CVE-2026-39802 WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in Everest Backup = 2.3.13 versions...

CVE-2026-57806

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...

CVE-2026-105892

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

CVE-2026-94590

The CodePeople2 Sell Downloads WordPress plugin, affecting versions up to and including 1.2.3 , contains a Broken Access Control vulnerability. This issue is characterized as an Improper Verification of Source of a Communication Channel , which can lead to the Exploitation of Trusted Credentials ...

CVE-2026-94590 WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...

CVE-2026-57806

The drfuri Martfury - WooCommerce Marketplace WordPress Theme is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This issue affects versions up to and including 3.3.9 . An attacker could exploit this to execute maliciou...

CVE-2026-57806 WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...

EUVD-2026-96398

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...

EUVD-2026-96406

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

CVE-2026-105892

The rtMedia for WordPress, BuddyPress and bbPress plugin (version

CVE-2026-105892 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

CVE-2026-94676

The Tainacan Community Tainacan WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data . This vulnerability affects versions from n/a through 1.3.0 . An attacker could potentially exploit this to perform unauthorized actions. No specific exploit links ...

CVE-2026-94676 WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0...

wpbf

wpbf! wpbf è uno strumento di brute force per testare da remoto la robustezza delle password, l'enumerazione degli utenti e il rilevamento dei plugin su un sito WordPress. Description ^^^^^^^^^^^ Lo script tenterà di accedere alla dashboard di WordPress tramite il modulo di login utilizzando una...

wp2shell-poc

wp2shell PoC Der erste Proof-of-Concept der Pre-Auth-Timing-basierten SQL-Injection-PoC für die WordPress-REST-API-Batch-Route-Konfusionskette CVE-2026-63030 + CVE-2026-60137 Erreichte Befehlsausführung, ohne auch nur zu versuchen, das Admin-Passwort zu knacken. Betroffen: WordPress 6.9.0–6.9.4...

CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

CVE-2026-4791

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2026-107657

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104722

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...