CVE-2014-91371-Wordpress-

CVE-2014-91371-Wordpress Description root@kitploit: wordpress with Plugin Slider REvolution 4.1.4...

CVE-2025-2011

CVE-2025-2011 - Depicter 插件 SQL 注入漏洞 CVE 参考： CVE-2025-2011 本仓库包含一个用于测试 Depicter Slider & Popup Builder 插件（版本 3.6.2）中 SQL 注入漏洞的概念验证环境。 前提条件 Docker Docker Compose Python 3.x 所需 Python 包：requests、colorama 搭建说明 1. 启动环境 root@kitploit: docker-compose up -d 2. 完成 WordPress 安装 打开浏览器并访问...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Slider Revolution 認可欠落スキャナー Slider Revolution WordPressプラグイン 6.7.0 に影響するCVE-2024-34444のプロフェッショナルマススキャナー バナー 🎯 説明 CVE-2024-34444は、Slider Revolution WordPressプラグイン（バージョン 6.7.0）における認可欠落 の脆弱性です。このスキャナーは、REST APIエンドポイント /wp-json/revslider/v1/slider/save を介した脆弱なインストールの検出と悪用を自動化します。 技術的...

WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...

WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload

Slider Future WordPress plugin = 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'sliderfuturehandleimageupload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication. id: CVE-2026-1405 info: name: WordPres...

OWL Carousel Slider - Cross-Site Scripting

OWL Carousel Slider WordPress plugin v2.2 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft malicious URL. id: CVE-2024-13627 info:...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection

WordPress WP TripAdvisor Review Slider plugin before 10.8 is susceptible to authenticated SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. This can lead...

CVE-2026-49777

CVE-2026-49777 CVE-2026-49777 - ShapedPlugin Product Slider Pro for WooCommerce バックドア RCE 詳細技術分析: Product Slider Pro バックドア脆弱性 脆弱性の基本と原因 CWE-1284 この脆弱性の技術的な起源は...

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...

CVE-2026-5399

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

EUVD-2026-75365

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

CVE-2025-2011

CVE-2025-2011 PoC 作者： X3RX3S 但自豪地被 Ash Wesker 剥离，这家伙用他的横幅对 GPT 了我的代码 ; 看这里 --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 你甚至可以在“他”的代码里看到我的 handle --' 目的： 一个概念验证工具，用于测试针对 WordPress 站点的 SQL 注入漏洞（CVE-2025-2011）。 免责声明： 仅用于您拥有 或已获得明确书面许可的系统。未经授权的测试是非法且不道德的。 关于漏洞 : WordPress 插件 Slider & Popup...

CVE-2026-1405

CVE-2026-1405 Slider Future = 1.0.5 - 未认证任意文件上传 🚀 CVE-2026-1405.py — Slider Future 批量利用工具 🩸 漏洞概述 组件： Slider Future（WordPress 插件） 受影响版本： ≤ 1.0.5 漏洞类型： 未认证任意文件上传 CVE： CVE-2026-1405 CVSS 评分： 9.8（严重） WordPress 的 Slider Future 插件在所有版本（包括 1.0.5）中，由于 sliderfuturehandleimageupload...

CVE-2025-10353-POC

CVE-2025-10353 POC - Subida de Archivos RCE 🛠️ POC para CVE-2025-10353: Una vulnerabilidad de subida de archivos en el módulo melis-cms-slider de Melis Platform que puede conducir a la ejecución remota de código RCE cuando un atacante sube un archivo malicioso a través del parámetro mcsdetailimg a...

woocommerce-plugin-supply-chain-security-assessment

CVE-2026-49777 - WooCommerce产品滑块专业版恶意软件植入远程代码执行 顾问式网络安全报告 针对WooCommerce插件供应链风险的专业漏洞评估报告，涵盖业务影响、修复措施及缓解策略。 📍 报告概览 字段| 详情 ---|--- 报告类型| 漏洞评估报告 参与背景| 安全研究 主要关注点| Web应用安全 受众| 安全团队、工程团队、招聘经理 输出风格| 执行摘要、技术分析、业务影响、修复路线图 发布状态| 经脱敏处理，用于公开作品集审核 !IMPORTANT...

CVE-2015-1579

CVE-2015-1579 - WP Revslider AFD Exploit: Wordpress Slider Revolution Responsive = 4.1.4: root@kitploit: Fecha de la vulnerabilidad: 24/07/2014 Autor del exploit: anarc0der Versión: Wordpress Slider Revolution Responsive = 4.1.4 CVE : CVE-2015-1579 Cómo usar: root@kitploit: python3 xpl.py...

CVE-2026-84028 Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...