CVE-2026-88904

CVE-2026-88904 affects the PuppyFW WordPress plugin through version 0.4.4 . The root cause is a broken authorization on one of its REST routes: the route validates the caller against a capability that is taken from the request itself , rather than from a fixed or hardcoded value. This allows any ...

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - REST API 权限提升至 RCE PoC（完整） 受影响的版本：5.0.0 至 7.2.0 用户要求：订阅者用户 方法：通过 REST API 将权限提升至管理员并触发 RCE 端点：/v1/members/me 端点。 如何使用 Docker root@kitploit: git clone https://github.com/HoangKien1020/CVE-2021-21389 cd CVE-2021-21389/ docker build . -t...

CVE-2024-7856

CVE-2024-7856 ★ CVE-2024-7856 任意文件删除 PoC ★ 描述 CVE-2024-7856 : MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar -f python3 CVE-2024-7856.py -u -f -i -p 示例 root@kitploit: python3 CVE-2024-7856.py -u http://example.com/ -f /tmp/test python3 CVE-2024-7856.py -u http://example.com/ -f...

CVE-2026-92806

phpList versions before 3.6.17 are vulnerable to Cross-Site Request Forgery (CSRF) in the mass subscriber removal form handler (massremove.php). The root cause is the absence of CSRF token validation, allowing an attacker to craft a page that, when visited by a logged-in administrator, triggers s...

CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

EUVD-2026-81066

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

CVE-2024-7135

CVE-2024-7135 El plugin Tainacan para WordPress es vulnerable al acceso no autorizado a datos debido a una comprobación de capacidad faltante en la función 'getfile' en todas las versiones hasta la 0.21.7 inclusive. La función también es vulnerable a directory traversal. Esto permite a atacantes...

CVE-2025-9215

StoreEngine 强大的 WordPress 电子商务插件（支付、会员、联盟营销、销售等）= 1.4.0 - 已认证（订阅者+）任意文件下载 StoreEngine 插件在其 CSV 导入/导出功能中包含一个漏洞，该漏洞允许任何已认证用户 （订阅者、作者、编辑等）从服务器下载任意文件，包括敏感的系统文件、WordPress 配置文件以及插件源代码。该漏洞源于 storeenginecsv/filedownload 端点缺乏适当的路径清理，仅依赖 nonce 验证来保证安全，而 storeenginenonce 通过插件的 JavaScript 暴露给所有前端用户...

CVE-2025-14172-Nuclei-Template

📄 Plantilla de Nuclei para CVE-2025-14172 🚀 Descripción general Este repositorio contiene una plantilla de Nuclei diseñada específicamente para detectar una Vulnerabilidad de Falta de Autorización CVE-2025-14172 en el plugin de WordPress WP Page Permalink Extension. Este problema permite que...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC WordPress 的 InfiniteWP Client 插件（版本至 1.11.1 及包括该版本）存在敏感信息泄露漏洞。该漏洞允许具有订阅者级别或更高权限的已认证攻击者提取包含配置详细信息在内的敏感数据。利用此漏洞的前提是插件尚未进行过配置。当与另一个任意插件安装和激活漏洞结合使用时，可能导致对站点的远程管理以及潜在的权限提升。...

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – Asistente de escritura de contenido con IA = 1.0.18 - Autorización faltante para instalación/activación arbitraria de plugins por parte de usuarios autenticados Suscriptor+ Descripción Descripción El plugin 10Web AI Assistant – Asistente de escritura de contenid...

CVE-2023-0630

CVE-2023-0630 CVE-2023-0630 - Slimstat Analytics 4.9.3.3 - Inyección SQL de Suscriptor+ Requisitos sqlmap instalado y un nombre de usuario y contraseña válidos con suscriptor+ Uso root@kitploit: usage: CVE-2023-0630.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message a...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - 对 AJAX 调用的不当访问控制（Subscriber+） 描述： 该插件中的部分 AJAX 调用未正确检查权限和 CSRF 令牌，从而导致任意文章读取、订阅者列表导出以及插件停用等问题。 root@kitploit: reference: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7afd55d?source=api-prod...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint -un -p -ru 免责声明 此脚本仅供教育和研究目的。未经授权在您不拥有或未获得明确测试许可的系统上使用是非法且不道德的。...

CVE-2023-47504-POC

CVE-2023-47504 POC 针对 CVE-2023-47504 的利用程序。 根据 NIST 的描述，该漏洞应允许未经身份验证的用户访问 Elementor Website Builder 插件中的功能。 根据我对该漏洞的研究，以及从描述该漏洞的 Patchstack URL...

CVE-2026-87959

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-87959

The WPBot WordPress plugin (versions 8.7.2 through 8.7.5, before 8.7.6) contains a missing capability check on the AJAX action responsible for saving its Claude AI provider settings . This allows users with as little as subscriber-level access to overwrite those settings, including the API key us...