WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure

The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request id: CVE-2022-1595 info: name: WordPress HC Custom WP-Admin URL =1.5 to mitigate the vulnerability. reference: -...

exploit_cve-2021-29447

exploitcve-2021-29447 Только в образовательных целях. Этот эксплойт представляет собой очень удобный инструмент для получения любого файла с сервера, работающего на WordPress 5.6.2 и php8. см. https://wpscan.com/vulnerability/cbbe6c17-b24e-4be4-8937-c78472a138b5 Всё, что нужно, — это базовый дост...

CVE-2026-105062

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-105062 WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-105062

The Brandtoss WP Admin Audit plugin for WordPress (versions n/a through 1.2.17 ) is vulnerable to a Missing Authorization vulnerability (CWE-862). This issue allows for exploiting incorrectly configured access control security levels . The impact is categorized as Medium severity with a CVSS3.1 s...

EUVD-2026-92309

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin WP Admin Audit versions = 1.2.17...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-91906

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928 Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

CVE-2026-96270

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

EUVD-2026-91876

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-96270

The Ultimate Member plugin for WordPress (versions up to and including 2.13.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'form_id' parameter. The root cause is insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-101928: Improper Neutralization of Input During Web Page Generation

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-96270: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-102565

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91203

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-85235

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-85235

The Forminator Forms WordPress plugin (versions up to and including 1.57.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Rich-Text Textarea Field . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scr...