wpgarlic

wpgarlic 거의 3천만 개 사이트에 설치된 WordPress 플러그인에서 300개 이상의 취약점을 발견하게 한 개념 증명proof-of-concept WordPress 플러그인 퍼저입니다. 사용된 기술은 https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html 에 설명되어 있습니다. 연구를 계속하고 싶다면 덜 인기 있는 플러그인부터 시작하세요. 만약 플러그인이 2021년 10월과 2024년 1월 사이에 최소 10,000회의 활성 설치를 달성했다면, 제가 이미 퍼저 보고서를...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 77,636 WordPress 보안 스캐닝을 위한 Nuclei 템플릿 🥳 WordPress 보안 실력을 한 단계 끌어올리세요! 이 프로젝트는 WordPress용 최신 Nuclei 템플릿의 보물창고입니다. Wordfence.com의 최신 인텔리전스를 기반으로 핵심Core, 플러그인, 테마의 취약점을 스캔하세요. 이 프로젝트가 여러분의 새로운 베스트 프렌드인 이유는 다음과 같습니다: 방대한 컬렉션 : 더 이상 개별 템플릿을 찾아 헤맬 필요 없이, 손끝에서 바로 사용할 수 있는 전체 무기고를...

wpBullet

wpBullet WordPressプラグイン/テーマ（およびPHP）向け静的コード解析ツール インストール リポジトリをクローンし、依存関係をインストールしてスクリプトを実行するだけです。...

wp_hunter

wphunter Wordpress 플러그인의 취약점을 검색하기 위한 정적 분석 도구입니다. root@kitploit: / \ / \ / | \ / | \ // /| / \ | / \ / \ \ \ / | | \ Y / | / | \ | \ /| | / /\ / ||| /|/|| /| \ | / // / / / | Author: @JosueEncinar Starting the process Total plugins 87509 Starting the analisys 모듈 추가 방법 이 도구는 정규 표현식 없이...

wpbullet

wpBullet WordPressプラグイン/テーマ（およびPHP）の静的コード解析 インストール リポジトリをクローンし、依存関係をインストールしてスクリプトを実行します $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py 使い方 利用可能なオプション: root@kitploit: --path 必須 システムパスまたはダウンロードURL 例:...

wordpress-php-object-helper

wordpress-php-object-helper 概要 既知のプラグインにPHPオブジェクトエクスプロイトがあるが、その問題を悪用してphpggcで実行するためにどのライブラリを使うべきか判断する必要がある、という場合に役立ちます。 これがあなたの助けになるはずです。 出力例 root@kitploit: $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were 277 vulnerabilities disclosed in 187 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 153 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Last week, there were 275 vulnerabilities disclosed in 214 WordPress Plugins and 17 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 116 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 265 vulnerabilities disclosed in 202 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 144 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response

The Wordfence Threat Intelligence Team was notified on August 7th, 2026 of a supply chain compromise affecting BdThemes, a WordPress plugin vendor whose plugins are available in the official WordPress plugins directory. Currently, all the affected plugins are temporarily closed pending a full...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)

Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-14872

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

EUVD-2026-51762

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-14483

The CVE-2026-14483 entry describes an unauthenticated Arbitrary File Upload in the Realtyna Organic IDX plugin + WPL Real Estate (

EUVD-2026-51404

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Last week, there were 264 vulnerabilities disclosed in 210 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 117 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-15397

The CVE concerns the WordPress plugin Subscriptions for WooCommerce (versions ≤ 2.0.0). The issue is Missing Authorization in the AJAX handler wps_sfw_install_plugin_configuration , allowing authenticated users with shop manager-level access or higher to install and activate arbitrary WordPress.o...

CVE-2026-15393

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and...

EUVD-2026-49701

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-11349

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...