324217 matches found
CVE-2026-96767 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-109216 Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profilebackground' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-109216
The Meta Box WordPress plugin (versions up to and including 5.15.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the profile_background[] parameter. This allows authenticated attackers with Subscriber-level acce...
CVE-2016-10033
PoC for CVE-2016-10033 RCE against WordPress 4.6 usage: ./CVE-2016-10033.py example: ./CVE-2016-10033.py http://site.com/ 1.2.3.4:4444 admin Python port +alterations of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html Required: Requests pip install requests I...
CVE-2026-114193
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...
CVE-2024-7856
CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★ Description CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p Example python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u...
CVE-2026-114193 WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...
CVE-2026-114193
The GEO my WordPress (geo-my-wp) plugin, developed by Eyal Fitoussi, is vulnerable to a Missing Authorization flaw (CWE-862) in versions up to 4.5.5.5 . This vulnerability allows for the exploitation of incorrectly configured access control security levels . According to the provided metrics, the...
CVE-2026-114193 WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...
EUVD-2026-112732
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5...
CVE-2026-115963 WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9...
CVE-2026-115963 WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9...
CVE-2026-115963
The VideoWhisper.com Broadcast Live Video (videowhisper-live-streaming-integration) WordPress plugin is affected by a Missing Authorization vulnerability (CWE-862). This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels in versions from n/a through 7.3.9 . The vulne...
WordPress All-In-One Security (AIOS) plugin < 5.5.0 - Subscriber+ 2FA Bypass vulnerability
Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin All In One WP Security & Firewall versions 5.5.0...
CVE-2026-91153
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
CVE-2026-91152
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evftoasttype' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping...
CVE-2026-116763
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-118192
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'teamid' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-107627
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-104727
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...