CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w UR...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Quietly Insights plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Minterpress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a functio...

ros2_CVE-2024-28231

This repo includes a vulnerable Docker image of ros2 iron based on ubuntu 22 and a matching exploit. We exploit the vulnerability in fastrtps version 2.10.3, enabling denial of service of a remote subscriber via heap buffer overflow. Vulnerable base image Fast RTPS version 2.10.3 and dependencies...

CVE-2025-14172-Nuclei-Template

📄 Nuclei Template for CVE-2025-14172 🚀 Overview This repository features a Nuclei template specifically designed to detect a Missing Authorization Vulnerability CVE-2025-14172 in the WP Page Permalink Extension WordPress plugin. This issue allows authenticated attackers to remotely flush the site...

CVE-2023-2833

CVE-2023-2833 Mass Exploit Generator by Alucard0x1 This repository contains an exploit for CVE-2023-2833, a privilege escalation vulnerability in the ReviewX plugin for WordPress versions up to and including 1.6.13. Description The ReviewX plugin is vulnerable to privilege escalation, allowing a...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

WordPress Hustle – Email Marketing, Lead Generation, Optins, Popups plugin <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Hustle versions = 7.8.14.3...

CVE-2026-52134-libiec61850

CVE-2026-52134: GOOSE replay and message-freshness handling in libiec61850 v1.6 Status CVE-2026-52134 has been assigned. Publication of the corresponding CVE Record is pending. Affected product Vendor: MZ Automation GmbH Product: libiec61850 Tested version: 1.6 Status of other versions: Not...

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields Description The plugin, used as a companion plugin for the Discy and Himer themes, does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message and exit -w URL,...

CVE-2024-25092

CVE-2024-25092 Exploit Overview CVE-2024-25092 is a high-severity vulnerability affecting the WordPress NextMove Lite plugin versions = 2.17.0. This vulnerability allows a subscriber+ user to install and activate arbitrary plugins on a WordPress site due to missing authorization checks. Details...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-118169

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

CVE-2026-118169

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.8.14.3 . The flaw exists because of insufficient input sanitization and output escaping of the 'content[cta_label]' parameter...

CVE-2026-118169 Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-111613

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Subscriber+ Arbitrary Options Update Description The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a...