CVE-2025-6058

🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit Unauthenticated Arbitrary File Upload Exploit targeting WordPress WPBookit Plugin ≤ 1.0.4 Exploit allows remote shell upload and full command execution. Author: 0xgh057r3c0n 📌 About The Vulnerability CVE-2025-6058 is...

wpCrack

wpCrack v1.0 versión 1.0 Instalación git clone https://github.com/MrSqar-Ye/wpCrack.git Cracker de hashes de WordPress Video Contacto : Twitter : @M4DM0E Enviar a mi correo...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

nex-forms_SQL-Injection-CVE-2023-2114

nex-formsInyección-SQL CVE-2023-2114 https://vulners.com/cve/CVE-2023-2114 https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d Revisión rápida sobre la Inyección SQL en el Plugin NEX-Forms para WordPress Exploit subido Nota: Este código de exploit subido no es para esta...

CVE-2024-27956

CVE-2024-27956 Note Build wordpress: docker-compose -f stack.yml up Install plugin: 1. WordPress dashboard, choose Plugins Add New 2. Click Upload Plugin 3. Choose File - wp-automatic.zip - Install Now 4. After the installation is complete, click Activate Plugin Exploit...

CVE-2026-63030-POC

CVE-2026-63030: WordPress Pre-Auth RCE Explained 📖 Read the full technical analysis first: CVE-2026-63030: WordPress Pre-Auth RCE Explained This repository contains the proof-of-concept exploit referenced in that article. Start with the blog to understand the vulnerability, limitations, and...

CVE-2026-0594-ListSiteContributors-Plugin-Exploit

CVE-2026-0594-ListSiteContributors-Plugin-Exploit 🛡️ Description CVE-2026-0594 is a critical Reflected Cross-Site Scripting XSS vulnerability found in the List Site Contributors WordPress plugin. This exploit automates the discovery of vulnerable endpoints via the WordPress REST API wp-json and...

wpbf

wpbf! wpbf es una herramienta de fuerza bruta para probar remotamente la fortaleza de las contraseñas, la enumeración de usuarios y la detección de plugins en un sitio WordPress. Descripción ^^^^^^^^^^^ El script intentará iniciar sesión en el panel de WordPress a través del formulario de login...

wpbf

wpbf! wpbf is a bruteforce tool to remotely test password strength, username enumeration and plugin detection on a WordPress site. Description ^^^^^^^^^^^ The script will try to login into the WordPress dashboard through the login form using a mixture of enumerated usernames, a wordlist and...

CVE-2017-8295

CVE-2017-8295 Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lead to an attacker gaining unauthorised access to a victim's WordPress account...

CVE-2024-3495-Poc

CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 Apple...

CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port...

WP-Bricks-Exploit-CVE-2024-25600

BricksRCE Exploiter CVE-2024-25600 — WordPress Bricks Builder RCE sin autenticación Herramienta de evaluación de seguridad autorizada para CVE-2024-25600 Autor: Sudeepa Wanigarathna · Herramienta: BricksRCE Exploiter v1.0 Script principal: cve-2024-25600.py...

php_filter_chain_generator

PHP filter chain generator A CLI to generate PHP filters chain, get your RCE without uploading a file if you control entirely the parameter passed to a require or an include in PHP! Usage Help root@kitploit: $ python3 phpfilterchaingenerator.py --help usage: phpfilterchaingenerator.py -h --chain...

CVE-2023-47504-POC

CVE-2023-47504 POC Exploit for CVE-2023-47504. According to NIST, this vulnerability should allow unauthenticated users to access functionalities in the Elementor Website Builder Plugin. Based on my research into the vulnerability, and also judging by the URL from Patchstack that describes the...

CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7

CVE-2021-29447 Authenticated XXE Exploit for WordPress 🎯 A Python PoC to exploit the authenticated XXE vulnerability CVE-2021-29447 in WordPress versions 5.6–5.7 via WAV metadata. It abuses the iXML chunk in WAV files to trigger an Out-of-Band OOB exfiltration of sensitive data—like /etc/passwd,...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF to RCE in WordPress Custom CSS, JS & PHP plugin = 2.4.1 🧠 Description A Cross-Site Request Forgery CSRF vulnerability in the WPFactory Custom CSS, JS & PHP plugin allows for Remote Code Execution RCE by injecting malicious PHP code via unauthorized POST requests. This...

CVE-2021-25094-tatsu-preauth-rce

Preauth RCE in Tatsu builder Wordpress plugin CVE-2021-25094 Simple PoC of an unauthenticated RCE in Tatsu Builder = 3.3.11 provided as an example. Full write-up here: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ Usage: root@kitploit: python3 exploit-rce.py -h...

cve-2016-10924-POC

CVE-2016-10924-POC This repository contains a Proof-of-Concept PoC exploit script for the Directory Traversal vulnerability CVE-2016-10924 found in the WordPress plugin ebook-download versions Note: This PoC is for educational and authorized testing purposes only. Misuse of this information can...

CMSScan

CMSScan Escanee sitios web de WordPress, Drupal, Joomla, vBulletin en busca de problemas de seguridad. Hecho con en India CMSScan proporciona un panel de seguridad centralizado para escaneos de seguridad de CMS. Está impulsado por wpscan, droopescan, vbscan y joomscan. Admite escaneos tanto bajo...