CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory = 1.0.0 — Divulgación no autenticada de PII de miembros a través de la API REST 📖 Resumen del Aviso CVE-2026-13736 es una vulnerabilidad de divulgación no autenticada de Información Personal Identificable PII de miembros que afect...

CVE-2025-55449

CVE-2025-55449 - Vulnerabilidad de Ejecución Remota de Código RCE en AstrBot Resumen Este repositorio contiene un exploit de prueba de concepto para CVE-2025-55449 , una vulnerabilidad crítica de Ejecución Remota de Código RCE en AstrBot. La vulnerabilidad permite a un atacante ejecutar código...

WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Asim Alshaya in WordPress Plugin FluentBoards versions = 2.0.12...

CVE-2024-27956-RCE-File-Package

CVE-2024-27956-RCE File Package Contents: 1. exploit.py Original Creator:https://GitHub.com/diego-tella 2. modifiedexploit.py Modified with an ignore ssl verification option 3. Screenshot 4. wpValvePressplugin.py Python script using URI parameters to search for vulnerable wp plugin...

CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQL Injection via sortf Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-42647, an unauthenticated SQL injection vulnerability affecting the WordPress plugin JoomSport - for Sports: Te...

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin eCommerce Product Catalog versions = 3.6.0...

CVE-2025-6440-Poc-Exploit

WC Designer Pro — Unauthenticated Arbitrary File Upload Security Research Proof of Concept A non-destructive proof of concept for an unauthenticated arbitrary file-upload vulnerability affecting the WC Designer Pro WordPress plugin. Table of Contents Vulnerability Overview Security Impact Affecte...

jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25

Script Security Plugin User’s guide adapted from information on Template plugin in CloudBees Plugins guide Various Jenkins plugins require that users define custom scripts, most commonly in the Groovy language, to customize Jenkins’s behavior. If everyone who writes these scripts is a Jenkins...

CVE-2023-4294

CVE ID : CVE-2023-4294 Vulnerability Type : Cross-Site Scripting Description : The URL Shortify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the referrer header in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes ...

CVE-2018-17254

CVE-2018-17254 Exploit Title: Joomla JCK Editor 6.4.4 - 'parent' SQL Injection Googke Dork: inurl:/plugins/editors/jckeditor/plugins/jtreelink/ Vendor Homepage: http://docs.arkextensions.com/downloads/jck-editor Version: 6.4.4 Tested on: Debian 10 Ubuntu Windows 11/10 CVE : CVE-2018-17254 PHP...

CVE-2024-25600

CVE-2024-25600 Unauthenticated Remote Code Execution – Bricks Usage: python3 bricks.py Example: python3 bricks.py https://example.org reference: https://github.com/Chocapikk/CVE-2024-25600...

By-Poloss..-..CVE-2017-20251

CVE-2017-20251: Insert PHP Plugin PHP Code Injection Vulnerability Title Unauthenticated PHP Code Injection via Shortcode Processing in Insert PHP Plugin Basic Information Field| Value ---|--- CVE ID| CVE-2017-20251 Plugin| Insert PHP now Woody Code Snippets Affected Versions| 3.3.1 tested on 1.3...

CVE-2025-6440

CVE-2025-6440 — WordPress WooCommerce Dynamic Pricing & Discounts Plugin Overview This repository contains a Python proof-of-concept PoC script for testing an unauthenticated file upload vulnerability affecting the WordPress WooCommerce Dynamic Pricing & Discounts plugin. ⚠️ This project is...

CVE-2023-6553-RCE-Exploit

🔥 CVE-2023-6553 — WordPress Backup Migration RCE Unauthenticated Remote Code Execution via PHP Filter Chain Proof of Concept exploit for CVE-2023-6553 — a critical unauthenticated RCE vulnerability in the WordPress "Backup Migration" plugin versions ≤ 1.3.7. 📋 Vulnerability Overview Property|...

CVE-2026-2991

KiviCare = 4.1.2 - Bypass de autenticación CVE-2026-2991 PoC 📜 Descripción CVE-2026-2991 es una vulnerabilidad de bypass de autenticación en el plugin de WordPress KiviCare – Clinic & Patient Management System EHR que afecta a todas las versiones hasta la 4.1.2 inclusive. El plugin expone un...

CVE-2026-4885

CVE-2026-4885 Piotnet Addons for Elementor Pro Note: The exploit can only be triggered if a file field is added to the Piotnet form. INFO : CVE-2026-4885 CVSS Score : 9.8 Critical CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Versions : = 7.1.70 Patched : No patch available...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses = 3.2.21 - Autorización faltante para usuarios autenticados Suscriptor+ que permite la actualización arbitraria de metadatos de usuario Descripción El plugin WP Courses LMS – Online...

CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Privilege Escalation to Administrator | ---|--- Product| Events Manager WordPress plugin Affected versions| 7.1.0 – 7.4.0.x Fixed version| 7.4.1 Weakness| CWE-269: Improper Privilege Management Severity| CVSS 3.1: 9.8 Critical —...

CVE-2026-15964-PoC

CVE-2026-15964 - Single Sign On For TNG = 2.0.0 Escalada de privilegios no autenticada mediante cambio de contraseña no verificado en el plugin de WordPress Single Sign On For TNG. | ---|--- Gravedad| Crítico 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-620 Cambio de contraseña no...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...