100231 matches found
cve-2024-25600
Exploit Repository: CVE-2024-25600 🔥 Unauthenticated RCE Exploit for WordPress Bricks Builder Welcome to the official repository for the CVE-2024-25600 exploit targeting WordPress Bricks Builder version 1.9.6 and below. This exploit allows for the execution of arbitrary code remotely, posing a...
CVE-2026-75930
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2026-19892
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...
CVE-2026-19943
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17089
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14280
The Events Manager WordPress plugin (≤ 7.3.7.4) is vulnerable to Local File Inclusion via the em_options_save function, specifically through manipulated dbem_data[updates] array keys. An attacker with administrator-level access or above can store a malicious traversal key that is subsequently exe...
CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
WordPress Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenverse versions = 4.0.2...
EUVD-2026-65278
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
EUVD-2026-65279
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-19943
The Gutenverse WordPress plugin (a page builder and site editor) is vulnerable to Stored Cross-Site Scripting via the titleTag block attribute in all versions up to and including 4.0.2 . The root cause is insufficient input sanitization and output escaping : the malicious titleTag value survives ...
CVE-2026-76063
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...
CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17089 Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17089 Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-65276
The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...