WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Ozeum versions = 1.3.0...

WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flipmart versions = 2.8...

WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Fabius versions = 1.0...

WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Equadio versions = 1.1.4...

WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Juno versions = 2.25...

WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme N7 | Golf Club Sports & Events versions = 2.21...

WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Invetex versions = 2.18...

WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Asia Garden versions = 1.3.1...

WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin ThemeStek Extras for LabtechCO Theme versions = 8.4...

CVE-2026-22241

CVE-2026-22241 : Open eClass Remote Code Execution RCE Questo exploit utilizza CVE-2026-22241 automatizzando il login, la creazione di file ZIP, il processo di upload e fornendo una webshell direttamente sul server, rimuovendola automaticamente una volta completato l'exploit. Descrizione Una...

CVE-2026-29053

Dies ist eine Überarbeitung des Repos von rootxran für dieselbe CVE - https://github.com/rootxran/CVE-2026-29053 Bei Tests gegen bestimmte Ghost-CMS-Umgebungen löste das ursprüngliche Theme-Payload einen Fatal Handlebars Error aus. Das CMS konnte das bösartige Theme nicht aktivieren, da es auf...

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC Autore dell'exploit: Ashish Koli Shikari Home page del fornitore: https://github.com/pluck-cms/pluck Versione: 4.7.16 CVE: CVE-2022-26965 Informazioni: Questo script carica shell.tar su PluckCMS. L'applicazione eseguirà...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Autorizzazione mancante per l'installazione/attivazione arbitraria di plugin da parte di utenti autenticati Abbonato+ Descrizione: Il tema ColorMag per WordPress è vulnerabile ad accessi non autorizzati a causa di una mancata verifica delle capacità nella funzione...

CVE-2025-1306

Newscrunch Exploit CVE-2025-1306 🚨 Panoramica Questo exploit prende di mira una vulnerabilità di Cross-Site Request Forgery CSRF verso upload arbitrario di file CVE-2025-1306 nel tema WordPress Newscrunch. A causa della mancata validazione nonce nella funzione newscrunchinstallandactivateplugin, ...

CVE-2024-10674

Exploit CVE-2024-10674 - Th Shop Mania = 1.4.9 🚀 Panoramica Questo repository contiene un exploit per la vulnerabilità identificata come CVE-2024-10674 nel tema WordPress Th Shop Mania. La vulnerabilità consente a utenti autenticati con almeno accesso a livello di Abbonato di installare e attivar...

CVE-2024-10673

🔥 Übersicht Dieses Skript nutzt CVE-2024-10673 aus, eine kritische Schwachstelle im Top Store WordPress-Theme = 1.5.4. Der Fehler erlaubt authentifizierten Benutzern mit Abonnenten-Zugriff oder höher , beliebige Plugins über ungeschützte AJAX-Anfragen zu installieren und zu aktivieren. ⚠️...

CVE-2023-41425-WonderCMS-Authenticated-RCE

CVE-2023-41425-WonderCMS-Authenticated-RCE Descrizione WonderCMS v3.2.0 - v3.4.2 è vulnerabile. Attaccanti remoti possono prendere il pieno controllo del server utilizzando un exploit di Cross-Site Scripting XSS solo a scopo educativo. Ecco il piano: Come funziona: L'exploit abusa del componente...

CVE-2025-57055

CVE-2025-57055: Authentifizierte Remote-Code-Ausführung in WonderCMS 3.5.0 Angriffsmechanik In WonderCMS v3.5.0 existiert eine authentifizierte Remote-Code-Ausführungs-Schwachstelle RCE. Das Problem liegt in der Art und Weise, wie die Anwendung Remote-Theme/Modul-Installationen über...

CVE-2026-104671

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...

CVE-2026-104671 TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...