CVE-2026-3852

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the $urloptions...

CVE-2024-6386

CVE-2024-6386 - WPML 中通过 Twig SSTI 实现 RCE PoC 基于 Python+Selenium 的 PoC 详细研究（俄语）：CVE-2024-6386 CVSS 基础评分： 9.9 向量： CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 摘要 在 WPML 中，你可以使用特定的 WordPress Shortcodes 来创建宏并渲染 Twig 模板。因此，你可以轻松地从中实现 SSTI。 利用链 SSTI 例如，让我们创建一个 shortcode 来利用 SSTI： root@kitploit:...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia para WordPress, BuddyPress y bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

CVE-2025-7431

概念验证 – CVE-2025-7431 Knowledge Base = 2.3.1 - 已验证（管理员以上权限）通过插件别名存储型跨站脚本攻击 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N ------- 4.4 漏洞概述 经过身份验证的攻击者（管理员）可通过向WordPress知识库插件的设置中注入恶意短代码内容，利用该插件的存储型跨站脚本（XSS）漏洞。 复现步骤 1. 测试者访问： root@kitploit: WordPress Admin Dashboard → Knowledge Base → Settings 2...

CVE-2024-3105-PoC

CVE-2024-3105 PoC Woody代码片段 – WordPress的插入页眉页脚代码、AdSense广告插件在所有版本，包括2.5.0及更早版本中，通过'insertphp'短代码存在远程代码执行漏洞。这是由于该插件未限制高级授权用户使用该功能。这使得经过身份验证的攻击者，具有贡献者级别及以上访问权限，能够在服务器上执行代码。 信息 基础评分：9.9 严重 向量：CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 软件类型：插件 软件标识：insert-php 修复措施：更新至版本2.5.1或更新的补丁版本 受影响版本： NUL";...

CVE-2024-13346

CVE-2024-13346 Avada 主题 7.11.14 - 未经认证的任意短代码执行 CVE-2024-13346 漏洞利用脚本 安装代码 root@kitploit: git clone https://github.com/tausifzaman/CVE-2024-13346.git root@kitploit: cd CVE-2024-13346 root@kitploit: pip install -r requirements.txt root@kitploit: python3 exploit.py Google Cloud Console Cloud Shell...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WP Popup Builder Popup Forms and Marketing Lead Generation <= 1.3.5 - Arbitrary Shortcode Execution

The The WP Popup Builder Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wpajaxnoprivshortcodeApiAdd AJAX action in all versions up to, and including, 1.3.5. This is due to the software allowing users to execute an action that...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

CVE-2026-3228

CVE-2026-3228 - Escáner y Exploit de XSS Almacenado para el Plugin de WordPress NextScripts https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/WordPress-Plugin-red Autor: NULL200OK Una herramienta integral en Python para...

CVE-2025-15368-Exploit

CVE-2025-15368 漏洞利用工具 WordPress 的 SportsPress 插件（= 2.7.26）— LFI 与 RCE 作者: kazehere4you 日期: 2026-02-11 描述 该工具利用了 WordPress 的 SportsPress 插件（版本 2.7.26 及更低）中的一个本地文件包含（LFI）漏洞。通过使用 eventlist 短代码并操纵 templatename 属性，经过身份验证的攻击者（贡献者 Contributor 及以上权限）可以包含任意文件。 此外，该工具还包含一个利用链，可通过上传恶意图片文件并借助 LFI...

CVE-2026-81571

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...

CVE-2024-3773

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

EUVD-2024-55747

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

EUVD-2026-70044

The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...