CVE-2026-6089: Server-Side Request Forgery (SSRF)

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'stickysmedia' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the importsidebars function passing user-supplied URLs from imported JSON data to filegetcontents with...

CVE-2025-10656: Incorrect Authorization

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

CVE-2026-11974: Improper Limitation of a Pathname to a Restricted Directory

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-15344: Improper Neutralization of Special Elements used in an SQL Command

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

WordPress WP-Lister Lite for eBay plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Yousof Nahya, Hamza Nour, Yousof Nahya whoami03 in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.8...

EUVD-2026-49989

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion Detection

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't...

WP Cerber < 8.9.3 - Broken Access Control Detection

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. !/usr/bin/env python3 -- coding: utf-8 -- """WP Cerber 8."""...

WP Helper Lite < 4.3 - Cross-Site Scripting Detection

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The WP Helper Lite WordPress plugin, in versions 4.""" from kittysploit import fr...

BackupBuddy - Local File Inclusion Detection

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters. !/usr/bin/env python3 -- coding: utf-8 -- """BackupBuddy versions 8.""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection Detection

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. !/usr/bin/env python3 -- coding: utf-8 -- """The Steveas WP Live Chat...

WP Hotel Booking < 1.10.4 - PHP Object Injection Detection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. !/usr/bin/env python3 -- coding: utf-8 -- """The wp-hotel-booking plugin...

Yoast SEO 16.7-17.2 - Information Disclosure Detection

Yoast SEO plugin 16.7 to 17.2 is susceptible to information disclosure, The plugin discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints, which can help an attacker identify other vulnerabilities or help during the exploitation of other identified...

WordPress Pie Register < 3.7.2.4 - Open Redirect Detection

WordPress Pie Register 3.7.2.4 is susceptible to an open redirect vulnerability because the plugin passes unvalidated user input to the wpredirect function. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pie Register 3.""" import re from kittysploit import from lib.protocols.http.httpclie...

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting Detection

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter. !/usr/bin/env python3 --...

WordPress W3 Total Cache - Cache Files Exposure Detection

Detects publicly accessible W3 Total Cache database cache files in the wp-content/w3tc/dbcache/ directory. When database caching to disk is enabled, these files contain raw SQL query results, potentially exposing sensitive data such as user details, password hashes, emails, or other database...

Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

WordPress anti-plagiarism <=3.60 - Cross-Site Scripting Detection

WordPress anti-plagiarism 3.6.0 and prior are vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress anti-plagiarism 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection Detection

The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization Detection

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """LottieFiles...