CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Unauthenticated SQL Injection via meclistloadmore attsinclude / attsexclude Summary Detail| Value ---|--- Plugin| Modern Events Calendar Lite Slug| modern-events-calendar-lite Author| Webnus Affected| = 7.33.0 the current vendor-distributed Lite release. Bug...

CVE-2024-8529

CVE-2024-8529 LearnPress – WordPress LMS Plugin = 4.2.7 - Unauthenticated SQL Injection via 'cfields' Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'cfields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in...

003Recon

📌 Description This repository contains some of my scripts that i created to automate some recon processes. It performs the following things; 1. Get subdomains of a domain 2. Filter out only online domains 3. Scan the domains for CRLF 4. Check for a CORS misconfigurations 5. Test for open redirect...

CVE-2026-105701

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 2.0.66 . The root cause is a missing capability check on the REST API form creation endpoint combined with an unsandboxed Twig environment used for rendering email templates. A...

EUVD-2026-92986

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2022-1329

CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...

CVE-2026-5076

CVE-2026-5076 - ARMember Password Reset Vulnerability Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Affected Version| Premium = 7.3.1 Patched Version| 7.3.2 CVSS Score| 9.8 Critical CWE| CWE-640: Weak Password...

wp2shell

wp2shell-check Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 "wp2shell", a pre-authentication RCE chain in WordPress core REST API batch-route confusion → SQL injection → RCE. Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta full RCE chain; 6.8.0–6.8.5 SQL injection only,...

CVE-2025-6586

Download Plugin 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu 1500 qdisc...

CVE-2025-1562

CVE-2025-1562 POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124 Safari/537.36...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...

CVE-2026-89289

The Fast Courier WordPress plugin (versions

EUVD-2026-92968

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

WordPress Fast Courier plugin <= 5.2.3 - Unauthenticated Order Fulfillment Update vulnerability

Unauthenticated Order Fulfillment Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Fast Courier versions = 5.2.3...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

CVE-2026-94278

The File Media Renamer WordPress plugin (versions

WordPress Slider Pro plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Seongwon Lee in WordPress Plugin Slider Pro versions = 1.0.0...