Lucene search
+L

236812 matches found

Nuclei
Nuclei
added 2026/08/31 5:18 a.m.64 views

WordPress AnyComment <0.3.5 - Open Redirect

WordPress AnyComment plugin before 0.3.5 contains an open redirect vulnerability via an API endpoint which passes user input via the redirect parameter to the wpredirect function without being validated. An attacker can redirect a user to a malicious site and possibly obtain sensitive information...

6.1CVSS6.4AI score0.02208EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.528 views

WordPress WPS Hide Login <1.9.1 - Information Disclosure

WordPress WPS Hide Login plugin before 1.9.1 is susceptible to incorrect authorization. An attacker can obtain the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. This reveals the secret login location. id:...

7.5CVSS7.2AI score0.71532EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.61 views

Noptin < 1.6.5 - Open Redirect

Noptin 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. id: CVE-2021-25033 info: name: Noptin 1.6.5 - Open Redirect author: dhiyaneshDk severity: medium...

6.1CVSS6.4AI score0.02303EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.86 views

WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting

WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevartduplicatepostparametrssaveindb AJAX action, allowing unauthenticated users to call...

3.5CVSS5.8AI score0.01364EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.24 views

WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting

WordPress Securimage-WP-Fixed plugin 3.5.4 and prior contains a cross-site scripting vulnerability due to the use of $SERVER'PHPSELF' in the /securimage-wp.php file, which allows attackers to inject arbitrary web scripts. id: CVE-2021-34640 info: name: WordPress Securimage-WP-Fixed =3.5.4 -...

6.1CVSS6.4AI score0.02313EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.64 views

WordPress Permalink Manager <2.2.15 - Cross-Site Scripting

WordPress Permalink Manager Lite and Pro plugins before 2.2.15 contain a reflected cross-site scripting vulnerability. They do not sanitize and escape query parameters before outputting them back in the debug page. id: CVE-2022-0201 info: name: WordPress Permalink Manager 2.2.15 - Cross-Site...

6.1CVSS6.3AI score0.03368EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.39 views

WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting

WordPress Plugin MapPress before version 2.73.4 does not sanitize and escape the 'mapid' parameter before outputting it back in the "Bad mapid" error message, leading to reflected cross-site scripting. id: CVE-2022-0208 info: name: WordPress Plugin MapPress 2.73.4 - Cross-Site Scripting author:...

6.1CVSS6.3AI score0.02038EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.210 views

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

WordPress eCommerce Product Catalog plugin before 3.0.39 contains a cross-site scripting vulnerability. The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute. This can allow an attacker to steal cookie-based authentication credentials an...

6.1CVSS6.3AI score0.01555EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.24 views

WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload

The Adning Advertising plugin for WordPress versions below 1.5.6 is vulnerable to arbitrary file upload, allowing attackers to upload malicious files to the server. id: CVE-2020-36728 info: name: WordPress Plugin Adning Advertising 1.5.6 - Arbitrary File Upload author: iamnoooob,pdresearch...

9.8CVSS7.3AI score0.03159EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.57 views

Nova Lite < 1.3.9 - Cross-Site Scripting

Nova Lite before 1.3.9 for WordPress is susceptible to reflected cross-site scripting via search.php. id: CVE-2020-17362 info: name: Nova Lite 1.3.9 - Cross-Site Scripting author: daffainfo severity: medium description: Nova Lite before 1.3.9 for WordPress is susceptible to reflected cross-site...

6.1CVSS6.3AI score0.02873EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.24 views

Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs that redirect to an external web site via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the...

6.1CVSS6.5AI score0.02072EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.21 views

Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

10CVSS7.3AI score0.08975EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.23 views

Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection

Team WordPress plugin = 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands. id: CVE-2025-14124 info: name: Team WordPress Plugin TLP Team = 5.0.9...

8.6CVSS6.1AI score0.01594EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.61 views

FooGallery plugin <= 2.2.35 - Cross-Site Scripting

Reflected Cross-Site Scripting XSS vulnerability in FooPlugins FooGallery plugin = 2.2.35 versions. id: CVE-2023-29439 info: name: FooGallery plugin = 2.2.35 - Cross-Site Scripting author: theamanrawat severity: medium description: | Reflected Cross-Site Scripting XSS vulnerability in FooPlugins...

7.1CVSS6.8AI score0.01747EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.144 views

WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. i...

9.8CVSS7.2AI score0.90339EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.28 views

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

9.8CVSS6AI score0.02791EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.31 views

WordPress Kali Forms <= 2.4.9 - Remote Code Execution

Kali Forms WordPress plugin = 2.4.9 contains a remote code execution caused by unsafe user input handling in 'formprocess' and 'preparepostdata' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication. id: CVE-2026-3584 info: name: WordPress Kal...

9.8CVSS6.4AI score0.07239EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.5 views

Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation

The Read More & Accordion expand-maker plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler yrmimportdata action. An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPre...

8.8CVSS5.9AI score0.01242EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.30 views

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

7.5CVSS5.9AI score0.01473EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.51 views

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

7.5CVSS5.9AI score0.01211EPSS
SaveExploits0References3
Rows per page
Query Builder