By-Poloss..-..CVE-2026-11551-PoC

CVE-2026-11551：Branda 插件 - 未授权权限提升（账户接管） 概述 CVE ID ：CVE-2026-11551 CVSS 评分 ：9.8（严重） 受影响版本 ：Branda – White Label & Branding = 3.4.29 修复版本 ：3.4.31 发布时间 ：2026年6月19日 漏洞描述 WordPress 的 Branda 插件在 3.4.29 及之前的所有版本中存在通过账户接管实现权限提升的漏洞。原因在于该插件在更新用户密码前未能正确验证用户身份。这使得未经验证的攻击者能够更改任意用户（包括管理员）的密码，并借此访问其账户。 技术分析...

WORDPRESS-CVE-2024-25600-EXPLOIT-RCE

WORDPRESS-CVE-2024-25600-EXPLOIT-RCE WORDPRESS-CVE-2024-25600-EXPLOIT-RCE - WordPress Bricks Builder リモートコード実行 RCE...

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cost of Goods for WooCommerce versions = 3.5.2...

cve-2023-40000

cve-2023-40000 这是 cve-2023-40000 的概念验证代码。Wordpress LiteSpeed Cache 漏洞利用。 该CVE可应用于所有 LiteSpeed Cache --------------------+"; echo "+----------------------------------------------------------------------+";...

CVE-2025-54726

CVE-2025-54726 JS Archive List = 5.0.12 time-based...

CVE-2026-89303

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by manop55555 in WordPress Plugin Classified Listing versions = 6.1.3...

CVE-2026-93000

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-89300

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-88828

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or...

CVE-2026-92996

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid...

CVE-2026-84744

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments...

CVE-2026-86838

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step...

CVE-2026-6279.py

説明 このPythonスクリプトは、Avada Builder = 3.15.2 を標的としたCVE-2026-6279のエクスプロイトツールです。 主な動作: Avada固有のショートコード/ページパターンを介して fusionloadnonce をターゲットスキャン Cloudflareがadmin-ajaxをブロックしている場合、AJAXエンドポイントと発信元IPバイパスを発見 fusiongetwidgetmarkup のエクスプロイトリクエストを構築 system, passthru, shellexec, exec, filegetcontents を介したRCEを試行...

WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ashish Agarwal @Donrulezz in WordPress Plugin GravityExport Lite for Gravity Forms versions = 2.7.2...

WordPress Media Library Folders plugin <= 8.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Media Library Folders versions = 8.4.1...

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Content Egg versions = 6.3.1...

CVE-2024-13869

CVE-2024-13869 移行、バックアップ、ステージング – WPvivid 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever ...

CVE-2025-6934

CVE-2025-6934 Opal Estate Proにおける認証なしの特権昇格 説明 CVE-2025-6934 は、Opal Estate Pro WordPress プラグイン v1.7.5 以下 の重大な脆弱性です。 このバグにより、認証されていない攻撃者 が細工したリクエストを以下の宛先に送信することで、新しい管理者アカウントを作成できるようになります。 /wp-admin/admin-ajax.php?action=opalestate\register\form 根本原因は、登録プロセス中の nonce 解析 opalestate-register-nonce...

CVE-2024-28000-Exploit-Lab

CVE-2024-28000 — WordPress LiteSpeed Cache 实验室 CVE-2024-28000 的授权本地实验复现，一个影响 LiteSpeed Cache WordPress 插件易受攻击版本的未认证权限提升问题。 范围： 本仓库记录了仅针对隔离的、个人控制的 WordPress 虚拟机所进行的测试。切勿将这些技术用于你不拥有或未经明确授权测试的系统。 结果 该漏洞已成功从 Kali 攻击虚拟机对运行 LiteSpeed Cache 6.2.0.1 的隔离 Ubuntu WordPress 目标进行端到端复现。 演示的攻击路径： 1. 枚举了 WordPre...