CVE-2026-4885

CVE-2026-4885 Piotnet Addons for Elementor Pro = 7.1.70 - Caricamento File Arbitrario Non Autenticato → RCE Descrizione : Il plugin Piotnet Addons for Elementor Pro per WordPress è vulnerabile al caricamento arbitrario di file a causa della mancanza di validazione del tipo di file nella funzione...

CVE-2023-40000

CVE-2023-40000 Plugin LiteSpeed Cache para WordPress que pode permitir que usuários não autenticados escalem seus privilégios Como esse método de detecção funciona? Este template verifica o seguinte caminho: /wp-content/plugins/litespeed-cache/readme.txt Com base na Stable Tag listada, se a versã...

CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - SQL Injection non autenticata Descrizione Il plugin LTL Freight Quotes – R+L Carriers Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'editid' e 'dropshipeditid' in tutte le versioni fino alla 3.3.4 inclusa...

file-away-exploit

File-Away Exploit CVE-2025-2539 e CVE-2025-2512 📌 Scopo Questo repository contiene i dettagli delle vulnerabilità e gli script trovati per File-Away, un plugin WordPress utilizzato per la gestione dei file. Questo plugin presenta due vulnerabilità che possono portare all'esecuzione remota di codi...

Poleposph

Poleposph Werkzeuge zum Scannen von CVE-2024-25600 - WordPress Bricks Builder Remote-Codeausführung RCE...

CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Nicht authentifizierte SQL-Injection Das Plugin versäumt es, die vom Benutzer bereitgestellten POST-Daten ordnungsgemäß zu bereinigen, bevor sie in einer dynamisch erstellten SQL-Abfrage verwendet werden, und zwar über die AJAX-Aktion...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2021-32789

CVE-2021-32789 Authentifizierte Blind-SQL-Injection. WordPress-WooCommerce-Plugin-Versionen = 2.5.0 Installation root@kitploit: git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Exploit root@kitploit: python3 exploit.py Enter URL:...

CVE-2020-36842

CVE-2020-36842 CVE-2020-36842 - Vulnerabilità di Upload Arbitrario di File del Plugin WPvivid Panoramica ID CVE: CVE-2020-36842 Data di divulgazione / aggiornamento: 16 ottobre 2024 Plugin interessato: WPvivid - Migration, Backup, Staging Versioni interessate: Fino alla versione 0.9.35 inclusa Ti...

CVE-2024-52375

WordPress Datasets Manager 💥 Exploit di: Nxploit Khaled Alenazi 📅 CVE Pubblicato: 14 Novembre 2024 🧠 Punteggio CVSS: 10.0 Critico 🛠 CWE-434: Caricamento senza restrizioni di file con tipo pericoloso 📌 Descrizione È stata scoperta una vulnerabilità critica nel plugin WordPress Datasets Manager by...

CVE-2025-1639

🔓 Script di Exploit per CVE-2025-1639 📝 Descrizione Il plugin Animation Addons for Elementor Pro per WordPress è vulnerabile all'installazione non autorizzata di plugin arbitrari a causa di un mancato controllo delle capability nella funzione installelementorpluginhandler in tutte le versioni fin...

CVE-2025-13486

Exploit di Massa CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Esecuzione Remota di Codice Non Autenticata in prepareform ⚠️ Dettagli della Vulnerabilità Il plugin Advanced Custom Fields: Extended per WordPress è vulnerabile all'Esecuzione Remota di Codice nelle versioni...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress (all versions up to and including 3.6.12 ) is vulnerable to Stored Cross-Site Scripting via the delay shortcode attribute. The root cause is insufficient input sanitization and output escaping, allowing authenticated attackers with Con...

EUVD-2026-64297

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-4559 Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-64298

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

EUVD-2026-64299

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561 MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...