CVE-2024-56278

CVE-2024-56278 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WP Ultimate Exporter Vulnerable version ⚠️ Since the 'WP Ultimate Exporter' plugin is an addon for the 'WP Ultimate CSV Importer' plugin, both plugins need to be installed. 1. Create a new post using the code...

CVE-2026-1357

CVE-2026-1357 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-latest poc: /public/plugins/icon/../../../../../../../../../../../../../../../../../../etc/passwd GET /public/plugins/icon/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 Host: 127.0.0.1:3000...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE Unauthenticated arbitrary file upload leading to RCE in the Realtyna WPL / Organic IDX WordPress plugin real-estate-listing-realtyna-wpl ≤ 5.2.0. The plugin registers an "I/O service" on the public WordPress...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 is an Unauthenticated SQL Injection SQLi vulnerability affecting the WP Ticket Customer Support Ticket System & Helpdesk plugin for WordPress up to and including version 6.0.4.The flaw occurs because the plugin takes the WordPress search parameter s and concatenates it...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

CVE-2025-9286

CVE-2025-9286 Appy Pie Connect for WooCommerce = 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation ⚠️ Appy Pie Connect for WooCommerce = 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via resetuserpassword 📝 Description The Appy Pie Connect for WooCommerc...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution CVE-2026-13714 — WPL Real Estate Unauthenticated RCE Realtyna Organic IDX plugin + WPL Real Estate for WordPress 5.3.0 Unauthenticated arbitrary file upload via...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

CVE-2026-1357

CVE-2026-1357 -- WPvivid RCE Unauthenticated Remote Code Execution RCE in WPvivid Backup & Migration 800%2C000-brightgreen?style=for-the-badge" alt="Installs" Critical flaw impacting over 800,000–900,000+ WordPress sites Unauthenticated arbitrary PHP upload → full server compromise 🌩️ Overview...

CVE-2025-10147

CVE-2025-10147 Podlove Podcast Publisher = 4.2.6 - Unauthenticated Arbitrary File Upload The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'moveasoriginalfile' function in all versions up to, and including, 4.2.6...

GSSC-CVE-2022-41923

Workaround for CVE-2022-41923: Privilege Management Vulnerability Summary The vulnerability CVE-2022-41923 found in the unpatched Grails Spring Security Core GSSC plugin can result in improper privilege management. This repository describes how to work around the issue. If you are using an...

CVE-2023-29386

CVE-2023-29386 — Manager for Icomoon This README documents a disclosed vulnerability for educational and defensive use only. Donot run tests against production systems or systems you do not own or have explicit permission to test. Discovered by: deokhunKim Status: Public Disclosure Date Reported:...

cve-2016-10924-POC

CVE-2016-10924-POC This repository contains a Proof-of-Concept PoC exploit script for the Directory Traversal vulnerability CVE-2016-10924 found in the WordPress plugin ebook-download versions Note: This PoC is for educational and authorized testing purposes only. Misuse of this information can...

CVE-2024-1071-Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Go to the project : cd...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload 🚀 StoreKeeper for WooCommerce = 14.4.4 - Unauthenticated Arbitrary File Upload Exploit 📝 Description The StoreKeeper for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to...

CVE-2024-10586-Poc

Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - Authenticated Author+ Arbitrary File Read via Directory Traversal Description The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wpajaxnoprivshortcodeApiAdd Description The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary...