CVE-2023-6063-PoC

PoC per CVE-2023-6063: WP Fastest Cache 1.2.2 Iniezione SQL Cieca Non Autenticata -red Una Proof of Concept per CVE-2023-6063, una vulnerabilità di iniezione SQL cieca basata sul tempo in WP Fastest Cache ≤1.2.2. Estrae password hashate userpass ed email useremail dalla tabella wpusers abusando d...

JBWPer

JBWPer | CVE-2022-4061 - JobBoardWP Automatisches Massentool zum Überprüfen und Ausnutzen der Schwachstelle CVE-2022-4061 - JobBoardWP install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh...

CVE-2026-18512

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-18328

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18323

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18100

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-16601

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

CVE-2024-3105-PoC

CVE-2024-3105 PoC Das Woody Code Snippets – Insert Header Footer Code, AdSense Ads Plugin für WordPress ist in allen Versionen bis einschließlich 2.5.0 anfällig für Remote Code Execution über den Shortcode 'insertphp'. Dies liegt daran, dass das Plugin die Nutzung der Funktionalität nicht auf...

essential-addons-for-elementor-xss-poc

🔍 Detector de Vulnerabilidade XSS no Essential Addons for Elementor 🚨 Informações Críticas Esta ferramenta é apenas para fins de pesquisa e correção de segurança. Não a utilize para prejudicar sites. Se encontrar sites vulneráveis, reporte-os responsavelmente aos proprietários para que possam...

CVE-2016-15041-mainwp-dashboard

CVE-2016-15041 Lab - MainWP Dashboard Gespeichertes XSS Verwundbares Labor für CVE-2016-15041: Nicht authentifiziertes gespeichertes XSS im MainWP Dashboard WordPress-Plugin = 3.1.2. Schnellstart root@kitploit: docker compose up -d --build Warten Sie 30 Sekunden für die automatische Einrichtung...

CVE-2023-6063-PoC

CVE-2023-6063-PoC Ausnutzung einer SQL-Injection-Schwachstelle in WP Fastest Cache CVE-2023-6063...

wordpress-cve-2024-10924-exploit

WordPress CVE-2024-10924 Exploit 📌 Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2024-10924, una vulnerabilità nel plugin WordPress Really Simple SSL che consente di bypassare l'autenticazione a due fattori 2FA. Gli attaccanti possono sfruttare questa falla per...

CVE-2026-18512

The TranslatePress WordPress plugin (multilingual/AI translation) is vulnerable to Stored XSS in all versions up to and including 3.2.6 . The root cause is insufficient input sanitization and output escaping of approved comment body content rendered in the Translation Editor Strings Dropdown comp...

EUVD-2026-65317

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-18100

The MetForm plugin for WordPress (Elementor form builder) versions up to and including 4.1.8 are vulnerable to Stored Cross-Site Scripting via the mf_form_id widget setting due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above...

CVE-2026-18100 MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-65316

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18323

The Forminator Forms plugin for WordPress (versions up to and including 1.57.0.2 ) is vulnerable to unauthenticated Stored XSS via the Radio Field "Save and Continue Draft" feature. The root cause is insufficient input sanitization and output escaping: the Save-and-Continue AJAX endpoint is regis...

CVE-2026-18328

The Forminator Forms WordPress plugin (all versions up to and including 1.57.0 ) is vulnerable to DOM-Based Reflected Cross-Site Scripting via the error_description parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...