24603 matches found
CVE-2026-14982 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
CVE-2026-82223: Missing Authorization
Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...
CVE-2026-81283: Deserialization of Untrusted Data
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
PT-2026-84694
Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...
PT-2026-84700
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
PT-2026-84683
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2025-8945: Incorrect Authorization
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...
CVE-2026-14982: Improper Limitation of a Pathname to a Restricted Directory
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
CVE-2026-84780: Allocation of Resources Without Limits or Throttling
Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...
PT-2026-84715
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...
CVE-2026-84770: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...
PT-2026-84592
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
PT-2026-84704
Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...
CVE-2026-83533: Insufficient Verification of Data Authenticity
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
PT-2026-84751
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
WordPressMassExploiter
WordPressMassExploiter Mass exploiter of CVE-2015-1579 for WordPress CMS This mass exploiter is based on CVE-2015-1579, discovered by CLAUDIO VIVIANI https://www.exploit-db.com/exploits/36554/ How it works: 1 - I use Selenium Framework to make the search on google. 2 - The results of search, are...
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL...
WordPress WP File Download plugin <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter vulnerability
Authenticated Subscriber+ Arbitrary File Deletion via 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.4...
CVE-2026-7877
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2026-7877 WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...