Lucene search
+L

275106 matches found

Cvelist
Cvelist
added 2026/08/22 2:26 a.m.33 views

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

8.8CVSS0.00369EPSS
SaveExploits0References10
OSV
OSV
added 2026/08/22 2:26 a.m.9 views

CVE-2026-19883 WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

8.8CVSS5.8AI score
SaveExploits0References12
EUVD
EUVD
added 2026/08/22 2:26 a.m.10 views

EUVD-2026-64207

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematicoimportsettings function in all versions up to, and including, 2.8.24. This makes it possible for...

8.8CVSS5.7AI score0.00369EPSS
SaveExploits0References10
CVE
CVE
added 2026/08/22 2:26 a.m.31 views

CVE-2026-19883

The WPeMatico RSS Feed Fetcher WordPress plugin (all versions up to and including 2.8.24 ) is vulnerable to privilege escalation due to a missing capability check on the wpematico_import_settings function. An authenticated attacker with subscriber-level access or above can update arbitrary WordPr...

8.8CVSS5.7AI score0.00369EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.15 views

PT-2026-79504

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

4.3CVSS5.3AI score0.00254EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.17 views

PT-2026-79503

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...

5.3CVSS5.6AI score0.00342EPSS
SaveExploits0References13
Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.13 views

PT-2026-79510

Name of the Vulnerable Software and Affected Versions ManageWP Worker versions prior to 4.9.37 Description An authentication bypass exists because the plugin fails to bind the account being logged in to the signature that authorizes the login. Additionally, the system does not prevent the replay ...

8.1CVSS5.4AI score0.00271EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.16 views

PT-2026-79505

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...

4.3CVSS5.3AI score0.00233EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.17 views

PT-2026-79525

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add list function, which accepts user-controlled array keys from $ POST'addresses', passes...

9.8CVSS5.3AI score0.00572EPSS
SaveExploits0References12
Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.15 views

PT-2026-79589

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PH...

9.8CVSS6.2AI score0.00624EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/08/21 10:24 p.m.2 views

CVE-2025-2563

CVE-2025-2563 O plugin User Registration & Membership para WordPress anterior à versão 4.1.2 não impede que os usuários definam a função de suas contas quando o Membership Addon está habilitado, levando a um problema de escalonamento de privilégios e permitindo que usuários não autenticados...

8.1CVSS8.4AI score0.46384EPSS
SaveExploits7References1
Kitploit
Kitploit
added 2026/08/21 9:01 p.m.1 views

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — PoC di CVE-2026-64638 Proof of Concept educativa della catena XSS2Shell CVE-2026-64638, vulnerabilità pre-autenticazione XSS → RCE nel WordPress Core scoperta in modo autonomo da pwn.ai e divulgata il 7 agosto 2026. Indice dei contenuti 1. Sommario esecutivo 2. Avviso legale 3...

8.9CVSS8.1AI score0.31204EPSS
SaveExploits33
Patchstack
Patchstack
added 2026/08/21 8:58 p.m.7 views

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions 1.8.8...

9.3CVSS5.4AI score0.00347EPSS
SaveExploits0References8Affected Software1
Patchstack
Patchstack
added 2026/08/21 8:57 p.m.10 views

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions = 1.8.7...

9.3CVSS5.3AI score0.00409EPSS
SaveExploits0References7Affected Software1
Wordfence Blog
Wordfence Blog
added 2026/08/21 5:45 p.m.14 views

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 260 vulnerabilities disclosed in 200 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 142 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

7.4AI score
SaveExploits0
Wordfence Blog
Wordfence Blog
added 2026/08/21 3:50 p.m.10 views

100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin

On August 10th, 2026, we received a submission for an Unauthenticated Privilege Escalation vulnerability in Pods, a WordPress plugin with more than 100,000 active installations. This vulnerability allows unauthenticated attackers to escalate their privileges to administrator and perform various...

9.8CVSS6.6AI score0.02461EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/08/21 3:06 p.m.2 views

CVE-2024-4041

CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%22alertdocument.domain%22%20x%3D%22 3. Öffnen Sie in der Admin-Leiste das Yoast-Menü und fahren Sie mit der Maus über oder klicken Sie darauf...

6.1CVSS5.2AI score0.00832EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/21 2:48 p.m.1 views

megaquagga-pentest-report

megaquagga-pentest-report Black-Box-Penetrationstest — WordPress-Ausnutzung, Privilegieneskalation über CVE-2022-0847...

7.8CVSS7AI score0.89721EPSS
SaveExploits101
NVD
NVD
added 2026/08/21 12:16 p.m.15 views

CVE-2026-19848

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login an...

6.5CVSS0.00223EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/21 12:16 p.m.11 views

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway...

3.7CVSS0.00198EPSS
SaveExploits0References1
Rows per page
Query Builder