CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin (versions before 2.2.1 ) is vulnerable to an incorrect authorization flaw (CWE-863). The plugin fails to perform proper authorization checks within a set of AJAX actions , which allows users with at least the Contributor role to perform unauthorized a...

CVE-2026-105977 Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators...

CVE-2026-105995 Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

EUVD-2026-96120

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-104754

The Rank Math SEO WordPress plugin (versions before 1.0.280 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to escape a stored redirection source value. An attacker with permissions to manage redirections (typically Administrators ) can inject malicious JavaScript that execu...

CVE-2026-104752

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to remote code execution (RCE) . The root cause is an unrestricted upload of file with dangerous type (CWE-434) within the settings import feature, which fails to correctly validate the type of uploaded files. This a...

CVE-2026-104753

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to SQL injection due to insufficient sanitization and escaping of the 'per_page' parameter before it is used in a SQL query. This vulnerability allows users with high privileges, such as administrators , to perform u...

EUVD-2026-96119

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-104753 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-104754 Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-104752 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

lab-cve-2025-3515

CVE-2025-3515 WordPress Labor Drag and Drop Multiple File Upload for Contact Form 7 Starten Sie eine verletzliche WordPress-Umgebung, um CVE-2025-3515 zu reproduzieren und zu validieren – uneingeschränkter Datei-Upload über ddmuuploadfile im Plugin drag-and-drop-multiple-file-upload-contact-form-...

plecost

Plecost Professioneller WordPress-Sicherheitsscanner Async-first, bibliotheksfreundlich, keine externe API erforderlich. Inhaltsverzeichnis Was ist Plecost? Plecost vs. WPScan Schnellstart Installation CVE-Datenbank CVE-Erkennungsmodul Scannen Erkennungsmodule WooCommerce-Sicherheit WP...

Trinity-Audio-CVE-Report2

Trinity-Audio-CVE-Report 2 Offenlegung von CVE-2025-9886 und CVE-2025-9952. CVE-2025-9886 und CVE-2025-9952 - Schwachstelle in Trinity Audio Dieses Repository legt eine Schwachstelle offen, die in Trinity Audio = 5.20.1, einem WordPress-Plugin von sergiotrinity, entdeckt wurde. 🛠 Betroffene Versi...

wpCrack

wpCrack v1.0 Version 1.0 Installation git clone https://github.com/MrSqar-Ye/wpCrack.git WordPress-Hash-Cracker Video Kontakt : Twitter : @M4DM0E Sende an meine E-Mail...

CVE-2022-1597

CVE-2022-1597 Das Plugin, das als Begleit-Plugin für die Themes Discy und Himer verwendet wird, bereinigt einen Parameter in seinem Passwort-Reset-Formular nicht und escaped ihn auch nicht, wodurch Reflected Cross-Site-Scripting-Angriffe ermöglicht werden. Betroffene Plugins: WPQA...

CVE-2021-24959

CVE-2021-24959 Beschreibung Das WP Email Users WordPress Plugin bis Version 1.7.6 escapet den Parameter dataraw in der AJAX-Aktion weuselectedusers1 nicht. Dies steht allen authentifizierten Benutzern zur Verfügung und ermöglicht ihnen SQL-Injection-Angriffe. CVE CVE-2021-24959 CVSS 8.8 High...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Nicht authentifizierte PHP-Objekt-Injektion Beschreibung: Das Formidable Forms Plugin für WordPress ist anfällig für PHP-Objekt-Injektion in Versionen bis einschließlich 6.1.2 durch Deserialisierung nicht vertrauenswürdiger Eingaben aus Formulareinsendunge...

blind-xxe-controller-CVE-2021-29447

Controlador de XXE cego Criei este controlador ao fazer a máquina metatwo no HackTheBox para explorar a CVE-2021-29447, que é uma vulnerabilidade XXE do WordPress na Biblioteca de Mídia que afeta as versões 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. Nela, um usuário autenticado com permissão para enviar...

wpjuicer

wpjuicer WP Juicer Tool zum schnellen Scannen vertraulicher Informationen auf WordPress-Endpunkten. Dieses Skript ist ausschließlich für Wordpress gedacht und erleichtert die Lokalisierung sensibler Informationen in Framework-Endpunkten, indem es bei der Erkennung und Datenextraktion durch...