CVE-2025-13390

WP Directory Kit = 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover Summary The WP Directory Kit plugin for Wordpress version 1.4.4 and below contains an authentication bypass in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain...

Shiva

Shiva First of all, put Shiva on watch. I will be upgrading it to a full stress testing suite over time. Shiva is designed to perform Denial Of Service DOS attack on wordpress sites by loading all jquery scripts at once through load-scripts.php. So basically its an exploit for CVE-2018-6389...

CVE-2025-14124

CVE-2025-14124 WordPress Team Plugin - Unauthenticated SQL Injection Author: Hyun Chiya Vulnerability Information...

wordpress-cve-2018-6389

WordPress-CVE-2018-6389 WordPress Core - 'load-scripts.php' Denial of Service = 4.9.4 Date: 05/02/2018 Software Link: WordPress Version: = 4.9.4 Tested on: KaLi Linux 2018.1 CVE: CVE-2018-6389 Discovered by: Barak Tawily Exploit by: Javier Olmedo HOW TO USE? Clone this repository root@kitploit: g...

CVE-2025-24659

CVE-2025-24659 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Premium Packages – Sell Digital Products Securely Vulnerable version Since the Premium Packages plugin is an addon...

CVE-2019-9978-RCE-PoC

CVE-2019-9978 RCE PoC – Social Warfare WordPress Plugin Exploit Unauthenticated Remote File Inclusion RFI to Remote Code Execution RCE 📌 Description This repository contains a Python-based Proof of Concept PoC demonstrating the exploitation of CVE-2019-9978 , a critical vulnerability in the Socia...

CVE-2025-12973

S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Generador de Contenido e Imágenes = 1.7.7 - Autenticado Editor+ Subida Arbitraria de Archivos El complemento S2B AI Assistant de WordPress versiones 2.47 y anteriores contiene una vulnerabilidad de subida arbitraria de archivos que permite a usuarios...

everest-backup-cve-2025-11380

CVE-2025-11380 Proof of concept code for CVE-2025-11380 - unauthenticated backup access in Everest Backup WordPress plugin. Blog post link coming soon...

Mass-CVE-2023-28121-kdoec

CVE-2023-28121 WooCommerce Payments 5.6.2 - Unauthenticated Privilege Escalation Mass Add Admin User How to use This script using Python3. Install requirements pip install -r requirements.txt Reference https://wpscan.com/vulnerability/0f78a245-866c-462e-bd23-43dfadb57072...

CVE-2023-32243

CVE-2023-32243 Essential Addons for Elementor - Unauthorized Account Takeover. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2025-3102

🔐 CVE-2025-3102 – Omisión de Autenticación en el Plugin SureTriggers de WordPress 🚨 CVE-2025-3102 es una vulnerabilidad crítica de omisión de autenticación que afecta al plugin de WordPress SureTriggers: All-in-One Automation Platform , el cual está instalado activamente en más de 100,000 sitios...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

CVE-2022-29455

CVE-2022-29455 Mass Scanner for CVE-2022-29455 on Elementor Plugins Wordpress Usage : python cve-2022-29455 list.txt threads...

CVE-2024-38793-PoC

CVE-2024-38793-PoC Proof of Concept code for exploitation of CVE-2024-38793 Best Restaurant Menu by PriceListo = 1.4.1 - Authenticated Contributor+ SQL Injection. Proof Of Concept This is a proof of concept exploit for the vulnerability CVE-2024-38793, an SQL injection vulnerability for versions ...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2025-14736

CVE-2025-14736 Frontend Admin by DynamiApps - Unauthenticated Privilege Escalation Author: Hyun Chiya Vulnerability Information Field| Value ---|--- CVE ID| CVE-2025-14736 Plugin| Frontend Admin by DynamiApps Affected Versions| B"Extract Nonce acfnonce & Form ID acfform" B -- C"Construct POST...

CVE-2025-13380

AI Engine for WordPress: ChatGPT, GPT Content Generator = 1.0.1 - Authenticated Contributor+ Arbitrary File Read The AI Engine for WordPress plugin contains a vulnerability in its image insertion feature that allows any authenticated user with post editing capabilities Contributor, Author, Editor...

wordpress-cve-2024-10924-exploit

WordPress CVE-2024-10924 Exploit 📌 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2024-10924, a vulnerability in the Really Simple SSL WordPress plugin that allows bypassing two-factor authentication 2FA. Attackers can exploit this flaw to log in as any user with a valid...