EUVD-2026-88812

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804

The Apache DolphinScheduler (versions before 3.4.3 ) is vulnerable to command injection in the Alert Script plugin . The root cause is the incorporation of the scriptPath parameter into a /bin/sh -c command without sufficient neutralization of shell metacharacters. An authenticated user can explo...

CVE-2025-25163-Nuclei-Template

Nuclei Template for CVE-2025-25163 🚀 Overview This repository features a Nuclei template specifically designed to detect the Path Traversal vulnerability CVE-2025-25163 in the Plugin A/B Image Optimizer for WordPress. This vulnerability poses a critical security risk, allowing unauthorized access...

CVE-2026-0740-mass

CVE-2026-0740 — Motor de Explotación Masiva Autor: 0xNuts Colaborador: Cursor Repositorio: https://github.com/ExDev994/CVE-2026-0740-mass PoC para CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Subida Arbitraria de Archivos sin Autenticación que puede llevar a RCE. La vulnerabilidad inicial f...

CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Unauthenticated SQL Injection via orderby Parameter Description The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2026-5718

CVE-2026-5718 CVE-2026-5718: Unauthenticated File Upload To RCE in DnD Upload CF7 Plugin CVE-2026-5718 — DnD CF7 File Upload RCE Scanner Plugin: Drag and Drop Multiple File Upload for Contact Form 7 Plugin Slug: drag-and-drop-multiple-file-upload-contact-form-7 CVE ID: CVE-2026-5718 CVSS Score: 8...

CVE-2024-27956-RCE

CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

CVE-2025-7441

CVE-2025-7441 StoryChief 1.0.42 - Arbitrary File Upload Vulnerability CVE-2025-7441 - Technical summary Affected component: StoryChief WordPress plugin Vulnerability type: Unauthenticated arbitrary file upload Vulnerable endpoint: /wp-json/storychief/webhook Root cause: The plugin accepts a JSON...

CVE-2026-5118

Divi Form Builder ⚠️ WARNING: This tool is for authorized penetration testing and security research only. Unauthorized access to computer systems is illegal. Use only on systems you own or have explicit written permission to test. More Disclaimer You can see the disclaimer on the cover of...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Vulnerability Type: Cross-Site Scripting XSS – Reflected XSS CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Severity: High CISA ADP CVSS v3.1: 7.1 Overview CVE-2026-9833 affects the Tag Groups – Advanced Way to...

WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WEBO MCP versions = 3.0.18...

CVE-2025-31486-Simulation

Vite Path Traversal Lab CVE-2025-31486 A hands-on, containerized lab environment to simulate and exploit the Path Traversal vulnerability in Vite's development server, identified as CVE-2025-31486. 📖 About The Vulnerability This lab demonstrates a significant Path Traversal vulnerability found in...

CVE-2026-4883

CVE-2026-4883: Piotnet Forms Pro = 2.1.40 - Unauthenticated Arbitrary File Upload → RCE The vulnerability stems from inadequate file type validation in the piotnetformsajaxformbuilder function. The plugin employs an incomplete extension blacklist blocking only php, phpt, php5, php7, and exe while...

CVE-2025-13486-POC

CVE-2025-13486 Proof of Concept A Proof of Concept PoC exploit for CVE-2025-13486, a Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin. Vulnerability Overview This vulnerability exists in ACFE versions 0.9.0.5 through 0.9.1.1, allowing unauthenticat...

CVE-2025-2011

CVE-2025-2011 - Depicter Plugin SQL Injection Vulnerability CVE Reference: CVE-2025-2011 This repository contains a proof-of-concept environment for testing the SQL injection vulnerability in Depicter Slider & Popup Builder plugin versions 3.6.2. Prerequisites Docker Docker Compose Python 3.x...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — Unauthenticated RCE via calluserfunc without Allowlist Vulnerability Summary Remote Code Execution RCE without authentication in the Avada Builder Fusion Builder plugin version = 3.15.2 used by the Avada WordPress theme — one of the most popular premium...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Subscriber + Arbitrary Plugin Installation Description A lack of capability checks and insufficient nonce check on the AJAX action in the plugin, made it possible for authenticated users to install arbitrary plugins on vulnerabl...