CVE-2025-22783

CVE-2025-22783 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Component name Plugin SEO de Squirrly SEO Vulnerable version = 12.4.01 Component slug squirrly-seo Component link https://wordpress.org/plugins/squirrly-seo/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3:...

ipyida

= IPyIDA IPyIDA es una solución basada únicamente en Python para añadir una consola de IPython a IDA Pro. Usa para abrir una ventana con una consola Qt integrada. Así podrás beneficiarte del autocompletado de IPython, la ayuda en línea, el campo de entrada con fuente monoespaciada, los gráficos,...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BP Better Messages versions = 3.0.4...

CVE-2019-9978_Exploit

CVE-2019-9978 Exploit Social WarFare Plugin =3.5.2 Remote Code Execution...

CVE-2025-4190

CVE-2025-4190 — CSV Mass Importer de WordPress ≤ 1.2 Carga Arbitraria de Archivos -purple 📌 Descripción El plugin CSV Mass Importer ≤ 1.2 para WordPress contiene una vulnerabilidad de Carga Arbitraria de Archivos para Admin+. Debido a una validación incorrecta de los archivos subidos, los usuario...

CVE-2016-10956-mail-masta

Mail Masta - Local File Read CVE-2016-10956 The mail-masta plugin 1.0 for WordPress has local file read in countofsend.php and csvexport.php. Usage root@kitploit: $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage: CVE-2016-10956mailmasta.py -h -v -s -t TARGETUR...

peda

peda PEDA - GDB 的 Python 漏洞利用开发辅助工具 主要特性： 增强 gdb 显示效果：调试期间为反汇编代码、寄存器、内存信息增加颜色和格式显示。 添加支持调试和漏洞利用开发的命令（完整命令列表请使用 peda help）： aslr -- 显示/设置 GDB 的 ASLR 设置 checksec -- 检查二进制文件的各种安全选项 dumpargs -- 在调用指令处停下时显示传递给函数的参数 dumprop -- 转储特定内存范围内的所有 ROP 小工具 elfheader -- 获取被调试 ELF 文件的头部信息 elfsymbol -- 从 ELF...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage root@kitploit: git clone...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass CVSS 9.8 Critical — Authentication Bypass to Admin Account Takeover Description CVE-2026-8181 is an Authentication Bypass vulnerability in the Burst Statistics WordPress plugin version 3.4.0 to 3.4.1.1. This plugin is used by 200,000+ WordPre...

CVE-2024-3105-PoC

CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

CVE-2024-9162

CVE-2024-9162 All-in-One WP Migration and Backup = 7.86 - Authenticated Administrator+ Arbitrary PHP Code Injection The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and...

CVE-2026-13158

CVE-2026-13158: Everest Toolkit = 1.2.3 — Carga Arbitraria de Archivos con privilegios de Admin+ que deriva en Ejecución Remota de Código RCE 📖 Resumen del Aviso CVE-2026-13158 es una vulnerabilidad autenticada de carga arbitraria de archivos Admin+ que afecta al plugin de WordPress Everest Toolk...

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2024-0757-Exploit

CVE-2024-0757 Exploit Description The Insert or Embed Articulate Content into WordPress plugin for WordPress is vulnerable to arbitrary file uploads through insecure file uploads in a zip archive in all versions up to, and including, 4.3000000023. This makes it possible for unauthenticated...

CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration !IMPORTANT Resumen: Se descubrió una vulnerabilidad de Falsificación de Solicitudes entre Sitios CSRF de severidad alta CVE-2026-13156 en el plugin oficial MailerSend SMTP Integration para WordPress 1.0.8. El manejador de eliminación de...

CVE-2019-14314

CVE-2019-14314 CVE-2019-14314 - NextGEN Gallery 3.2.10 Authenticated SQL Injection Usage root@kitploit: usage: cve201914314.py -h url loginuser loginpass username CVE-2019-14314 Hash Extractor positional arguments: url Wordpress blog URL loginuser Username to login with loginpass Password to logi...

fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap root@kitploit: Ask Bing DuckDuck GO UOL Yahoo Install root@kitploit: git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using...

CVE-2025-6934

CVE-2025-6934 – Explotación de WordPress Opal Estate Pro 📖 Descripción Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2025-6934 , una vulnerabilidad crítica en el Plugin de WordPress: Opal Estate Pro = 1.7.5, que permite la creación de cuentas de administrador sin...

setup-wordpress-with-security-best-practice

Setup WordPress With Security Best Practice This document is written with the aim of being suitable for web applications developed using WordPress that do not interact with users. It is primarily intended for corporate brand pages, various static views, recruitment pages, and similar sites. For...

SSCMS-PluginShell

Install Visual Studio 2. Import this project 3. Modify the IPAddress.Parse value in the Startup.cs file root@kitploit: using Microsoft.Extensions.DependencyInjection; using SSCMS.Advertisement.Abstractions; using SSCMS.Advertisement.Core; using SSCMS.Plugins; using System.Diagnostics; using...