tag

Wordpress

wp2shell — WordPress Core Pre-Auth SQLi → Row Forgery → Admin Creation → RCE (CVE-2026-63030 + CVE-2026-60137)

CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf· WordPress core (REST API /batch/v1, WP_Query::author__not_in) patched

WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload RCE (CVE-2025-11170)

CVE-2025-11170· WP移行専用プラグイン for CPI (cpi-wp-migration, a CPI/site-migration import plugin for WordPress) unpatched

WP Directory Kit Auto-Login Authentication Bypass to Full Site Takeover (CVE-2025-13390)

CVE-2025-13390· WP Directory Kit (WordPress plugin) unpatched

WordPress WPAMS Plugin Arbitrary File Upload to RCE (CVE-2025-39401)

CVE-2025-39401· WPAMS (WordPress Apartment/Property Management System) plugin by mojoomla unpatched

WordPress Simple Link Directory Unauthenticated Password Reset to Admin Takeover (CVE-2025-49901)

CVE-2025-49901· WordPress "Simple Link Directory" plugin (qc-simple-link-directory by quantumcloud) patched

WordPress Service Finder Bookings ≤ 6.0 Authentication Bypass via `original_user_id` Cookie (CVE-2025-5947)

CVE-2025-5947· WordPress plugin "Service Finder Bookings" (sf-booking) unpatched

WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860)

CVE-2025-68860· WordPress "Mobile Builder" plugin unpatched

WooCommerce Dynamic Pricing & Discounts (WC Designer Pro) Unauthenticated File Upload RCE (CVE-2025-6440)

CVE-2025-6440· WordPress WooCommerce Dynamic Pricing & Discounts plugin (wc-designer-pro) unpatched

Webkul Medical Prescription Attachment for WooCommerce — Unrestricted File Upload to Web Shell (CVE-2025-29009)

CVE-2025-29009· Webkul "Medical Prescription Attachment Plugin for WooCommerce" (WordPress plugin) patched

WavePlayer Unauthenticated Arbitrary File Upload to RCE (CVE-2025-12057)

CVE-2025-12057· WavePlayer (WordPress plugin) unpatched

TNC Toolbox: Web Performance Unauthenticated cPanel Credential Exposure (CVE-2025-12539)

CVE-2025-12539· TNC Toolbox: Web Performance (WordPress plugin) unpatched

StoryChief WordPress Plugin Unauthenticated Arbitrary File Upload via Webhook (CVE-2025-7441)

CVE-2025-7441· StoryChief WordPress plugin unpatched

StoreKeeper for WooCommerce Unauthenticated Arbitrary File Upload (CVE-2025-48148)

CVE-2025-48148· StoreKeeper for WooCommerce (WordPress plugin) unpatched

Sneeit Framework <= 8.3 Unauthenticated RCE via `call_user_func()` — Rogue Admin Creation (CVE-2025-6389)

CVE-2025-6389· Sneeit Framework (WordPress theme framework plugin, sneeit-framework) unpatched

Simple User Registration WordPress Plugin — Unauthenticated Privilege Escalation (CVE-2025-4334)

CVE-2025-4334· "Simple User Registration" WordPress plugin (registration/form-builder plugin, wpr_submit_form AJAX action) unpatched

Simple Business Directory Pro Unauthenticated Password Reset to Admin Takeover (CVE-2025-53580)

CVE-2025-53580· quantumcloud "Simple Business Directory Pro" WordPress plugin (simple-business-directory-pro) patched

RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)

CVE-2025-9209· RestroPress – Online Food Ordering System (WordPress plugin) unpatched

Real Spaces WordPress Theme Unauthenticated Privilege Escalation via `imic_agent_register` (CVE-2025-6758)

CVE-2025-6758· Real Spaces - Properties Directory Theme for WordPress (imic_agent_register AJAX handler) unpatched

PPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)

CVE-2025-11391· PPOM for WooCommerce (woocommerce-product-addon plugin) patched

Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload RCE (CVE-2025-10147)

CVE-2025-10147· Podlove Podcast Publisher (WordPress plugin) unpatched

Opal Estate Pro WordPress Plugin Unauthenticated Administrator Registration (CVE-2025-6934)

CVE-2025-6934· Opal Estate Pro (WordPress real-estate plugin) unpatched

Kubio AI Page Builder <= 2.5.1 Unauthenticated Local File Inclusion (CVE-2025-2294)

CVE-2025-2294· Kubio AI Page Builder (WordPress plugin) unpatched

KiotViet Sync Unauthenticated Arbitrary File Upload (CVE-2025-12674)

CVE-2025-12674· KiotViet Sync (WordPress plugin) unpatched

JAY Login & Register "Switch Back" Cookie Authentication Bypass (CVE-2025-14440)

CVE-2025-14440· JAY Login & Register (WordPress plugin) unpatched

GiveWP Unauthenticated PHP Object Injection via Weak Serialized-Data Regex Check (CVE-2025-22777)

CVE-2025-22777· GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin, 100,000+ active installs) patched

Frontend Admin by DynamiApps — Unauthenticated Administrator Account Creation (CVE-2025-13342)

CVE-2025-13342· Frontend Admin by DynamiApps (WordPress plugin built on Advanced Custom Fields / ACF frontend forms) patched

Fox LMS `createOrder` Unauthenticated Privilege Escalation to Administrator (CVE-2025-14156)

CVE-2025-14156· Fox LMS (WordPress LMS plugin) unpatched

Flozen WordPress Theme Unauthenticated Arbitrary File Upload (CVE-2025-49071)

CVE-2025-49071· Flozen Theme for WordPress unpatched

Cibeles AI `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13595)

CVE-2025-13595· Cibeles AI (WordPress plugin) unpatched

AI Feeds `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13597)

CVE-2025-13597· AI Feeds (WordPress plugin) unpatched

AI Engine WordPress Plugin Unauthenticated MCP Token Disclosure to Admin Account Creation (CVE-2025-11749)

CVE-2025-11749· AI Engine plugin for WordPress (mwai) unpatched

ACF Extended (ACFE) `prepare_form()` Unauthenticated RCE via Privilege Escalation (CVE-2025-13486)

CVE-2025-13486· Advanced Custom Fields: Extended (ACFE) — WordPress plugin unpatched

YayMail WooCommerce Plugin Missing Authorization to Privilege Escalation — CVE-2026-1937

CVE-2026-1937· YayMail – WooCommerce Email Customizer plugin for WordPress unpatched

WPvivid Backup & Migration Unauthenticated Arbitrary File Upload RCE (CVE-2026-1357)

CVE-2026-1357· WPvivid Backup & Migration WordPress plugin unpatched

WP Zendesk for Contact Form 7 Unauthenticated PHP Object Injection (CVE-2026-49105)

CVE-2026-49105· WP Zendesk for Contact Form 7 plugin for WordPress, cf7-zendesk.php unpatched

WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791)

CVE-2026-40791· WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin) patched

WP Photo Album Plus Unauthenticated SQL Injection — CVE-2026-6379

CVE-2026-6379· WordPress plugin "WP Photo Album Plus" (WPPA+) by opajaap patched

WP Insightly Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49085)

CVE-2026-49085· WP Insightly (Contact Form 7 to Insightly CRM integration) plugin for WordPress, cf7-insightly.php unpatched

WP Captcha PRO Subscriber-to-Administrator Authentication Bypass — CVE-2026-5415

CVE-2026-5415· WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA) unpatched

WP Activity Log Unauthenticated PHP Object Injection — CVE-2026-54806

CVE-2026-54806· WP Activity Log (plugin slug: wp-security-audit-log) by Melapress, for WordPress patched

WordPress User Language Switch Plugin SSRF — CVE-2026-0745

CVE-2026-0745 (GHSA-m38c-5p3m-p7gm)· WordPress "User Language Switch" plugin unpatched

WordPress SignUp/SignIn & Invoice Generator Password-Reset Account Takeover (CVE-2026-12416 / CVE-2026-12417)

CVE-2026-12416, CVE-2026-12417· SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416) unpatched

WordPress Ninja Forms Plugin Unauthenticated File Upload — CVE-2026-0740

CVE-2026-0740· WordPress "Ninja Forms" plugin — file upload field/module unpatched

WordPress HT Mega (Absolute Addons for Elementor) Unauthenticated PII Disclosure (CVE-2026-4106)

CVE-2026-4106· HT Mega – Absolute Addons for Elementor (WordPress plugin) unpatched

WordPress Download Manager 3.3.5.2 — Unauthenticated IDOR (CVE-2026-39676)

CVE-2026-39676· Download Manager plugin for WordPress unpatched

WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180

CVE-2026-3180· WordPress "Contest Gallery" plugin unpatched

WordPress Breeze Cache Plugin — Unauthenticated Arbitrary File Upload (CVE-2026-3844)

CVE-2026-3844· Breeze Cache plugin for WordPress unpatched

WordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594)

CVE-2026-0594· "List Site Contributors" WordPress plugin unpatched

WordPress "Import and Export Users and Customers" Plugin Privilege Escalation (CVE-2026-3629)

CVE-2026-3629· Import and Export Users and Customers (WordPress plugin) unpatched

WordPress "Form Maker" Plugin Unauthenticated SQL Injection — CVE-2026-3359

CVE-2026-3359· WordPress "Form Maker" plugin by Web10 unpatched

WordPress "Drag and Drop File Upload for Contact Form 7" Unauthenticated RCE — CVE-2026-5364

CVE-2026-5364· WordPress plugin "Drag and Drop File Upload for Contact Form 7" (drag-and-drop-file-upload-for-contact-form-7) unpatched

WooCommerce Wholesale Lead Capture — Unauthenticated Privilege Escalation & File Upload RCE (CVE-2026-27542 / CVE-2026-27540)

CVE-2026-27542 (bundled with CVE-2026-27540)· WooCommerce Wholesale Lead Capture (WWLC) plugin for WordPress unpatched

WooCommerce Frontend Registration Form Unauthenticated Admin Role Assignment — CVE-2026-54807

CVE-2026-54807· WordPress plugin exposing a custom WooCommerce-style frontend registration form (form fields prefixed tgwcfb_*) unpatched

WebStack WordPress Theme Unauthenticated Arbitrary File Upload RCE — CVE-2026-1555

CVE-2026-1555· WebStack theme for WordPress unpatched

User Registration Advanced Fields WordPress Plugin Unauthenticated Arbitrary File Upload (CVE-2026-4882)

CVE-2026-4882· User Registration Advanced Fields plugin for WordPress unpatched

User Registration & Membership Unauthenticated Admin Privilege Escalation (CVE-2026-1492)

CVE-2026-1492· User Registration & Membership WordPress plugin (Custom Registration Form Builder, Login Form, User Profile, Content Restriction & Membership) unpatched

User Registration & Membership for WordPress — Unauthenticated Admin Approval Bypass (CVE-2026-6145)

CVE-2026-6145· User Registration & Membership for WordPress plugin unpatched

UpdraftPlus WordPress Plugin — Unauthenticated RPC Key Bypass to Admin Creation & RCE (CVE-2026-10795)

CVE-2026-10795· UpdraftPlus (WordPress backup plugin) — UpdraftCentral remote RPC feature unpatched

The Events Calendar WordPress Plugin Unauthenticated Blind SQL Injection (CVE-2026-49772)

CVE-2026-49772· The Events Calendar (WordPress plugin, StellarWP / Liquid Web), experimental tec/v1 REST API patched

Spectra Gutenberg Blocks Authenticated Remote Code Execution — CVE-2026-7465

CVE-2026-7465· Spectra (Gutenberg blocks plugin for WordPress, uagb/ block namespace) unpatched

Snow Monkey Forms — Unauthenticated Arbitrary File Deletion via Path Traversal (CVE-2026-1056)

CVE-2026-1056· Snow Monkey Forms (WordPress plugin) unpatched

Simple History Missing Authorization Account Takeover — CVE-2026-7459

CVE-2026-7459· Simple History (WordPress plugin) unpatched

Simple File List Plugin Unauthenticated File Modification / Path Traversal — CVE-2026-11912

CVE-2026-11912· Simple File List WordPress plugin patched

Schema & Structured Data for WP & AMP Unauthenticated Unrestricted File Upload (CVE-2026-9067)

CVE-2026-9067· Schema & Structured Data for WP & AMP (WordPress plugin, schema-and-structured-data-for-wp) unpatched

Prodigy Commerce WordPress Plugin — Unauthenticated Local File Inclusion (CVE-2026-0926)

CVE-2026-0926· Prodigy Commerce (WordPress plugin) unpatched

Piotnet Addons for Elementor Pro Unauthenticated Arbitrary File Upload RCE (CVE-2026-4885)

CVE-2026-4885· Piotnet Addons for Elementor Pro (WordPress plugin) unpatched

Perfmatters WordPress Plugin Arbitrary File Deletion (CVE-2026-4350)

CVE-2026-4350· Perfmatters WordPress plugin unpatched

NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)

CVE-2026-3228· NextScripts: Social Networks Auto-Poster (WordPress plugin) unpatched

midi-Synth WordPress Plugin Arbitrary File Upload (CVE-2026-1306)

CVE-2026-1306· midi-Synth WordPress plugin unpatched

Masteriyo LMS Authenticated Privilege Escalation to Administrator (CVE-2026-4484)

CVE-2026-4484· Masteriyo LMS plugin for WordPress unpatched

LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083)

CVE-2026-49083· LatePoint Calendar Booking plugin for WordPress unpatched

LatePoint Calendar Booking Plugin Agent-to-Administrator Privilege Escalation — CVE-2026-6741

CVE-2026-6741· LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin, slug latepoint) patched

LA-Studio Element Kit for Elementor — Unauthenticated Admin Account Creation (CVE-2026-0920)

CVE-2026-0920· LA-Studio Element Kit for Elementor (WordPress plugin, slug lakit) unpatched

Kirki WordPress Plugin Password-Reset Hijack Leading to Account Takeover (CVE-2026-8206)

CVE-2026-8206· Kirki (WordPress Customizer framework plugin) — CompLibFormHandler REST API endpoint unpatched

JetSearch WordPress Plugin Unauthenticated SQL Injection (CVE-2026-49079)

CVE-2026-49079· JetSearch plugin for WordPress unpatched

Integration for Keap/Infusionsoft Contact Form Plugin Unauthenticated PHP Object Injection (CVE-2026-49104)

CVE-2026-49104· Integration for Keap/Infusionsoft (Contact Form 7 to Keap/Infusionsoft CRM integration) plugin for WordPress, cf7-infusionsoft.php unpatched

Integration for ActiveCampaign Unauthenticated PHP Object Injection via Unsafe Deserialization (CVE-2026-9691)

CVE-2026-9691· "Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms" WordPress plugin unpatched

Hustle (WordPress Popup) Authenticated Arbitrary File Upload via Module Import (CVE-2026-0911)

CVE-2026-0911· Hustle (wordpress-popup) plugin by WPMU DEV unpatched

Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)

CVE-2026-10580· Hippoo Mobile App for WooCommerce (WordPress plugin) unpatched

Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406)

CVE-2026-4406· Gravity Forms (WordPress plugin) by Rocketgenius, Inc. patched

Gravity Forms Path Traversal → Arbitrary File Deletion (CVE-2026-48866)

CVE-2026-48866· Gravity Forms plugin for WordPress patched

Friendly Functions for Welcart WordPress Plugin CSRF (CVE-2026-1208)

CVE-2026-1208· Friendly Functions for Welcart (WordPress plugin) patched

Form Notify WordPress Plugin — LINE OAuth Authentication Bypass to Account Takeover (CVE-2026-5229)

CVE-2026-5229· Form Notify WordPress plugin, LINE Login OAuth 2.0 integration (src/APIs/Line/Login/Route.php, User.php) patched

Everest Forms Unauthenticated PHP Object Injection to RCE (CVE-2026-3296)

CVE-2026-3296· Everest Forms (WordPress plugin — Contact Form, Payment Form, Quiz, Survey & Custom Form Builder) patched

Everest Forms Pro Unauthenticated PHP Code Injection via Calculation Addon (CVE-2026-3300)

CVE-2026-3300· Everest Forms Pro (WordPress plugin) — Calculation Addon unpatched

EventPrime WordPress Plugin Unauthenticated Arbitrary File Upload — CVE-2026-1657

CVE-2026-1657· EventPrime (WordPress plugin) patched

Eventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776)

CVE-2026-40776 / Patchstack PSID 85de025d71e7· Eventin — Events Calendar, Event Booking, Ticket & Registration (wp-event-solution WordPress plugin) patched

ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)

CVE-2026-2600· ElementsKit Elementor Addons (WordPress plugin) patched

Easy Elements for Elementor Unauthenticated Privilege Escalation via `custom_meta` Overwrite (CVE-2026-9018)

CVE-2026-9018· Easy Elements for Elementor – Addons & Website Templates (easy-elements WordPress plugin) patched

Divi Form Builder <= 5.1.2 Unauthenticated Privilege Escalation via Role Injection (CVE-2026-5118)

CVE-2026-5118· Divi Form Builder (WordPress plugin) unpatched

Contact Form by Supsystic <= 1.7.36 Unauthenticated SSTI to RCE (CVE-2026-4257)

CVE-2026-4257· Contact Form by Supsystic (WordPress plugin) unpatched

Business Directory Plugin for WordPress — Unauthenticated Time-Based Blind SQL Injection (CVE-2026-2576)

CVE-2026-2576· Business Directory Plugin (Easy Listing Directories) for WordPress patched

Burst Statistics WordPress Plugin Authentication Bypass to Admin Account Takeover (CVE-2026-8181)

CVE-2026-8181· Burst Statistics – Privacy-Friendly WordPress Analytics (burst-statistics plugin) patched

Branda White Label & Branding Plugin Unauthenticated Account Takeover — CVE-2026-11551

CVE-2026-11551· Branda White Label & Branding WordPress plugin patched

Bookly Booking Form Cookie-Based Stored XSS — CVE-2026-5513

CVE-2026-5513· Bookly — Online Scheduling and Appointment Booking System (WordPress plugin) patched

BookingPress Pro Unauthenticated Arbitrary File Upload via Data URI Signature Field (CVE-2026-6960)

CVE-2026-6960· BookingPress Pro (WordPress appointment-booking plugin) unpatched

BetterDocs Pro Unauthenticated Local File Inclusion to RCE — CVE-2026-7515

CVE-2026-7515· BetterDocs Pro (WordPress plugin) unpatched

Avada Builder Unauthenticated RCE via call_user_func() Allowlist Bypass (CVE-2026-6279)

CVE-2026-6279· Avada Builder (Fusion Builder) WordPress theme/plugin unpatched

ARMember WordPress Plugin Insecure Password Reset via Plaintext Key + SQLi Chain (CVE-2026-5076)

CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074)· ARMember – Membership Plugin & Content Restriction (WordPress plugin) patched

Advanced Custom Fields: Extended Unauthenticated Privilege Escalation via `_acf_post_id` Validation Bypass (CVE-2026-8809)

CVE-2026-8809· Advanced Custom Fields: Extended (ACF Extended / "ACFE") WordPress plugin patched

AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729

CVE-2026-1729· AdForest theme for WordPress unpatched