CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

rcno-reviews

Recencio Book Reviews A WordPress plugin for managing and displaying book reviews. Custom post type, 7 taxonomies, 13 shortcodes, 7 widgets, 6 templates, 5 extensions. All data stored in standard WordPress post meta — no custom tables. Background Recencio Book Reviews was created by Kemory Grubb...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privilege Escalation via Administrator Account Creation ♡ === shadow ♡ & friska === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...

CVE-2023-6036

CVE-2023-6036 POC about Wordpress plugin Web3 – Crypto wallet Login & NFT token gating 3.0.0 - Authentication Bypass This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handleloginrequest’ function and ‘handleauthrequest' function Vulnerability I have...

wordpress-CVE-2024-27956

This repository does not have a README...

CVE-2025-4796

CVE-2025-4796 eventin and update the speaker email to an email they control. then the attacker can use wordpress password reset to take over the admin account. requirements: python 3.8 or higher requests install requests: pip install requests usage run the script and enter required values when...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ -----------------------------124662954...

CVE-2025-14440

CVE-2025-14440 JAY Login & Register = 2.4.01 - Bypass de Autenticación mediante Cookie 🚨 JAY Login & Register = 2.4.01 - Bypass de Autenticación mediante Cookie 📝 Descripción El plugin JAY Login & Register para WordPress es vulnerable a un bypass de autenticación en versiones hasta la 2.4.01...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro = 1.9.26 - Unauthenticated Arbitrary File Upload Description WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation i...

CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...

CVE-2019-9978

CVE-2019-9978 - RCE en el Plugin Social Warfare de WordPress system'cat /etc/passwd' ✅ Paso 2 – Iniciar un Servidor HTTP de Python Usa Python para servir tu payload: python3 -m http.server 8000 Esto hará que tu payload.txt sea accesible en: http://:8000/payload.txt ✅ Paso 3 – Ejecutar el Exploit...

CVE-2025-2005

CVE-2025-2005 — Front-End Users Arbitrary File Upload CVE-2025-2005 WordPress Front-End Users — Unauthenticated Arbitrary File Upload 0xZ3R0 // h4ckxel 0x00 — Executive Summary Front-End Users is affected by an unauthenticated arbitrary file upload vulnerability affecting versions ≤ 3.2.32. The...

CVE-2026-0920

CVE-2026-0920 - WordPress Plugin LA-Studio Element Kit / Unauthenticated Privilege Escalation A proof-of-concept exploit for CVE-2026-0920 , an unauthenticated privilege-escalation vulnerability in the LA-Studio Element Kit WordPress plugin. The vulnerability allows an unauthenticated attacker to...

Project-Project-Chimera-Exploiting-a-Modern-WordPress-XXE-to-Pillage-Secrets-

Project Goal: To demonstrate a complete attack chain on a vulnerable WordPress installation, exploiting CVE-2021-29447 XXE in media library to achieve remote code execution and full system compromise. Phase 1: Reconnaissance & Enumeration Network Scanning with Nmap: bash Quick SYN scan to discove...

CVE-2026-82222-MassExploit

CVE-2026-82222 — GiveWP WordPress Plugin Unauthenticated RCE Critical Unauthenticated Remote Code Execution CVSS 9.8 — GiveWP ≤ 4.16.7.1 This tool exploits CVE-2026-82222 , a vulnerability in the WordPress GiveWP plugin that allows unauthenticated attackers to execute arbitrary commands on the...

CVE-2026-96899

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site...

CVE-2026-97319

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-96897

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password...

CVE-2026-89003

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...