WordPress LiteSpeed Cache plugin <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin LiteSpeed Cache versions = 7.9.1...

WordPress NewsmanApp plugin <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin NewsmanApp versions = 3.7.29...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

WordPress Meta Box – A Framework for Dynamic Websites plugin <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions = 5.15.2...

Wp2shell-ioc-scanner

wp2shell IOC Scanner Version 1.4.0 · GPL-2.0-or-later · WordPress 6.0+ · PHP 7.4+ A read-only-by-default triage tool for the WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030 “wp2shell”. It checks patch state, accounts, durable database artifacts and file integrity, separates...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Improper Privilege Management | Unauthenticated registration with attacker-chosen staff role → patient PHI disclosure Overview Critical vulnerability in the KiviCare – Clinic & Patient Management System WordPress plugin versions...

CVE-2023-29384

CVE-2023-29384 CVE-2023-29384 Auto Exploiter on WordPress Job Board and Recruitment Plugin Vulnerability type: Arbitrary File Upload...

CVE-2026-15989

█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗ ██████╗ ██████╗ ████████╗ ██╔══██╗ ████╗ ██║ ╚══██╔══╝ ██║ ██╔══██╗ ██╔═████╗ ██╔═████╗ ╚══██╔══╝ ███████║ ██╔██╗ ██║ ██║ ██║ ██║ ██║ ██║██╔██║ ██║██╔██║ ██║ ██╔══██║ ██║╚██╗██║ ██║ ██║ ██║ ██║ ████╔╝██║ ████╔╝██║ ██║ ██║ ██║ ██║ ╚████║ ██║ ██║ ██████╔╝...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Auth Bypass PoC Proof-of-concept for CVE-2026-15013 : unauthenticated authentication bypass via SAML Signature Algorithm Confusion HMAC-SHA1 in the miniOrange SAML Single Sign On – SSO Login WordPress plugin versions up to and including 5.4.3. Authoriz...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms Unauthorized Form Publication Authenticated Contributor+ Authorization Bypass to Publish Any Draft Form in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-11991 CVSS Score| 6.2 — Medium CVSS Vector|...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

CVE-2019-17234b-Exploit

Wordpress IgniteUp plugin vulnerability Wordpress IgniteUp plugin v3.4 and below allows remote unauthenticated users to potentially arbitrarily delete any file on target webserver possibly causing a Denial of Service attack. CVE-2019-17234 timeline The vulnerability was reported to wordpress.org...

CVE-2026-19598-PoC

CVE-2026-19598-PoC Proof of Concept for CVE-2026-19598 affecting Pods ⚠️ Security Research / Authorized Testing Only This repository contains a Proof of Concept for CVE-2026-19598. Affected Software WordPress Pods = 3.3.9 Vulnerability Unauthenticated privilege escalation. PoC The PoC demonstrates...

CVE-2026-17089-PoC-pwnVader

CVE-2026-17089 — Events Manager = 7.4.0.1 — Unauthenticated reflected XSS headerformat Author: pwnVader · License: MIT repository root | ---|--- Component| Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin Type| CWE-79 — Reflected Cross-Site Scripting Affected| = 7.4.0.1...

CVE-2026-64638

CVE-2026-64638 // XSS2Shell Technical analysis and defensive mitigation matrix for the CVE-2026-64638 XSS2Shell vector, a critical parsing inconsistency in the WordPress Core authentication screen that makes it possible to chain a reflected pre-authentication Cross-Site Scripting XSS with browser...

WordPress Greenshift – animation and page builder blocks plugin <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Greenshift versions = 13.2.1...

WordPress Media Library Assistant plugin <= 3.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin NEX-Forms versions = 9.3.2...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC for CVE-2026-52715 Educational Proof of Concept for GeoLeak CVE-2026-52715, an unauthenticated SQL injection CVSS 9.3 in the GEO my WordPress = 4.5.5 plugin for WordPress. The swlatlng and nelatlng map boundary parameters are interpolated without sanitization into the WHERE clause...