CVE-2025-69080

Exploit LFI du thème Gecko CVE-2025-69080 Vulnérabilité d'inclusion locale de fichier LFI non authentifiée dans le thème WordPress Gecko = 1.9.8 ⚠️ Description Cet exploit cible une vulnérabilité d'inclusion locale de fichier de haute sévérité CVSS 8.1 dans le thème WordPress JanStudio Gecko. La...

CVE-2025-4334

CVE-2025-4334 - Simple User Registration --form Arguments: -u / --url → Base WordPress URL e.g. https://target.com/wordpress/ --form → Full URL of the registration form e.g. https://target.com/wpr/default-registration/ Example: python3 CVE-2025-4334.py -u https://example.com/wordpress --form...

CVE-2026-6271

CVE-2026-6271 — Career Section WordPress Plugin RCE Scanner Plugin: Career Section career-section CVE ID: CVE-2026-6271 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary File Upload → Remote Code Execution Affected...

CVE-2024-56067

CVE-2024-56067 WP SuperBackup = 2.3.3 - غياب التفويض لتنزيل ملف النسخة الاحتياطية بدون مصادقة الوصف إضافة Super Backup & Clone - Migrate لـ WordPress معرضة للوصول غير المصرح به بسبب فقدان فحص الصلاحية في إحدى الدوال في جميع الإصدارات حتى 2.3.3. وهذا يجعل من الممكن للمهاجمين غير المصادق عليهم تنزي...

CVE-2026-8206-Lab

CVE-2026-8206 - Kirki Account Takeover Lab Local Docker lab for demonstrating CVE-2026-8206 in the Kirki WordPress plugin. This repository compares the real Kirki plugin releases: vuln: Kirki 6.0.6 patched: Kirki 6.0.7 The lab is local-only and binds WordPress services to 127.0.0.1. The PoC is...

CVE-2019-1698

تران كونغ دانه - SVTT - المشرف: لوو فان لان - CVE-2019-1698 - تاريخ البدء: 30/07/2024 افحص الفرق في الكود بين الإصدار الذي يحتوي على الثغرة والإصدار الذي يحتوي على إصلاح الثغرة: مرجع الكود 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php...

CVE-2024-34568

Exploit Title: LetterPress = 1.2.1 - Cookie Stealing Vulnerability Exploit Author: SANU P.L CVE: CVE-2024-34568 CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L References: https://nvd.nist.gov/vuln/detail/CVE-2024-34568...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 We access the WordPress web page where we will see that it has MFA enabled through the vulnerable plugin: We must run the PoC and provide the login credentials: Automatically, the browser will open via a...

wp2shell-lab

mini-wp-rest A compact, dependency-free reimplementation of a small slice of WordPress's REST API — just enough to serve a public posts collection and run several sub-requests in one round trip. Handy for teaching how WordPress routing, WPQuery, and $wpdb fit together without pulling in all of...

CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' ⚠️ CVE-2025-14156 – Fox LMS WordPress Unauthenticated Privilege Escalation Exploit 🛡️ Vulnerability Overview Fox LMS – WordPress LMS Plugin v1.0.4.7 to v1.0.5.1 – Unauthenticated...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Required Arguments: -u, --url Target WordPress site URL e.g., http://127.0.0.1/wordpress -e, --email Email for the new admin account Optional Arguments: -f, --fname First name default: Pwn -l, --lname Last name default: Admin -r, --role Role to assign default:...

CVE-2019-9978

CVE-2019-9978 – Proof of Concept PoC Functional PoC for vulnerability CVE-2019-9978 , affecting the plugin Social Warfare = 3.5.2, allowing Remote Code Execution RCE in WordPress. 📌 Description This exploit abuses the swpdebug=loadoptions parameter to force the loading of a remote payload, allowi...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Unauthenticated Arbitrary Plugin Installation Description The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnewsimporterpluginactionfornotice function in all versions up to, and...

CVE-2023-6553

CVE-2023-6553 Due to a incorrect include statement in the "Backup Migration" plugin, a attacker can achieve RCE Summary of the CVE The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Missing Authorization via activateplugin Description The Square theme for WordPress is vulnerable to unauthorized plugin activation due to a missing capability check on the activateplugin function called via an AJAX action in versions up to, and including, 2.0.0...

CVE-2026-23550

🧨 CVE-2026-23550 – Contournement Admin Modular Connector Connexion administrateur WordPress non authentifiée via le paramètreorigin=mo Plugin Modular Connector ≤ 2.5.1 📖 Description Le plugin Modular Connector pour WordPress versions ≤ 2.5.1 contient une vulnérabilité critique de contournement...

CVE-2026-63030-CVE-2026-60137

wp2shell PoC RCE pré-authentification - CVE-2026-63030 + CVE-2026-60137 WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 Pour les tests d'intrusion et la recherche en sécurité autorisés uniquement. L'exécution de ceci contre des systèmes sans autorisation écrite est illégale. Les auteurs déclinent toute...

CVE-2026-63030

LANGZ — Outil d'exploitation wp2shell Auteur : LANGZ CVE : CVE-2026-63030 Chaîné avec CVE-2026-60137 Sévérité : Critique CVSS 9.8 Type : Exécution de code à distance pré-authentification RCE ⚠️ Avertissement Cet outil est fourni strictement à des fins éducatives et pour des tests de sécurité...

CVE-2025-14855-POC

CVE-2025-14855: SureForms WordPress Plugin Stored XSS Proof of Concept Target: WordPress Plugin "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Vulnerability Type: Stored Cross-Site Scripting XSS CVE: CVE-2025-14855 Refer:...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...