CVE-2025-13486-POC

CVE-2025-13486 Proof of Concept A Proof of Concept PoC exploit for CVE-2025-13486, a Remote Code Execution vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin. Vulnerability Overview This vulnerability exists in ACFE versions 0.9.0.5 through 0.9.1.1, allowing unauthenticat...

CVE-2026-6279

CVE-2026-6279 Avada Builder = 3.15.2 — Unauthenticated RCE via calluserfunc without Allowlist Vulnerability Summary Remote Code Execution RCE without authentication in the Avada Builder Fusion Builder plugin version = 3.15.2 used by the Avada WordPress theme — one of the most popular premium...

WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BackupEase versions = 2.2.2...

WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteSkite versions = 2.1.8...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder ≤ 5.1.2 Unauthenticated Privilege Escalation via Role Injection === Beelze zeroday 1diot9 === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-5118 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-269 —...

CVE-2025-31864

CVE-2025-31864 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Beam me up Scotty – Back to Top Button Vulnerable version = 1.0.23 Component slug beam-me-up-scotty Component link https://wordpress.org/plugins/beam-me-up-scotty/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3:...

WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MCP Content Manager Lite versions = 1.1.0...

2026-11551

2026-11551 CVE-2026-11551: Branda Plugin - Unauthenticated Privilege Escalation via Account Takeover...

Exposure Of Data Element To Wrong Session

org.apache.struts, struts2-json-plugin is vulnerable to an exposure of data element to wrong session. The vulnerability is due to per-request JSON parsing state being shared across concurrent requests, which allows an attacker to potentially observe data associated with another request and bypass...

CVE-2026-59550

CVE-2026-59550 - AWP Classifieds ≤ 4.4.7 inyección SQL no autenticada Inyección SQL ciega basada en tiempo no autenticada en el plugin de WordPress AWP Classifieds another-wordpress-classifieds-plugin, accesible a través del flujo anónimo invitado de envío de anuncios por AJAX del plugin. | ---|-...

CVE-2026-8181

CVE-2026-8181 exploit Burst Statistics WordPress Plugin — Authentication Bypass to Administrator Privilege Escalation Exploit for the CVE-2026-8181 discovered by Chloe Chamberland and PRISM. ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author...

CVE-2025-39401

CVE-2025-39401 WordPress WPAMS Plugin El plugin WPAMS de WordPress CVE: CVE-2025-39401 Puntuación base: 10.0 CRÍTICO La vulnerabilidad de carga sin restricciones de archivos con tipo peligroso en mojoomla WPAMS permite a los atacantes subir una web shell al servidor, lo que conduce a un compromis...

CVE-2025-12539

CVE-2025-12539 TNC Toolbox: Web Performance = 1.4.2 - Exposición de Información Sensible No Autenticada que deriva en Escalada de Privilegios / Toma de Control de Cuenta de cPanel 🚨 TNC Toolbox: Web Performance = 1.4.2 - Exposición de Información Sensible No Autenticada que deriva en Escalada de...

CVE-2026-14894

CVE-2026-14894 — Super Forms Unauthenticated File Upload RCE Nonce Leak → datauristring Upload → Code Execution Overview CVE-2026-14894 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin by WebRehab...

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit Unauthenticated Admin Takeover | CVSS 9.8 | Ready to use 🔥 What you get Fully working Python exploit for CVE-2026-8732 Unauthenticated administrator account creation Returns magic login URL – instant site takeover Works against WP Maps Pro ≤ 6.1.0...

struts2-rce

Exploit Demo for CVE-2017-5638 Completely based on https://github.com/piesecurity/apache-struts2-CVE-2017-5638 A realistic scenario where a reference project for a framework is deployed on a container but with terrible consequences. To familiarise yourself look at the code and compile it. Also...

stylesmuggler-adobe-patches

disrex/stylesmuggler-adobe-patches Un plugin de Composer que aplica el parche oficial APSB26-146 de Adobe CVE-2026-75650, referencia interna VULN-39341 para el zero-day StyleSmuggler en Magento Open Source y Mage-OS , automáticamente, detectando tu versión instalada. Parchea los paquetes instalad...

ptxNinja

ptxNinja Autor : Nicolò Altamura Explora código PTX a través de Binary Ninja Descripción ptxNinja es un plugin de arquitectura para Binary Ninja orientado a PTX, el lenguaje para la arquitectura virtual de la GPU basada en CUDA. Esto te permite: explorar binarios PTX integrando análisis ya...

CVE-2026-5229

CVE-2026-5229 CVE-2026-5229: Form Notify Auth Bypass via LINE OAuth Callback CVSS 9.8 Form Notify — LINE OAuth Authentication Bypass Scanner Plugin: Form Notify form-notify Vulnerability Type: Unauthenticated LINE OAuth Authentication Bypass → Account Takeover CVSS Score: 9.8 Critical CVSS Vector...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...