418 matches found
wpDiscuz <= 5.3.5 - SQL Injection
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. id: CVE-2020-13640 info: name: wpDiscuz = 5.3.5 - SQL Injection author: Sourabh-Sahu severity:...
CVE-2020-24186-wpDiscuz-7.0.4-RCE
POC CVE-2020-24186-wpDiscuz-7.0.4-RCE WordPress wpDiscuz 7.0.4 Remote Code Execution A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the...
CVE-2020-24186_reverse_shell_upload
CVE-2020-24186 reverse shell upload Exploit for WpDiscuz 7.0.4 based on the the exploit written by h3v0x. Exploits the vulnerability and uploads a reverse PHP shell. Inspiration was the Blogger CTF. exploit.py -u http://192.168.1.81/blog -p /wordpress/2021/06/blogpost -l '192.168.1.9' -s 9001...
WordPress wpDiscuz <=7.0.4 - Remote Code Execution
WordPress wpDiscuz plugin versions version 7.0 through 7.0.4 are susceptible to remote code execution. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site's server. id: CVE-2020-24186 info: nam...
Exploit for Unrestricted Upload of File with Dangerous Type in Gvectors Wpdiscuz
wpDiscuz ≤ 7.0.4 - Unauthenticated Arbitrary File Upload to RC...
CVE-2026-119366
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73...
EUVD-2026-116777
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73...
CVE-2026-119366
The AdvancedCoding wpDiscuz WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions up to and including 7.6.73 . Exploitation allows an attacker to inject malicious scripts that are...
CVE-2026-119366 WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73...
WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin wpDiscuz versions = 7.6.73...
CVE-2026-111318
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
CVE-2026-111318
The HT Mega Addons for Elementor WordPress plugin (versions <= 3.2.7 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the href attribute of tags within the .htmega-tab-nav parameter of the Tabs widget . U...
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
PT-2026-130682
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
WordPress Comments plugin < 7.6.66 - Unauthenticated Comment Disclosure vulnerability
Unauthenticated Comment Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin wpDiscuz versions 7.6.66...
CVE-2026-19704
The wpDiscuz (Comments) WordPress plugin versions prior to 7.6.66 is vulnerable to an unauthenticated SQL injection due to improper validation of a value used in a database query. An attacker can exploit this to read unauthorized comments, including those awaiting moderation, marked as spam, tras...
CVE-2026-19704 Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...
CVE-2026-19704 Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...
WordPress wpDiscuz plugin < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion vulnerability
Unauthenticated Stored XSS via Image URL Conversion vulnerability discovered by hieus in WordPress Plugin wpDiscuz versions 7.6.60...