CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Nicht authentifizierte SQL-Injection Das Plugin versäumt es, die vom Benutzer bereitgestellten POST-Daten ordnungsgemäß zu bereinigen, bevor sie in einer dynamisch erstellten SQL-Abfrage verwendet werden, und zwar über die AJAX-Aktion...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2021-32789

CVE-2021-32789 Authentifizierte Blind-SQL-Injection. WordPress-WooCommerce-Plugin-Versionen = 2.5.0 Installation root@kitploit: git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Exploit root@kitploit: python3 exploit.py Enter URL:...

CVE-2020-36842

CVE-2020-36842 CVE-2020-36842 - Vulnerabilità di Upload Arbitrario di File del Plugin WPvivid Panoramica ID CVE: CVE-2020-36842 Data di divulgazione / aggiornamento: 16 ottobre 2024 Plugin interessato: WPvivid - Migration, Backup, Staging Versioni interessate: Fino alla versione 0.9.35 inclusa Ti...

CVE-2024-52375

WordPress Datasets Manager 💥 Exploit di: Nxploit Khaled Alenazi 📅 CVE Pubblicato: 14 Novembre 2024 🧠 Punteggio CVSS: 10.0 Critico 🛠 CWE-434: Caricamento senza restrizioni di file con tipo pericoloso 📌 Descrizione È stata scoperta una vulnerabilità critica nel plugin WordPress Datasets Manager by...

CVE-2025-1639

🔓 Script di Exploit per CVE-2025-1639 📝 Descrizione Il plugin Animation Addons for Elementor Pro per WordPress è vulnerabile all'installazione non autorizzata di plugin arbitrari a causa di un mancato controllo delle capability nella funzione installelementorpluginhandler in tutte le versioni fin...

CVE-2025-13486

Exploit di Massa CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Esecuzione Remota di Codice Non Autenticata in prepareform ⚠️ Dettagli della Vulnerabilità Il plugin Advanced Custom Fields: Extended per WordPress è vulnerabile all'Esecuzione Remota di Codice nelle versioni...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress (all versions up to and including 3.6.12 ) is vulnerable to Stored Cross-Site Scripting via the delay shortcode attribute. The root cause is insufficient input sanitization and output escaping, allowing authenticated attackers with Con...

EUVD-2026-64297

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-4559 Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-64298

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

EUVD-2026-64299

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561 MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.12.0 . The flaw resides in the form response message post meta fields (e.g., text_subscribed, text_error), caused by insufficient input sa...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-4244

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2025-26892

CVE-2025-26892 – WordPress Celestial Aura Theme = 2.2 Beliebiger Datei-Upload Authentifiziert 📄 Beschreibung Eine Schwachstelle mit uneingeschränktem Datei-Upload besteht im WordPress-Theme Celestial Aura entwickelt von dkszone bis Version 2.2. Ein authentifizierter Benutzer mit niedrigen...