CVE-2025-3102

🔐 CVE-2025-3102 – Authentication Bypass in SureTriggers WordPress Plugin 🚨 CVE-2025-3102 is a critical authentication bypass vulnerability affecting the SureTriggers: All-in-One Automation Platform WordPress plugin, which is actively installed on over 100,000 websites. Due to the nature of the fl...

CVE-2017-9506

Proof of Concept SSRF & XSS https://jira.you.com//plugins/servlet/oauth/users/icon-uri?consumerUri=http://www.google.co.uk CVE-2017-9506 The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in a...

CVE-2015-4133

CVE-2015-4133 usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH wp-content/uploads sub...

-CVE-2026-7465

-CVE-2026-7465 CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit...

CVE-2026-5415

CVE-2026-5415 CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPress + Tutor LMS...

CVE-2026-8206

CVE-2026-8206 CVE-2026-8206 Kirki Plugin Unauthenticated Account Takeover Exploit...

CVE-2021-43798

Grafana CVE-2021-43798 Exploit Overview This repository demonstrates the exploitation of CVE-2021-43798, a directory traversal vulnerability in Grafana. This vulnerability allows attackers to read arbitrary files on the server. CVE Details CVE : CVE-2021-43798 Description : Directory traversal...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

CVE-2024-9932-POC

CVE-2024-9932-POC Description: The Wux Blog Editor WordPress plugin is vulnerable to arbitrary file uploads due to insufficient file type validation in the wuxbtinsertImageNew function. Versions up to and including 3.0.0 are affected. This vulnerability allows unauthenticated attackers to upload...

CVE-2026-19856

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

WordPress WPC Estimated Delivery Date for WooCommerce plugin <= 4.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPC Estimated Delivery Date for WooCommerce versions = 4.0.1...

CVE-2014-125130

The CodeArt Google MP3 Audio Player plugin for WordPress (versions through 1.0.11 ) is vulnerable to an unauthenticated arbitrary file read vulnerability. This flaw exists due to a path-traversal vulnerability in the file parameter of the direct_download.php file. Remote attackers can exploit thi...

EUVD-2026-91769

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...

CVE-2026-19856

The All in One SEO WordPress plugin versions prior to 5.0.2.1 contains a vulnerability where it fails to correctly identify which shortcodes are present in content derived from user input before stripping them. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on t...

CVE-2023-4596

CVE-2023-4596 PoC Script for CVE-2023-4596, unauthenticated Remote Command Execution through arbitrary file uploads. Video of PoC being used Nuclei Template News article WordFence NVD Nist Summary A critical vulnerability has been discovered in the WordPress plugin Forminator, which enables an...

CVE-2026-104854

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on ...