WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting

WordPress Bello Directory & Listing theme before 1.6.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape the listinglistview, btbblistingfieldmylat, btbblistingfieldmylng, btbblistingfielddistancevalue, btbblistingfieldmylatdefault,...

WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting

WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter a search query. Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean...

Themes Coder Ecommerce <= 1.3.4 - SQL Injection

The Themes Coder Ecommerce WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. id: CVE-2024-13726 info: name: Themes Coder Ecommerce = 1.3.4 - SQL...

All Thrive Themes and Plugins - Unauthenticated Option Update

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...

Wordpress Multiple Themes - Reflected Cross-Site Scripting

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution

WordPress themes including Shapely = 1.2.7, NewsMag = 2.4.1, Activello = 1.4.0, Illdy = 2.1.4, Allegiant = 1.2.2, Newspaper X = 1.3.1, Pixova Lite = 2.0.5, Brilliance = 1.2.7, MedZone Lite = 1.2.4, Regina Lite = 2.0.4, Transcend = 1.1.8, Affluent = 1.1.0, Bonkers = 1.0.4, Antreas = 1.0.2, Sparkli...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 77,636 WordPress 보안 스캐닝을 위한 Nuclei 템플릿 🥳 WordPress 보안 실력을 한 단계 끌어올리세요! 이 프로젝트는 WordPress용 최신 Nuclei 템플릿의 보물창고입니다. Wordfence.com의 최신 인텔리전스를 기반으로 핵심Core, 플러그인, 테마의 취약점을 스캔하세요. 이 프로젝트가 여러분의 새로운 베스트 프렌드인 이유는 다음과 같습니다: 방대한 컬렉션 : 더 이상 개별 템플릿을 찾아 헤맬 필요 없이, 손끝에서 바로 사용할 수 있는 전체 무기고를...

CVE-2022-0316_wordpress_multiple_themes_exploit

Wordpress 다중 테마 - 인증되지 않은 임의 파일 업로드 CVE-2022-0316 ChimpStudio 및 PixFill의 여러 테마에서 인증되지 않은 임의 파일 업로드 취약점입니다. 더 많은 익스플로잇 및 독점 익스플로잇을 원하시면 텔레그램 @KtN1990으로 연락주세요. 영향을 받는 테마 westand footysquare aidreform statfort club-theme kingclub-theme spikes spikes-black soundblast bolster rocky-theme bolster-theme...

CVE

CVE一覧表 CVE番号| 種別| 企業/製品| 説明| 記事リンク| リポジトリリンク ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows July 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| 外部バインドされたMCPサーバーでのサニタイズ欠如により、SQLインジェクションが発生する可能性があります。|...

wpbullet

wpBullet WordPress 플러그인/테마 및 PHP를 위한 정적 코드 분석 설치 간단히 저장소를 클론하고, 요구 사항을 설치한 후 스크립트를 실행하세요. $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py 사용법 사용 가능한 옵션: root@kitploit: --path required System path or download URL...

wpscvn

wpscvn is a tool for pentesters, website owner to test if their websites had some vulnerable plugins or themes The author does not hold any responsibility for the bad use of this tool, remember that attacking targets without prior consent is illegal and punished by law. requires : Python 3 usage ...

CVE-2023-38146-Poc

ThemeBleed CVE-2023-38146 익스플로잇 PoC Windows 11 테마 https://github.com/gabe-k/themebleed 에서 많은 영감을 받았으며, 해당 도구는 Windows에서만 실행됩니다 이것이 제가 작성하게 된 이유입니다. impacket smbserver.py https://github.com/fortra/impacket/blob/master/impacket/smbserver.py 의 수정된 코드를 사용했습니다. 유용한 자료:...

wpBullet

wpBullet 一个针对 WordPress 插件/主题（和 PHP）的静态代码分析工具 安装 只需克隆仓库，安装依赖项并运行脚本： $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py 使用方法 可用选项： root@kitploit: --path 必需 系统路径或下载 URL 示例： --path="/path/to/plugin"...

CVE-2023-38146

ThemeBleed CVE-2023-38146 エクスプロイトの PoC Windows 11 テーマ https://github.com/gabe-k/themebleed に大きく影響を受けています。元のツールは Windows でのみ動作するため、この PoC を書くことにしました。 impacket の smbserver.py の改変コードを使用しています https://github.com/fortra/impacket/blob/master/impacket/smbserver.py 参考情報:...

wordpress-hacking

WordPressハッキング WordPressおよびそのプラグインとテーマをハッキングするための便利なリソース集です。 バグ報奨金プログラム WordPressの脆弱性の発見と報告に情熱を持っているなら、以下のバグ報奨金プログラムへの参加を検討してください: Wordfence と Patchstack。私のWordfenceリンクを通じて登録すると、あなたが5件の脆弱性を報告した際に私にも少しボーナスが入り、コミュニティ向けのツールやリソースの開発を支援することができます。ありがとうございます！ プラグイン...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 278 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)

Last week, there were 266 vulnerabilities disclosed in 186 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 131 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-81779

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48...

CVE-2026-81779 WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48...