WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FV Simpler SEO versions = 1.9.7...

WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Chained Quiz versions = 1.4.1...

WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Post Video Players versions = 1.165...

WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin GEO my WordPress versions = 4.5.5.3...

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-89269

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin YouTube Showcase versions = 4.1.0...

CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

CVE-2026-54867 WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9...

WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Responsive Slider versions = 0.1.9...

CVE-2026-54868 WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7...

WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FV Simpler SEO versions = 1.9.7...

CVE-2026-54869 WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1...

WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin IMPress for IDX Broker versions = 3.3.1...

wp2shell

🔍 wp2shell - WordPress CVE-2026-63030 Vulnerability Scanner & Exploit ⚡ Fast, Real-time Vulnerability Scanner & Exploit for CVE-2026-63030 wp2shell 📌 Overview wp2shell is a comprehensive toolkit for detecting and exploiting CVE-2026-63030 , a critical vulnerability in WordPress that allows...

abdal-cve-2026-63030

English | فارسی 🛡️ Abdal CVE-2026-63030 PoC Exploits Abdal CVE-2026-63030 is a defensive WordPress exposure verifier for the REST API batch route confusion tracked as CVE-2026-63030. The issue can be chained with CVE-2026-60137 on affected WordPress releases and may lead to remote code execution...

WordPress 7.0.1 Pre-Authentication Remote Code Execution

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a REST API batch route confusion and SQL injection chain that can lead to unauthenticated remote code execution. This proof of concept creates an administrator and uploads a command shell. https://packetstorm.news/download/235...