP...

5.3CVSS5.9AI score0.00669EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.37 views

Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure

Export WP Page to Static HTML & PDF WordPress plugin = 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger...

9.8CVSS5.8AI score0.02135EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.42 views

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

9.8CVSS7.3AI score0.03283EPSS
SaveExploits3References1
Rows per page
Query Builder