Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-2500

Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Davidfcarr Wordpress
Products
Quick Playground Wordpress
CVE-2026-6403

Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, which appends a user-controlled 'stylesheet' parameter directly to the theme root directory path without sanitizing directory traversal sequences. This makes it possible for unauthenticated attackers to trigger the creation of a ZIP archive containing arbitrary files from the server's filesystem — including wp-config.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Davidfcarr Wordpress
Products
Quick Playground Wordpress
CVE-2023-41652

WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.

CVSS 3.1 · 8.2 High EPSS 1.0% KEV · Not listed
Vendors
Carrcommunications Davidfcarr
Products
Rsvpmaker Rsvpmarker
CVE-2026-1830

Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated attackers to retrieve the sync code, upload PHP files with path traversal, and achieve remote code execution on the server.

CVSS 3.1 · 9.8 Critical EPSS 8.1% KEV · Not listed
Vendors
Davidfcarr Wordpress
Products
Quick Playground Wordpress
CVE-2025-48278

WordPress RSVPMarker plugin <= 11.5.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.5.6.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Davidfcarr
Products
Rsvpmarker
CVE-2025-31552

WordPress RSVPMarker plugin <= 11.6.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker rsvpmaker allows SQL Injection.This issue affects RSVPMarker : from n/a through <= 11.6.7.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Davidfcarr Wordpress
Products
Rsvpmarker Wordpress
CVE-2024-50531

WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Carrcommunications Davidfcarr
Products
Rsvpmaker Rsvpmarker