CVE-2023-6360

CVE-2023-6360 Analysis Report Overview CVE-2023-6360 is an SQL injection vulnerability found in a specific WordPress plugin, allowing an attacker to exploit security weaknesses in the web application to inject malicious SQL code into the database. This can lead to serious security issues such as...

CVE-2022-3689

CVE-2022-3689 Analysis Report Overview CVE-2022-3689 is an SQL injection vulnerability found in a specific WordPress plugin, which allows an attacker to exploit security vulnerabilities in web applications to insert malicious SQL code into the database. This can lead to serious security issues su...

cve-2026-15748

CVE-2026-15748 — Forminator Security Scanner A Python-based security research and vulnerability assessment scanner for identifying WordPress installations that use the Forminator plugin and assessing version-related exposure. For Educational & Authorized Testing Only Run this project only against...

CVE-2025-3616

Metasploit Module: Greenshift WordPress Plugin Arbitrary File Upload CVE-2025-3616 This repository contains a Metasploit module to exploit CVE-2025-3616 , an arbitrary file upload vulnerability in the Greenshift WordPress plugin versions 11.4 through 11.4.5. The exploit allows authenticated users...

cve-2023-1874

CVE-2023-1874 Disclaimer THIS SCRIPT IS DESIGNED FOR WHITE HAT AND EDUCATIONAL PURPOSES ONLY. ANY USE OF THIS AGAINST A DEVICE YOU ARE NOT AUTHORIZED TO TEST ON OR DO NOT OWN IS YOUR OWN RESPONSIBILITY. THE AUTHOR OF THIS SCRIPT TAKES NO RESPONSIBILITY FOR ANYTHING YOU DO WITH THIS SCRIPT. YOUR...

CVE-2025-54726

CVE-2025-54726 JS Archive List = 6.1.5 - Unauthenticated SQL Injection Description The JS Archive List plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2025-2294

CVE-2025-2294 Introduction CVE-2025-2294 is a critical Local File Inclusion LFI vulnerability in the Kubio AI Page Builder plugin for WordPress. The vulnerability allows an unauthenticated remote attacker to pass a specially crafted parameter, causing the plugin to include an arbitrary file on th...

PoC---CVE-2018-6389

PoC - CVE-2018-6389 Proof of Concept of vunerability CVE-2018-6389 on Wordpress 4.9.2...

Wordpress-Vulnerability-Identification-Scripts

Wordpress-Vulnerability-Identification-Scripts Identifies domains which run WordPress and tests against vulnerabilities CVE-2023-32243 / VU76395 / etc... wpidentifier.py === Input: File containing list of domains / sub-domains Output: List of domains hosting WordPress application CVE-2023-32243 =...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Leveraging the shell once...

CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read

CVE-2025-2539 - File Away WordPress Plugin Arbitrary File Read 📋 Executive Summary CVE ID: CVE-2025-2539 Plugin: File Away Versions = 3.9.9.0.1 Vulnerability Type: Authenticated Arbitrary File Read CVSS Score: 8.5 High Exploit Availability: Public PoC Available Impact: Unauthorized file disclosur...

CVE-2015-4133

CVE-2015-4133 root@kitploit: usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH...

CVE-2024-43917

CVE-2024-43917 A proof of concept developed to exploit CVE-2024-43917. Based on PatchStack's article. Usage root@kitploit: usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share...

CVE-2023-28121

CVE-2023-28121 root@kitploit: usage: CVE-2023-28121.py -h -v RHOST RPORT WooCommerce Payments WordPress plugin = 5.6.1 CVE-2023-28121 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28121 positional arguments: RHOST remote host RPORT remote port optional arguments: -h, --help show this...

CVE-2025-4094

CVE-2025-4094 – WordPress Digits Plugin This method...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache Targets versions ≤2.7.5 vulnerable to CVE-2023-5359 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS =...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 Remote code execution running on w3 total cache cve 2013-2010 Usage: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" Output: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import request...

demo-CVE-2021-29447-lezione

POC CVE-2021029447 - XXE in WordPress WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 https://vulners.com/cve/CVE-2021-29447 Using Step1. Run WordPress root@kitploit: $ make up-wp Step2. Run Attacker web server root@kitploit: $ make up-mal Step3. Generate malicious WAV file With...

wpBullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation...

CVE-2015-6668

CVE-2015-6668 - Job Manager IDOR A small Rust CLI that reproduces the information-disclosure pattern associated with CVE-2015-6668 Job Manager //filename.ext. Attack pattern: brute-force / enumerate common year/month folders and filename variants to locate accessible files. Indicators: HTTP 200...