323236 matches found
EUVD-2026-112748
The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...
EUVD-2026-112747
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...
CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'postid' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records,...
EUVD-2026-112749
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-110184
The Newsmatic theme for WordPress is vulnerable to blind SQL Injection in all versions up to and including 1.5.0 . The flaw exists because of insufficient escaping on the user-supplied 'slug' parameter and a lack of sufficient preparation on the existing SQL query. This allows unauthenticated att...
CVE-2026-115821 NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billingfirstname, billinglastname' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-109216 Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profilebackground' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-96767 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-109216 Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profilebackground' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2026-112745
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-109216
The Meta Box WordPress plugin (versions up to and including 5.15.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the profile_background[] parameter. This allows authenticated attackers with Subscriber-level acce...
CVE-2026-96767
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.3.2 . The root cause is insufficient input sanitization and output escaping related to the 'type' parameter . This flaw allows unauthenticated attackers to ...
EUVD-2026-112746
The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profilebackground' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2016-10033
PoC for CVE-2016-10033 RCE against WordPress 4.6 usage: ./CVE-2016-10033.py example: ./CVE-2016-10033.py http://site.com/ 1.2.3.4:4444 admin Python port +alterations of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html Required: Requests pip install requests I...
CVE-2026-114193
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...
CVE-2024-7856
CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★ Description CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p Example python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u...
CVE-2026-114193 WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...
CVE-2026-114193
The GEO my WordPress (geo-my-wp) plugin, developed by Eyal Fitoussi, is vulnerable to a Missing Authorization flaw (CWE-862) in versions up to 4.5.5.5 . This vulnerability allows for the exploitation of incorrectly configured access control security levels . According to the provided metrics, the...
EUVD-2026-112732
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...