WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ssophiz in WordPress Plugin Custom Price for WooCommerce versions = 1.1.29...

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Kit formerly ConvertKit versions = 3.4.7...

WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nizar yart D3dC0d in WordPress Plugin Strong Testimonials versions = 3.3.15...

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Profile Builder versions = 4.0.5...

CVE-2026-1357

CVE-2026-1357 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip...

CVE-2026-25450

The ThemeGrill User Registration WordPress plugin (versions

CVE-2026-87902

CVE-2026-87902 — PoC: unauthenticated path traversal in WordPress page-template resolution Exploit file: exploitlocatetemplaterce.py — Python 3.6+ stdlib only. Single-command pipeline: safe detection LFI differential, no writes →, if vulnerable, RCE via the pearcmd.php gadget executing the comman...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by elba.code in WordPress Plugin User Registration versions = 5.3.0...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...

WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin StreamCast versions = 2.4.6...

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.6...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Je22y in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Luke Schneider in WordPress Plugin SureForms versions = 2.12.9...

wordpress_DoS

WordPress 4.9.8 is vulnerable to DoS Attacks. Additional Information We found a Denial of Service DoS in WordPress version 4.9.8. An unauthenticated remote user can perform a series of requests on the vulnerable pages, resulting in increased processing, swap and disk I/O on the server. This...

CVE-2026-3228

CVE-2026-3228 - NextScripts WordPress Plugin Stored XSS Scanner & Exploit https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/WordPress-Plugin-red Author: NULL200OK A comprehensive Python tool to scan for and exploit...