CVE-2026-105995 Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

EUVD-2026-96125

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin (versions before 2.2.1 ) is vulnerable to an incorrect authorization flaw (CWE-863). The plugin fails to perform proper authorization checks within a set of AJAX actions , which allows users with at least the Contributor role to perform unauthorized a...

EUVD-2026-96120

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-104754

The Rank Math SEO WordPress plugin (versions before 1.0.280 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to escape a stored redirection source value. An attacker with permissions to manage redirections (typically Administrators ) can inject malicious JavaScript that execu...

CVE-2026-104752

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to remote code execution (RCE) . The root cause is an unrestricted upload of file with dangerous type (CWE-434) within the settings import feature, which fails to correctly validate the type of uploaded files. This a...

EUVD-2026-96119

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-104754 Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-104753 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-104752 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

CVE-2026-104753

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to SQL injection due to insufficient sanitization and escaping of the 'per_page' parameter before it is used in a SQL query. This vulnerability allows users with high privileges, such as administrators , to perform u...

lab-cve-2025-3515

CVE-2025-3515 WordPress Lab Drag and Drop Multiple File Upload for Contact Form 7 Avvia un ambiente WordPress vulnerabile per riprodurre e validare la CVE-2025-3515 — caricamento di file senza restrizioni tramite ddmuuploadfile nel plugin drag-and-drop-multiple-file-upload-contact-form-7 ≤ 1.3.8....

plecost

Plecost Scanner professionale per la sicurezza di WordPress Basato su asincronia, adatto a librerie, nessuna API esterna richiesta. Indice Cos'è Plecost? Plecost vs WPScan Avvio rapido Installazione Database CVE Motore di rilevamento CVE Scansione Moduli di rilevamento Sicurezza WooCommerce...

Trinity-Audio-CVE-Report2

Trinity-Audio-CVE-Report 2 Offenlegung von CVE-2025-9886 und CVE-2025-9952. CVE-2025-9886 und CVE-2025-9952 - Schwachstelle in Trinity Audio Dieses Repository legt eine Schwachstelle offen, die in Trinity Audio = 5.20.1, einem WordPress-Plugin von sergiotrinity, entdeckt wurde. 🛠 Betroffene Versi...

wpCrack

wpCrack v1.0 versione 1.0 Installazione git clone https://github.com/MrSqar-Ye/wpCrack.git Cracker di hash WordPress Video Contatti : Twitter : @M4DM0E Invia alla mia email...

CVE-2022-1597

CVE-2022-1597 Das Plugin, das als Begleit-Plugin für die Themes Discy und Himer verwendet wird, bereinigt einen Parameter in seinem Passwort-Reset-Formular nicht und escaped ihn auch nicht, wodurch Reflected Cross-Site-Scripting-Angriffe ermöglicht werden. Betroffene Plugins: WPQA...

CVE-2021-24959

CVE-2021-24959 Descrizione Il plugin WP Email Users per WordPress fino alla versione 1.7.6 non esegue l'escape del parametro dataraw nell'azione AJAX weuselectedusers1, disponibile a qualsiasi utente autenticato, permettendo loro di effettuare attacchi di SQL injection. CVE CVE-2021-24959 CVSS 8....

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Iniezione di Oggetti PHP non autenticata Descrizione: Il plugin Formidable Forms per WordPress è vulnerabile all'Iniezione di Oggetti PHP nelle versioni fino alla 6.1.2 inclusa, tramite deserializzazione di input non fidato proveniente dall'invio dei modul...

blind-xxe-controller-CVE-2021-29447

Controller per Blind XXE Ho creato questo controller per la macchina metatwo di HackTheBox per sfruttare CVE-2021-29447, una vulnerabilità XXE di WordPress nella libreria multimediale che colpisce le versioni 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. dove un utente autenticato con la possibilità di caricar...

wpjuicer

wpjuicer WP Juicer Tool per la scansione rapida di informazioni riservate sugli endpoint di WordPress. Questo script è esclusivamente per Wordpress e facilita la localizzazione di informazioni sensibili negli endpoint del framework, aiutando nel riconoscimento e nell'estrazione dei dati fornendo...