CVE-2021-25076

CVE-2021-25076-Exploit Plugin de WordPress WP User Frontend 3.5.26 - Inyección SQL Autenticado Descripción del CVE: El plugin de WordPress WP User Frontend anterior a la versión 3.5.26 no valida ni escapa el parámetro status antes de usarlo en una sentencia SQL en el panel de Suscriptores, lo que...

CVE-2016-10956-mail-masta

Mail Masta - Local File Read CVE-2016-10956 The mail-masta plugin 1.0 for WordPress has local file read in countofsend.php and csvexport.php. Usage $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage: CVE-2016-10956mailmasta.py -h -v -s -t TARGETURL -f FILE | -F...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...

CVE-2026-94299

The elegro Crypto Payment WordPress plugin versions through 1.0.1 is vulnerable to an unauthenticated arbitrary order status change via IPN callback. The root cause is a failure to require a shared secret for validating incoming payment notification requests. If the secret remains at its default ...

CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...

CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE Exploit CRITICAL Vulnerability CVE-ID: CVE-2025-32583 Severity: 9.9 CRITICAL CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Description A vulnerability in the PDF 2 Post WordPress plugin developed by termel allows Remote Code Inclusion RCE...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

CVE-2022-47615

CVE-2022-47615 LearnPress Plugin 4.2.0 - Descripción de LFI sin autenticación Descripción El plugin no valida varios parámetros en los endpoints REST lp/v1/courses/archive-course antes de usarlos en una sentencia include, lo que podría provocar problemas de LFI. Cómo usar $ python3 exploit.py -u...

CVE-2025-22783

CVE-2025-22783 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name SEO Plugin by Squirrly SEO Vulnerable version = 12.4.01 Component slug squirrly-seo Component link https://wordpress.org/plugins/squirrly-seo/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2022-0739

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit, based on destr4ct's POC - just prettier. Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress with a vulnerable bookingpress plugin version 1.0.10. python booking-sqlinjector.py -u http://metapress.htb -nu...

CVE-2019-15858

CVE-2019-15858 Unauthenticated Remote Code Execution at Woody Ad Snippets PoC An unauthenticated options import vulnerability combined with a stored XSS vulnerability can lead to remote code execution in the WordPress Woody Ad Snippets 90,000+ active installations. Woody Ad Snippets is a plugin...

CVE-2022-1597

CVE-2022-1597 El plugin, utilizado como complemento para los temas Discy y Himer, no sanitiza ni escapa un parámetro en su formulario de restablecimiento de contraseña, lo que permite realizar ataques de Cross-Site Scripting Reflejado. Plugins afectados: WPQA history.pushState'', '', '/' Plantill...

CVE-2024-3105-PoC

CVE-2024-3105 PoC El plugin Woody code snippets – Insert Header Footer Code, AdSense Ads para WordPress es vulnerable a Ejecución Remota de Código en todas las versiones hasta, e incluyendo, la 2.5.0 a través del shortcode 'insertphp'. Esto se debe a que el plugin no restringe el uso de la...

CVE-2024-7313

Shield Security Plugin Vulnerability Exploit CVE-2024-7313 Overview This repository contains a Python PoC script designed to exploit a reflected XSS vulnerability in the Shield Security Plugin for WordPress, affecting versions below 20.0.6. The vulnerability CVE-2024-7313 allows an attacker to...

CVE-2023-37979

CVE-2023-37979 Vulnerabilidad de Cross-Site Scripting XSS Reflejado no autenticada en el plugin Ninja Forms Contact Form de Saturday Drive en versiones = 3.6.25. PoC y Comprobador, solo con fines educativos 'python3 exploit.py https://target.com'...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions ≤1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Bypass de Autenticación para Toma de Control de Cuenta de Administrador Resumen Esta herramienta es un exploit de prueba de concepto para CVE-2026-10580 , una vulnerabilidad de bypass de autenticación que afecta al plugin de WordPress Hippoo...

CVE-2022-29455

CVE-2022-29455 Vulnerabilidad de WordPress - XSS Cross-Site Scripting Ubicación de la vulnerabilidad https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Versión vulnerable Ejemplo - https://www.youtube.com/watch?v=4qvOkSbhcE...