Overview 59 matches · 0 in Waratek scope · 0 protected · 8 exploited · 2 CISA KEV · 8 public PoC · 3 EPSS ≥ 0.5
59matches
0in Waratek scope0.0%
0protected0.0%
8exploited13.6%
2CISA KEV3.4%
8public PoC13.6%
3EPSS ≥ 0.55.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
1.7%
Not applicable
58
98.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
59
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 20 / year
20061
Not applicable1
Critical1
not blocked1
Working exploit published1
20071
Not applicable1
Critical1
not blocked1
No public exploit1
20080
20090
20100
20110
20120
20130
20140
20150
20162
Not applicable2
Critical2
not blocked2
Exploited1
Working exploit published1
20173
Outside Waratek scope1
Not applicable2
Critical3
not blocked3
Exploited2
No public exploit1
20182
Not applicable2
Critical2
not blocked2
No public exploit2
20194
Not applicable4
Critical4
not blocked4
No public exploit4
20209
Not applicable9
Critical9
not blocked9
Exploited1
No public exploit8
20215
Not applicable5
Critical5
not blocked5
No public exploit5
20221
Not applicable1
Critical1
not blocked1
No public exploit1
20236
Not applicable6
Critical6
not blocked6
Exploited2
Proof of concept only1
No public exploit3
202420
Not applicable20
Critical20
not blocked20
Exploited1
Proof of concept only2
No public exploit17
20254
Not applicable4
Critical4
not blocked4
Proof of concept only1
No public exploit3
20261
Not applicable1
Critical1
not blocked1
Exploited1
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-63030 | Critical | 2026-07-17 | Not applicable | Exploited | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. |
| CVE-2025-58668 | Critical | 2025-09-22 | Not applicable | No public exploit | Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970. |
| CVE-2024-11635 | Critical | 2025-01-08 | Not applicable | No public exploit | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server. |
| CVE-2024-11613 | Critical | 2025-01-08 | Not applicable | No public exploit | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server. |
| CVE-2024-8855 | Critical | 2025-01-07 | Not applicable | Proof of concept only | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks |
| CVE-2024-56046 | Critical | 2024-12-31 | Not applicable | No public exploit | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9. |
| CVE-2024-56045 | Critical | 2024-12-31 | Not applicable | No public exploit | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5. |
| CVE-2024-56044 | Critical | 2024-12-31 | Not applicable | No public exploit | Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9. |
| CVE-2024-56043 | Critical | 2024-12-31 | Not applicable | No public exploit | Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9. |
| CVE-2024-56042 | Critical | 2024-12-31 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3. |
| CVE-2024-56057 | Critical | 2024-12-18 | Not applicable | No public exploit | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
| CVE-2024-56054 | Critical | 2024-12-18 | Not applicable | No public exploit | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
| CVE-2024-56052 | Critical | 2024-12-18 | Not applicable | No public exploit | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2. |
| CVE-2024-56050 | Critical | 2024-12-18 | Not applicable | No public exploit | Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3. |
| CVE-2024-9942 | Critical | 2024-11-23 | Not applicable | No public exploit | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the MJ_gmgt_user_avatar_image_upload() function in all versions up to, and including, 67.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. |
| CVE-2024-11069 | Critical | 2024-11-19 | Not applicable | No public exploit | The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users. |
| CVE-2024-52431 | Critical | 2024-11-18 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - The Ultimate Video Importer allows SQL Injection.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0. |
| CVE-2024-10470 | Critical | 2024-11-09 | Not applicable | No public exploit | The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated. |
| CVE-2024-50450 | Critical | 2024-10-28 | Not applicable | Proof of concept only | Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through <= 1.3.3.4. |
| CVE-2024-9047 | Critical | 2024-10-12 | Not applicable | Exploited | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier. |
| CVE-2024-7385 | Critical | 2024-09-25 | Not applicable | No public exploit | The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2024-8624 | Critical | 2024-09-24 | Not applicable | No public exploit | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' attribute of the 'mdf_select_title' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2024-6330 | Critical | 2024-08-19 | Not applicable | No public exploit | The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution. |
| CVE-2024-31211 | Critical | 2024-04-04 | Not applicable | No public exploit | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected. |
| CVE-2023-3211 | Critical | 2024-01-16 | Not applicable | Proof of concept only | The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. |
| CVE-2023-40606 | Critical | 2023-12-29 | Not applicable | No public exploit | Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21. |
| CVE-2023-35039 | Critical | 2023-12-07 | Not applicable | No public exploit | Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15. |
| CVE-2022-45370 | Critical | 2023-11-07 | Not applicable | No public exploit | Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1. |
| CVE-2023-2982 | Critical | 2023-06-29 | Not applicable | Exploited | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5. |
| CVE-2021-4374 | Critical | 2023-06-07 | Not applicable | Exploited | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site. |
| CVE-2022-4383 | Critical | 2023-01-23 | Not applicable | Proof of concept only | The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. |
| CVE-2021-24814 | Critical | 2022-02-01 | Not applicable | No public exploit | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction). |
| CVE-2021-44223 | Critical | 2021-11-25 | Not applicable | No public exploit | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. |
| CVE-2021-43409 | Critical | 2021-11-19 | Not applicable | No public exploit | The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data. In this case, the XSS payload can be submitted by any anonymous user, the payload then renders and executes when a WordPress administrator authenticates and accesses the WordPress Dashboard. The injected payload can carry out actions on behalf of the administrator including adding other administrative users and changing application settings. This flaw could be exploited to ultimately provide full control of the affected system to the attacker. |
| CVE-2020-36326 | Critical | 2021-04-28 | Not applicable | No public exploit | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation. |
| CVE-2021-24229 | Critical | 2021-04-12 | Not applicable | No public exploit | The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability. |
| CVE-2021-24228 | Critical | 2021-04-12 | Not applicable | No public exploit | The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized. |
| CVE-2020-28039 | Critical | 2020-11-02 | Not applicable | No public exploit | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. |
| CVE-2020-28037 | Critical | 2020-11-02 | Not applicable | No public exploit | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). |
| CVE-2020-28036 | Critical | 2020-11-02 | Not applicable | No public exploit | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. |
| CVE-2020-28035 | Critical | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. |
| CVE-2020-28032 | Critical | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. |
| CVE-2020-10564 | Critical | 2020-03-13 | Not applicable | No public exploit | An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call. |
| CVE-2020-10257 | Critical | 2020-03-10 | Not applicable | Exploited | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter. |
| CVE-2013-1401 | Critical | 2020-02-13 | Not applicable | No public exploit | Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll. |
| CVE-2013-1400 | Critical | 2020-02-13 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action. |
| CVE-2019-20041 | Critical | 2019-12-27 | Not applicable | No public exploit | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring. |
| CVE-2019-17670 | Critical | 2019-10-17 | Not applicable | No public exploit | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs. |
| CVE-2019-17669 | Critical | 2019-10-17 | Not applicable | No public exploit | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters. |
| CVE-2018-20984 | Critical | 2019-08-22 | Not applicable | No public exploit | The patreon-connect plugin before 1.2.2 for WordPress has Object Injection. |
| CVE-2018-20148 | Critical | 2018-12-14 | Not applicable | No public exploit | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php. |
| CVE-2014-5014 | Critical | 2018-04-25 | Not applicable | No public exploit | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path. |
| CVE-2017-16510 | Critical | 2017-11-02 | Not applicable | No public exploit | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723. |
| CVE-2017-14723 | Critical | 2017-09-23 | Not applicable | Exploited | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks. |
| CVE-2017-5611 | Critical | 2017-01-30 | Outside Waratek scope | Exploited | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name. |
| CVE-2016-10045 | Critical | 2016-12-30 | Not applicable | Working exploit published | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. |
| CVE-2016-10033 | Critical | 2016-12-30 | Not applicable | Exploited | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. |
| CVE-2007-6013 | Critical | 2007-11-19 | Not applicable | No public exploit | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash. |
| CVE-2006-6863 | Critical | 2006-12-31 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in the Enigma2 plugin (Enigma2.php) in Enigma WordPress Bridge allows remote attackers to execute arbitrary PHP code via a URL in the boarddir parameter. NOTE: CVE disputes this issue, since $boarddir is set to a fixed value |