100172 matches found
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
On August 19th, 2026, during internal research, I discovered an Authentication Bypass vulnerability in WPMU DEV Dashboard, a WordPress plugin with an estimated 350,000 active installations. This vulnerability makes it possible for unauthenticated attackers to gain administrator access when Hub...
CVE-2026-19092
The Tutor LMS WordPress plugin before 4.0.6 is vulnerable to template variable shadowing : request data can overwrite internal variables during template rendering, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. This yields a CVSS 3.1 score...
CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
EUVD-2026-67242
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
CVE-2023-4861-PoC
CVE-2023-4861 PoC Questo repository contiene una prova di concetto in Python per CVE-2023-4861 , un problema di esecuzione remota di codice autenticato nel plugin WordPress File Manager Pro - Filester. Riepilogo della vulnerabilità CVE: CVE-2023-4861 Prodotto: File Manager Pro - Filester filester...
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.33...
WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14.2...
WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability
Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin Smush Image Compression and Optimization versions = 4.2.0...
WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability
Bypass vulnerability vulnerability discovered by Gaurav popalghat in WordPress Plugin Essential Addons for Elementor versions = 6.8.0...
WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Rank Math SEO versions = 1.0.276...
WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability
WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability discovered by Jashid Sany in WordPress Plugin AI Engine versions 3.3.3-3.7.1...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability
Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...
WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability
Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Md Mehedi Hasan in WordPress Plugin WP Job Portal versions = 2.5.9...
WordPress RestrictMate plugin < 1.3.0 - Unauthenticated Privilege Escalation to Administrator vulnerability
Unauthenticated Privilege Escalation to Administrator vulnerability discovered by João Ramos Maciel in WordPress Plugin RestrictMate versions 1.3.0...
WordPress WPCargo Track & Trace plugin < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number vulnerability
Unauthenticated SQL Injection via wpcargotrackingnumber vulnerability discovered by Shivamani Vastrala in WordPress Plugin WPCargo Track & Trace versions 8.0.4...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...