274764 matches found
CVE-2026-14187 Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2025-68860
CVE-2025-68860 WordPress Mobile builder Plugin Die Schwachstelle Umgehung der Authentifizierung über einen alternativen Pfad oder Kanal in Mobile Builder ermöglicht Missbrauch der Authentifizierung. Dieses Problem betrifft Mobile builder von n/a bis 1.4.2. CVSS-Score: 9.8 KRITISCH Vektor:...
CVE-2025-39459
CVE-2025-39459 Real Estate 7 = 3.5.2 - Escalation di privilegi senza autenticazione 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Escalation di privilegi senza autenticazione 📌 Panoramica Questo repository contiene un tool proof-of-concept in Python per CVE-2025-39459 , che colpisce il tema WordPress...
CVE-2026-64638-WordPress-Core-XSS2Shell
CVE-2026-64638 — Nuclei Detection Template Template Nuclei para detecção não-intrusiva do XSS2Shell , um parser differential pré-autenticado no WordPress Core que permite injeção de elementos DOM na página de login, servindo de base para uma cadeia de XSS → RCE. ⚠️ Este template apenas detecta a...
WP-CVE-2025-4322---Scan
Uso Normal Test python3 wp-backdoor-remote-scan.py https://misitio.com con output JSON python3 wp-backdoor-remote-scan.py https://misitio.com --json Ajustar threads y timeout para sitios con rate limit python3 wp-backdoor-remote-scan.py https://misitio.com --threads 5 --timeout 15...
CVE-2026-76057
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-76074
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-75027
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...
CVE-2026-76074 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
EUVD-2026-64211
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-76074
AutomatorWP – Automator (WordPress plugin) is vulnerable to an authorization bypass in all versions up to and including 5.8.4 . The automatorwp_campaign_monitor_get_lists AJAX action does not properly verify that the requesting user holds the plugin's manager capability. Because the required nonc...
EUVD-2026-64210
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...
CVE-2026-76057
The AutomatorWP – Automator WordPress plugin (no-code automations, webhooks & custom integrations) is vulnerable to authorization bypass in all versions up to and including 5.8.4 . The root cause is a missing authorization check on the automatorwp_convertkit_get_forms AJAX action: the required no...
CVE-2026-76057 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-75027
The Themify Builder plugin for WordPress (all versions up to and including 7.8.0 ) is vulnerable to authorization bypass via the tb_update_old_data AJAX action. The plugin fails to properly verify user authorization, and the required nonce is automatically emitted to all frontend pages rendered b...
EUVD-2026-64209
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-19883
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...
EUVD-2026-64207
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...