Lucene search
+L

78 matches found

Kitploit
Kitploit
added 2026/09/07 5:14 p.m.8 views

CVE-2026-49049

CVE-2026-49049 — Helix3 Joomla 插件 JoomShaper 未经身份验证的 AJAX 处理器 — 只读漏洞扫描器 概述 CVE-2026-49049 影响 Joomla 的 Helix3 模板框架(版本 1.0 至 3.1.0 )。通过 Joomla 的 comajax 调度器可访问的 onAjaxHelix3 处理器,在多个破坏性操作上未执行任何身份验证、授权或 CSRF 验证 : 操作| 影响| 可用版本 ---|---|--- save| 写入攻击者控制的 JSON 文件,支持路径遍历| 所有版本 remove| 删除任意文件 — 无扩展名或路径限制|...

7.5CVSS6AI score0.00992EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/07 1:45 p.m.5 views

cve-2021-38314

CVE-2021-38314 Python 利用程序 详情 Gutenberg Template Library & Redux Framework 插件 = 4.2.11 为 WordPress 注册了多个 AJAX 操作,这些操作位于 redux-core/class-redux-core.php 的 includes 函数中,对未认证用户可用。这些操作对特定站点是唯一的,但具有确定性和可预测性,因为它们基于站点 URL 的 md5 哈希(盐值已知为 '-redux')以及前一个哈希的 md5 哈希(盐值已知为 '-support')。这些 AJAX...

5.3CVSS6AI score0.28961EPSS
SaveExploits6
CVE
CVE
added 2026/09/05 6:00 a.m.17 views

CVE-2026-78149

The Smart Post WordPress plugin (Post Grid, Post Carousel, & List Category Posts) versions 4.0.0 through 4.0.7 are affected by an unauthenticated information disclosure vulnerability in the sp_handle_post_id AJAX action. The plugin fails to check whether a post is password-protected before return...

5.3CVSS5.2AI score0.00251EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/03 12:51 a.m.11 views

CVE-2025-5947_Exploit

🔍 WordPress 插件漏洞利用 — Service Finder sf-booking 概述 Service Finder 插件是 WordPress 的预订和服务管理系统。 由于其受欢迎程度和复杂性,某些版本存在与未认证的 AJAX 端点 或不当访问控制相关的安全问题。 本 README 旨在说明研究人员如何安全地对安装进行指纹识别,并遵循道德规范(dbr krk)。 易受攻击的 WP 搜索语法 /wp-content/plugins/service-finder/ /wp-content/plugins/service-finder-bookings/...

9.8CVSS8.5AI score0.04469EPSS
SaveExploits2References1
Patchstack
Patchstack
added 2026/08/17 7:50 a.m.14 views

WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

8.8CVSS5.2AI score0.00379EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/08/16 5:16 a.m.12 views

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

8.8CVSS0.00345EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/16 4:24 a.m.11 views

EUVD-2026-59863

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

8.8CVSS5.5AI score0.00345EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/16 4:24 a.m.15 views

EUVD-2026-59861

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

5.3CVSS5.5AI score0.00386EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/16 4:24 a.m.46 views

CVE-2026-15441 Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

5.3CVSS0.00386EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment
added 2026/08/16 4:24 a.m.7 views

CVE-2026-15441 Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter

The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptopscrolloffset' shortcode attribute exposed through the unauthenticated wcptajax AJAX handler. The handler is registered for wpajaxnoprivwcptajax, JSON-decodes...

5.3CVSS5.5AI score0.00386EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
added 2026/08/16 4:24 a.m.18 views

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

9.8CVSS5.4AI score0.0051EPSS
SaveExploits0References13
ATTACKERKB
ATTACKERKB
added 2026/08/15 2:26 a.m.14 views

CVE-2026-15001

The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions savebloyalconfigurationdata and savebloyalaccesskeyverificationdata being registered without any capability or...

5.2AI score0.00379EPSS
SaveExploits0References11
NVD
NVD
added 2026/08/12 6:20 a.m.10 views

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

8.1CVSS0.00215EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/09 6:19 a.m.15 views

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

6.5CVSS0.00249EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/01 6:00 a.m.11 views

CVE-2026-13604

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

5.6AI score0.00171EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/31 7:16 a.m.16 views

CVE-2026-14834

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists...

6.5CVSS0.00164EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/29 7:16 a.m.18 views

CVE-2026-13423

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

9.8CVSS0.00536EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.20 views

PT-2026-65690

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

7.5CVSS5.8AI score0.00489EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/27 7:16 a.m.25 views

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

6.1CVSS0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/27 6:00 a.m.47 views

CVE-2026-14190 Sina Extension for Elementor < 3.10.2 - Reflected XSS

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

0.00162EPSS
SaveExploits0References1
Rows per page
Query Builder