WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Zein in WordPress Plugin Social Rocket versions = 1.3.5...

CVE-2025-2005

CVE-2025-2005 WordPress Front End Users Plugin = 3.2.32 is vulnerable to Arbitrary File Upload WordPress Front-End Users Plugin Exploit Vulnerability Information Plugin Name : Front-End Users Plugin Version Affected : = 3.2.32 Vulnerability Type : Arbitrary File Upload CVSS Score : 10 Critical Ri...

WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ListingPro versions = 2.9.12...

cve-2026-63030-lab

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection Overview wp2shell is a chain of two independently low-severity bugs in WordPress core that, when combined, allow an unauthenticated remote attacker to: 1. Reach an SQL injecti...

Wordpress-CVE-2020-35749

Exploit de la vulnerabilidad LFI del Plugin Simple Job Board de Wordpress 2.9.3 CVE-2020-35749 Resumen El Plugin Simple Job Board de WordPress es propenso a una vulnerabilidad de recorrido de directorios porque no verifica suficientemente la entrada proporcionada por el usuario. La explotación de...

CVE-2026-14894

CVE-2026-14894 Arbitrary File Upload Nxploited Mass Exploiter — Super Forms & Elementor Pro 🩸 Join our Telegram for the latest exclusive 0-days & weaponized CVEs 📡 Channel: https://t.me/KNxploited 👤 Nxploited | @Kxploit A high-speed, multi-threaded mass exploiter that chains two unauthenticated...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

-CVE-2022-1609

CVE-2022-1609 Bash poc for CVE-2022-1609 WordPress Weblizar Backdoor How to install ? wget https://raw.githubusercontent.com/0xSojalSec/CVE-2022-1609/main/exploit.sh chmod +x exploit.sh ./exploit.sh How to use it ? GH0ST3exP10it$ ./exploit.sh http://127.0.0.1:8080 + Targeting http://127.0.0.1:808...

CVE-2025-5394

🚨 CVE-2025-5394 - Unauthenticated Arbitrary Plugin Upload in Alone Theme 📌 Affected Product: Alone – Charity Multipurpose Non-profit WordPress Theme Versions: 🚀 Example Usage: python3 CVE-2025-5394.py -help usage: CVE-2025-5394.py...

CVE-2026-32488

CVE-2026-32488 CVE-2026-32488 Nonce değerini değişkene al $NONCE = "c82a4f80ba" curl.exe -s -X POST "http://localhost/wp-admin/admin-ajax.php" -d "action=userregistrationuserformsubmit" -d "urfrontendformnonce=$NONCE" -d "formid=6" -d...

WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SafeSnap – Verified WordPress Backup & Restore versions = 2.1.2...

WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Museder RestoreOne versions = 2.7.276...

WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Norvis Backup versions = 1.1.0...

WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sitemovr versions = 1.0.1...

WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Snapshotify All-in-One Backup & Restore & Migrate versions = 1.3.2...

WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Tourfic Pro versions = 1.17.3...

tvsz

CVE-2018-6389 PoC node js multisite with proxy This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time. !!! IMPORTANT BEFORE YOU CONTINUE !!!...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / Exploit Script: CVE-2026-2631.py Author: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub Contact: Telegram: @Kxploit 🧬 Vulnerability Overview Plugin: Datalogics Ecommerce Delivery – Datalogics WordPress Affected Versions: 2.6.60...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...