324170 matches found
PT-2026-110855
Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...
PT-2026-122569
Name of the Vulnerable Software and Affected Versions Auction Nudge – Your eBay on Your Site versions prior to 8.4.1 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts...
PT-2026-122572
Name of the Vulnerable Software and Affected Versions Meals & Wheels versions prior to 1.1.14 Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used to achieve code execution is present in...
PT-2026-122576
Name of the Vulnerable Software and Affected Versions Nuts versions prior to 1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets us...
PT-2026-122579
Name of the Vulnerable Software and Affected Versions Avventure versions prior to 1.1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...
PT-2026-122587
Name of the Vulnerable Software and Affected Versions Gunslinger versions prior to 1.12 Description The Gunslinger theme for WordPress allows unauthenticated attackers to perform PHP Object Injection due to the deserialization of untrusted input. This occurs when the application processes data th...
PT-2026-122574
Name of the Vulnerable Software and Affected Versions Motorix versions prior to 1.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...
CVE-2026-107791: Missing Authorization
The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...
PT-2026-110473
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...
VulnCheck KEV: CVE-2026-0702
The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
PT-2026-122570
Name of the Vulnerable Software and Affected Versions Legal Stone versions prior to 1.2.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...
PT-2026-110479
Name of the Vulnerable Software and Affected Versions Hotel Booking versions prior to 3.9 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if a booking record belongs to the user requesting it. This allows any authenticated user, such as a Subscriber,...
WordPress Ad Inserter Cross-Site Script Vulnerability
WordPress Ad Inserter 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to stored-xss attacks...
WordPress Event Post Authorization Issue Vulnerability
WordPress Event post 6.1.1 and earlier versions have a vulnerability related to authorization settings. This vulnerability stems from improper access control configurations, which may allow unauthorized access...
WordPress Event Post Authorization Issue Vulnerability
WordPress Event post 6.1.1 and earlier versions have a vulnerability related to authorization. This vulnerability stems from bypassing authorization through user-controlled keys. Attackers can exploit improperly configured access control levels, leading to unauthorized access...
WordPress Booster Elite for WooCommerce has a vulnerability related to information leakage
WordPress Booster Elite for WooCommerce versions prior to 8.4.0 have a vulnerability related to information leakage. This vulnerability arises from inserting sensitive information into the data sent out, potentially allowing the retrieval of embedded sensitive data...
nuclei-wordfence-cve
Nuclei + Wordfence = ♥ 86,413 Nuclei Templates for WordPress Security Scanning 🥳 Level up your WordPress security game! This project's got a treasure trove of fresh Nuclei templates for WordPress. Scan for weaknesses in Core, plugins, and themes – all based on the latest intel from Wordfence.com...
wpscan
WPScan Escáner de Seguridad de WordPress Base de datos de vulnerabilidades de WordPress de WPScan - Plugin de seguridad de WordPress INSTALACIÓN Prerrequisitos Opcional pero altamente recomendado: rbenv Ruby = 3.3 - Recomendado: última versión estable Curl = 7.72 - Recomendado: última versión...
wpscvn
wpscvn es una herramienta para pentesters y propietarios de sitios web para probar si sus sitios tienen algunos plugins o temas vulnerables. El autor no se hace responsable del mal uso de esta herramienta, recuerda que atacar objetivos sin consentimiento previo es ilegal y castigado por la ley...
