Lucene search
+L

2315 matches found

Kitploit
Kitploit
added 2026/09/17 5:19 a.m.8 views

CVE-2025-4606

CVE-2025-4606 Overview This tool is used to test the vulnerability CVE-2025-4606 in WordPress using the Sala – Startup & SaaS WordPress Theme. This vulnerability allows Privilege Escalation through Account Takeover because the theme does not properly validate user identity before updating sensiti...

9.8CVSS8.4AI score0.00581EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/17 3:28 a.m.14 views

CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes Theme = 4.4.0 - Privilege Escalation 🔥 Vulnerability Summary The WordPress theme RealHomes versions = 4.4.0 is vulnerable to a privilege escalation vulnerability. This allows authenticated users with low privileges such as subscribers to escalate their roles to...

8.8CVSS7.6AI score0.06951EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.161 views

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. id: CVE-2021-24407 info: name: WordPress Jannah Theme 5.4.5 - Cross-Site Scripting author: pikpikcu severity:...

6.1CVSS6.2AI score0.02591EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.83 views

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

9.8CVSS8.3AI score0.02342EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.43 views

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...

7.5CVSS7.6AI score0.55008EPSS
SaveExploits1References4
Kitploit
Kitploit
added 2026/09/17 2:04 a.m.18 views

CVE-2025-4322

🔐 CVE-2025-4322 – Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover 📌 Themes Information Plugin : Motors = 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover Vulnerable Version : = 5.6.67 CVE : CVE-2025-4322 Severity : 9.8...

9.8CVSS8.7AI score0.15524EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/16 2:22 p.m.10 views

CVE-2024-10673

🔥 概要 このスクリプトは CVE-2024-10673 を悪用します。これは Top Store WordPress テーマ = 1.5.4 に見つかった重大な脆弱性です。この欠陥により、購読者以上のアクセス権を持つ認証済みユーザー が、保護されていない AJAX リクエストを介して任意のプラグインをインストールおよび有効化できるようになります。 ⚠️ 重大性と影響 認証なしのプラグインインストール : 購読者権限 を持つ攻撃者は、管理者の承認なしにプラグインをインストールできます。 リモートコード実行 RCE の可能性 :...

8.8CVSS8.6AI score0.01179EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/16 2:01 p.m.8 views

CVE-2025-5394

CVE-2025-5394 CVE‑2025‑5394 WP Alone theme ≤ 7.8.3...

9.8CVSS6.2AI score0.52758EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/16 11:58 a.m.10 views

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - 認証済み(Subscriber+)による任意のプラグインのインストール/有効化を許可する認可不足 説明: WordPress用のColorMagテーマは、バージョン3.1.2まで(およびそれを含む)の全バージョンにおいて、pluginactioncallback関数に対する機能チェックが欠如しているため、不正アクセスに対して脆弱です。これにより、購読者レベル以上のアクセス権を持つ認証済み攻撃者が任意のプラグインをインストールおよび有効化できる可能性があります。 root@kitploit: Severity: medium...

6.5CVSS7.5AI score0.01301EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/16 11:41 a.m.11 views

CVE-2024-10674

CVE-2024-10674 エクスプロイト - Th Shop Mania = 1.4.9 🚀 概要 このリポジトリには、Th Shop Mania WordPressテーマにおけるCVE-2024-10674として識別された脆弱性のエクスプロイトが含まれています。この脆弱性により、少なくとも購読者レベルのアクセス権を持つ認証済みユーザーが、適切な認可なしに任意のプラグインをインストールおよび有効化できるようになります。このエクスプロイトは悪意のあるプラグインをインストールするために利用される可能性があり、結果としてリモートコード実行や権限昇格につながる可能性があります。 🔍 脆弱性の...

8.8CVSS8.5AI score0.01732EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/16 4:13 a.m.7 views

CVE-2024-3867

CVE-2024-3867 This repository shows u some information on this vulnerability, which were found by me. Here is the official description given: The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate...

6.1CVSS6.1AI score0.00818EPSS
SaveExploits0
NVD
NVD
added 2026/09/15 4:17 p.m.6 views

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

5.1CVSS0.00283EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/15 4:17 p.m.4 views

CVE-2026-87792

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

8.7CVSS0.00359EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/15 4:17 p.m.4 views

CVE-2026-87793

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

5.1CVSS0.00395EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/15 3:23 p.m.8 views

EUVD-2026-78668

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

5.1CVSS5.8AI score0.00283EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/15 3:23 p.m.10 views

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

5.1CVSS5.8AI score0.00283EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/15 3:21 p.m.8 views

CVE-2026-87793

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

5.1CVSS6.3AI score0.00395EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/15 3:21 p.m.6 views

EUVD-2026-78666

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter...

5.1CVSS6.3AI score0.00395EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/15 3:20 p.m.10 views

CVE-2026-87792

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

8.7CVSS5.8AI score0.00359EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/15 3:20 p.m.7 views

EUVD-2026-78665

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed...

8.7CVSS5.8AI score0.00359EPSS
SaveExploits0References2
Rows per page
Query Builder