EUVD-2026-64251

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

CVE-2026-4245

The Post Duplicator WordPress plugin (all versions up to and including 3.0.11 ) is vulnerable to an authorization bypass in its REST API. The duplicate_post_permissions() callback only verifies the duplicate_posts capability without checking whether the user holds publish_posts or other status-ga...

CVE-2026-4245 Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

CVE-2026-3424

The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.4.10.3 . The root cause is improper validation of the payload parameter before passing it to do_shortcode, allowing an...

EUVD-2026-64250

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

CVE-2025-14156

CVE-2025-14156 Fox LMS – Plugin WordPress LMS 1.0.4.7 - 1.0.5.1 - Escalation di privilegi non autenticata tramite 'createOrder' ⚠️ CVE-2025-14156 – Exploit di escalation di privilegi non autenticata per Fox LMS WordPress 🛡️ Panoramica della vulnerabilità Fox LMS – Plugin WordPress LMS v1.0.4.7 a...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Erforderliche Argumente: -u, --url Ziel-URL der WordPress-Site z. B. http://127.0.0.1/wordpress -e, --email E-Mail-Adresse für das neue Administratorkonto Optionale Argumente: -f, --fname Vorname Standard: Pwn -l, --lname Nachname Standard: Admin -r, --role...

CVE-2025-12674

CVE-2025-12674 KiotViet Sync = 1.8.5 - Caricamento Arbitrario di File Non Autenticato 🐚 KiotViet Sync = 1.8.5 - Caricamento Arbitrario di File Non Autenticato 📝 Descrizione Il plugin KiotViet Sync per WordPress versioni fino a 1.8.5 incluse è vulnerabile al caricamento arbitrario di file, a causa...

CVE-2024-34568

Exploit-Titel: LetterPress = 1.2.1 - Cookie-Diebstahl-Schwachstelle Exploit-Autor: SANU P.L CVE: CVE-2024-34568 CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L Referenzen: https://nvd.nist.gov/vuln/detail/CVE-2024-34568...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Caricamento File Non Autenticato RCE Discrepanza tra isimage e extractfileextension → Caricamento Polyglot PHP Panoramica CVE-2026-13001 è una vulnerabilità critica CVSS 9.8 di caricamento arbitrario di file non autenticato nel plugin WordPress Podlove...

wp2shell-compromise-scanner-plugin

wp2shell के लिए कॉम्प्रोमाइज़ स्कैनर केवल-पठन एक स्वतंत्र, केवल-पठन WordPress प्लगइन जो आपके डेटाबेस और प्लगइन निर्देशिका को इस बात के संकेतों के लिए स्कैन करता है कि wp2shell कोर श्रृंखला CVE-2026-63030 + CVE-2026-60137 का शोषण किया गया था — भले ही यह हफ्तों पहले हुआ हो या हमलावर ने सफाई कर दी ह...

CVE-2026-78003

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

wp2shell-lab

mini-wp-rest Una reimplementazione compatta e senza dipendenze di una piccola parte dell'API REST di WordPress — sufficiente per servire una raccolta pubblica di post ed eseguire più sotto-richieste in un'unica chiamata. Utile per insegnare come il routing di WordPress, WPQuery e $wpdb si combina...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

EUVD-2026-64242

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-78003

The Mailgun for WordPress plugin (versions up to and including 2.2.0 ) is vulnerable to Server-Side Request Forgery (SSRF) via path traversal. The root cause is insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and passes t...

CVE-2026-77002

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators...

CVE-2026-77000

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's ema...

CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-76789

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...