CVE-2025-14124

CVE-2025-14124 WordPress Team Plugin - Nicht authentifizierte SQL-Injection Autor: Hyun Chiya Schwachstelleninformationen...

CVE-2025-10307

Exploit: Cancellazione di file arbitraria tramite Backuply tarfile path traversal PoC da console del browser admin autenticato root@kitploit: async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await...

CVE-2019-9978-RCE-PoC

CVE-2019-9978 RCE PoC – Exploit del Plugin Social Warfare per WordPress Inclusione Remota di File RFI non autenticata verso Esecuzione Remota di Codice RCE 📌 Descrizione Questo repository contiene un Proof of Concept PoC basato su Python che dimostra lo sfruttamento di CVE-2019-9978 , una...

CVE-2025-12973

S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Generatore di Contenuti e Immagini = 1.7.7 - Autenticato Editor+ Caricamento Arbitrario di File Il plugin WordPress S2B AI Assistant versioni 2.47 e precedenti contiene una vulnerabilità di caricamento arbitrario di file che consente agli utenti...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Escalation dei privilegi non autenticata Autore: Hyun Chiya Informazioni sulla vulnerabilità Campo| Valore ---|--- ID CVE| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Versioni interessate| B"Extract Nonce acfnonce & Form ID acfform" B --...

CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - Lettura Arbitraria di File per utenti autenticati Contributor+ Il plugin AI Engine for WordPress contiene una vulnerabilità nella funzionalità di inserimento immagini che consente a qualsiasi utente autenticato con capacità di...

CVE-2025-13374

Kalrav AI Agent = 2.3.3 - Caricamento Arbitrario di File non Autenticato tramite Azione AJAX kalravuploadfile Il plugin WordPress Kalrav AI Agent versione 2.3.3 e precedenti contiene una vulnerabilità di caricamento arbitrario di file che consente a utenti non autenticati di caricare file PHP...

CVE-2025-13597

AI Feeds = 1.0.11 - رفع ملف تعسفي غير مصادق عليه يحتوي إضافة ووردبريس AI Feeds في الإصدارات 1.0.11 وما دون على ثغرة تنفيذ تعليمات برمجية عن بُعد غير مصادق عليها في ملف actualizadorgit.php. يمكن الوصول إلى هذا الملف مباشرة عبر HTTP دون أي تحقق من المصادقة أو التفويض، مما يسمح للمهاجمين غير المصادق...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Die Shell ausnutzen, soba...

CVE-2025-13595

CIBELES AI = 1.10.8 - बिना प्रमाणीकरण के मनमाना फ़ाइल अपलोड Cibeles AI WordPress प्लगइन के संस्करण 1.10.8 और उससे नीचे में actualizadorgit.php फ़ाइल में एक बिना प्रमाणीकरण वाली रिमोट कोड निष्पादन भेद्यता मौजूद है। यह फ़ाइल बिना किसी प्रमाणीकरण या प्राधिकरण जांच के HTTP के माध्यम से सीधे एक्सेस की...

Exploit_CVE-2021-24762

exploitcve-2021-24762 Dieses Repository zeigt einen Exploit für CVE-2021-24762. Es handelt sich um einen Blind-SQLi-Exploit, der in der Standardkonfiguration das Admin-Passwort ausliest. Während ich ein Labor auf Basis von WordPress mit dem PerfectSurvey-Plugin durchführte, blieb ich bei einer...

CVE-2026-74932

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o Das AI Bud Plugin stellt einen REST-API-Endpunkt /wp-json/ai-buddy/v1/wp/attachments bereit, der das Hochladen von Dateien in die WordPress-Mediathek ermöglicht. Die Dateilogik des Endpunkts enthält eine Dateiumbenennungsfunktion,...

RED_HAWK

Versione 2.0.0 Di R3D@0R2H1N A.K.A Tuhinshubhra Strumento tutto in uno per Information Gathering e Vulnerability Scanning Scansioni che puoi eseguire con RED HAWK : Scansione di base Titolo del sito NUOVO Indirizzo IP Rilevamento del server web MIGLIORATO Rilevamento CMS Rilevamento Cloudflare...

CVE-2026-74932 WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references ...

CVE-2026-74932

WP Fastest Cache (WordPress plugin) versions before 1.5.1 fail to validate the Host header before using it to build URLs for asset files embedded in cached pages, and omit that header from the cache key. This allows an unauthenticated attacker to poison cached pages with references to an attacker...

cve-2026-3359-exp

CVE-2026-3359 è una vulnerabilità di SQL Injection non autenticata situata nel plugin WordPress "Form Maker" di Web10 in tutte le versioni fino alla 1.15.42. Per utilizzare questo PoC/exploit, configura prima un ambiente virtuale tramite i comandi "virtualenv name of your enviroment here" o "venv...

sudowp-clickfunnels-zurich

SudoWP Zurich für ClickFunnels Mitwirkende: SudoWP, WP Republic Ursprüngliche Autoren: Etison, LLC Schlagwörter: clickfunnels, security-patch, legacy, landing pages, funnels, sudowp Erfordert mindestens: 4.3 Getestet bis: 6.7 Stabile Version: 0.1.1 Lizenz: GPLv2 oder später Sicherheitshinweis Die...

sudowp-adminer

SudoWP Adminer Sicherheits-Fork Mitwirkende: SudoWP, WP Republic Ursprüngliche Autoren: Frank Bültge, Inpsyde Tags: adminer, database, security, cve-2021-21311, ssrf-patch Erfordert mindestens: 5.8 Getestet bis: 6.7 Stabile Version: 1.5.0 Lizenz: GPLv2 oder später Sicherheitshinweis CVE-2021-2131...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — प्रमाणीकरण बाईपास से व्यवस्थापक खाता अधिग्रहण भेद्यता सारांश वर्डप्रेस प्लगइन Burst Statistics संस्करण 3.4.0 से 3.4.1.1 एक अप्रमाणित प्रमाणीकरण बाईपास भेद्यता के लिए संवेदनशील है जो पूर्ण व्यवस्थापक खाता अधिग्रहण की ओर ले जाता है। यह गंभीर दोष एक...