Mass-CVE-2023-28121

CVE-2023-28121 WooCommerce Payments 5.6.2 - Escalata dei Privilegi non autenticata Aggiunta massiva di utenti amministratori Introduzione Questo script utilizza Python3 e usa il threading per una migliore velocità di elaborazione. Lo script è stato aggiornato a 2 versioni. V1 è la vecchia version...

Mass-CVE-2023-28121-kdoec

CVE-2023-28121 WooCommerce Payments 5.6.2 - Nicht authentifizierte Privilegienausweitung Massenhinzufügen von Admin-Benutzern Verwendung Dieses Skript verwendet Python3. Installieren Sie die Abhängigkeiten pip install -r requirements.txt Referenzen...

CVE-2025-12720

g-FFL Cockpit = 1.7.1 - Eliminazione arbitraria di prodotti non autenticata Il plugin g-FFL Cockpit non implementa controlli di autorizzazione adeguati sugli endpoint REST API queue e process, consentendo a utenti non autenticati di eliminare prodotti WooCommerce arbitrari spoofando gli header HT...

CVE-2025-29009-POC

CVE-2025-29009-POC Plugin de Anexo de Prescrição Médica para WooCommerce = 1.2.3 - Upload Arbitrário de Arquivo Não Autenticado. Assista a demonstração aqui: https://youtu.be/WvW2shDBIFs...

CVE-2023-28121

CVE-2023-28121 WooCommerce Payments: Exploit di accesso admin non autorizzato Non pubblicherò questo per primo... questo è sicuro.. Il PoC è ora pubblicato. È stato creato solo per scopi educativi/di ricerca! Usalo a tuo rischio!...

CVE-2017-17058-woo_exploit

Este repositorio nao tem um README...

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit 🛡️ Beschreibung CVE-2026-3891 ist eine kritische Unauthenticated Arbitrary File Upload -Sicherheitslücke, die im Pix for WooCommerce WordPress-Plugin in den Versionen bis einschließlich 1.5.0 gefunden wurde. Die Schwachstelle existiert in der...

CVE-2023-28121-WordPress-Privilege-Escalation

🔐 CVE-2023-28121 — Escalation dei privilegi WordPress Esplorazione pratica di una vulnerabilità critica in WordPress utilizzando il plugin WooCommerce Payments. 📌 Riepilogo La CVE-2023-28121 consente di creare utenti amministratori senza autenticazione tramite API REST. Severità: Critica CVSS 9.8...

WooRefer

WooRefer | CVE-2022-4047 - Reso, Rimborso e Scambio per WooCommerce Strumento automatico di massa per verificare e sfruttare la vulnerabilità in CVE-2022-4047 - Reso, Rimborso e Scambio per WooCommerce install.sh sha1sum install.sh | grep 12345678 md5sum install.sh...

CVE-2025-1661

CVE-2025-1661 Exploit per CVE-2025-1661 - HUSKY – Products Filter Professional for WooCommerce 1.3.6.6 La PoC è ora pubblicata. È stata creata solo per scopi educativi/di ricerca! Utilizzala a tuo rischio e pericolo!...

woocommerce_scanner

Questo repository non contiene un README...

Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. i...

WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting

WordPress Persian Woocommerce plugin through 5.8.0 contains a cross-site scripting vulnerability. The plugin does not escape the s parameter before outputting it back in an attribute in the admin dashboard. An attacker can inject arbitrary script in the browser of an unsuspecting user in the...

WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting

WordPress Active Products Tables for WooCommerce plugin prior to 1.0.5 contains a cross-site scripting vulnerability.. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, An attacker can inject arbitrary script in the browser of an...

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting

WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter. id: CVE-2018-5316 info: name: WordPress SagePay Server Gateway for WooCommerce 1.0.9 - Cross-Site Scripting author: daffainfo severity: medium...

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

TI WooCommerce Wishlist <= 2.9.2 - Arbitrary File Upload

TemplateInvaders TI WooCommerce Wishlist = 2.10.0 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges. id: CVE-2025-47577 info: name: TI WooCommerce Wishlist =...

WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...

Woo Bulk Price Update <2.2.2 - Cross-Site Scripting

The Woo Bulk Price Update WordPress plugin, in versions 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the technogetproducts action, which can only be triggered by an authenticated user. id: CVE-2023-28665 info: name: Woo Bulk Price Update 2.2.2 -...

WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting

The Product Addons & Fields for WooCommerce WordPress plugin before version 32.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape some URL parameters in the admin panel, which could allow attackers to execute arbitrary JavaScript code in ...