PT-2026-104546

Name of the Vulnerable Software and Affected Versions Mail logging – WP Mail Catcher versions prior to 2.1.13 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs via the PHPMailer wp mail failed...

PT-2026-104549

Name of the Vulnerable Software and Affected Versions WP Visitor Statistics Real Time Traffic versions prior to 8.8 Description An unauthenticated attacker can perform a second-order SQL injection by submitting a crafted referrer URL to the 'wmcTrack' tracking endpoint. The application fails to...

PT-2026-104538

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.4 Description Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...

PT-2026-104504

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.187 Description Insufficient escaping and a lack of numeric validation on coordinate values when saving a listing allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection...

CVE-2026-101159: Improper Neutralization of Input During Web Page Generation

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators,...

PT-2026-104501

Name of the Vulnerable Software and Affected Versions Magic Tooltips For Contact Form 7 versions prior to 1.0.35 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that...

CVE-2026-101928: Improper Neutralization of Input During Web Page Generation

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2026-104520

Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 4.1.0 Description The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during it...

PT-2026-104547

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar versions prior to 3.5.2 Description Reflected Cross-Site Scripting occurs when the write debug logs debug-log output path reflects the raw value of the $ SERVER'REQUEST URI' variable through the vprintf function within...

CVE-2026-18464

CVE-2026-18464 — WP Maps Pro このリポジトリは、すでに開示された脆弱性に関する技術リファレンスとして提供されています。武器化されたサービス拒否スクリプトは含まれていません。 概要 項目| 詳細 ---|--- CVE| CVE-2026-18464 製品| WP MAPS PRO 影響を受けるバージョン| 6.1.3 修正バージョン| 6.1.3 脆弱性の種類| CWE-400 — 制御されていないリソース消費 攻撃要件| 未認証のリモート攻撃者 深刻度| 7.5 CVSS 3.1 公開日| 2026-08-09 発見者| Mohammad Aghdasi C...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - 未認証の格納型クロスサイトスクリプティング プラグインURL https://wordpress.org/plugins/wp-stats/ 説明 statspage の statsauthor GET パラメータにおける未認証の反射型XSS。サニタイズフィルタ striptags が urldecode より前に適用されるため、攻撃者はペイロードを二重URLエンコードすることでこれをバイパスできる。 POC 1. WP-Stats プラグインをインストールして有効化する 2. pagestats...

CVE-2023-22622

DoS WP-Cron - CVE-2023-22622 エクスプロイト PoC 概要 このリポジトリには、WordPress の CVE-2023-22622 脆弱性を悪用し、WP-Cron を介してサービス拒否 DoS を引き起こすスクリプトが含まれています。このスクリプトを使用して、脆弱な WordPress サイトに大量のリクエストを送信し、サーバー過負荷を引き起こす可能性があります。 エクスプロイトの詳細 エクスプロイトタイトル: DoS WP-Cron - CVE-2023-22622 日付: 07/29/2024 エクスプロイト作成者: Michael Fry...

CVE-2022-2546

All-in-One WP Migration 影響を受けるバージョン All-in-One WP Migration 7.63 参考文献 Sucuri WPScan Hacking Force クロスサイトスクリプティング XSS 分類 タイプ: クロスサイトスクリプティング OWASP TOP 10: A03:2021-Injection CWE: CWE-79 ウェブページ生成中の入力の不適切な無効化 'クロスサイトスクリプティング' 研究者/ハッカー Geovanni Campos GeoZIN, Thiago Martins Kirito, Jorge Buzeti R3tr0...

CVE-2015-4133

CVE-2015-4133 usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH wp-content/uploads sub...

CVE-2026-5415

CVE-2026-5415 CVE-2026-5415 WP Captcha PRO 認証済み認証バイパスエクスプロイト...

CVE-2026-49085

CVE-2026-49085 CVE-2026-49085 WP Insightly PHPオブジェクトインジェクションエクスプロイト...

WordPress Wp Social Login and Register Social Counter plugin <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin Wp Social versions = 3.2.1...

WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.7 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin WP Visitor Statistics Real Time Traffic versions = 8.7...

WordPress WP Ultimate Review plugin <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by walid213 in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress 事前認証反映型XSS → リモートコード実行チェーン DOM Clobbering + アプリケーションパスワード窃取 + REST API プラグイン有効化 = 完全なRCE ⚡ 概要 CVE-2026-64638 は、WordPress の wp-login.php における重大な事前認証型反映XSS です。この脆弱性は、ログインエラーメッセージが送信されたユーザー名を適切なHTMLエンコードなしで 反映するために存在し、 によるDOM Clobberingを可能にして、ほとんどのフィルタを回避します。...