CVE-2025-4396

CVE-2025-4396 — Inyección SQL en Relevanssi Ciega Basada en Tiempo Descargo de responsabilidad: Este repositorio está destinado únicamente a pruebas de penetración autorizadas, investigación de seguridad y fines educativos. El acceso no autorizado a sistemas informáticos es ilegal y poco ético...

WordPress-Path-Traversal-CVE-2019-11447

Penetration Test Report WordPress Path Traversal - CVE-2019-11447 Document Information...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate Unauthenticated RCE -red.svg Critical Unauthenticated Remote Code Execution CVSS 10.0 — Realtyna Organic IDX + WPL Real Estate ≤ 5.2.0 This tool exploits CVE-2026-57811 , a critical vulnerability in the Realtyna Organic IDX + WPL Real Estate...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — Documented, reproducible-in-Docker proof of concept Unauthenticated second-order SQL injection in All-in-One WP Migration and Backup WordPress that escalates to leaking the ai1wmsecretkey and, with it, to remote code execution RCE. Read this in: English · Español...

CVE-2022-4140

CVE-2022-4140 - WordPress plugin Welcart e-Commerce 2.8.5 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2022-4140. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own ...

CVE-2026-8732-PoC

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation English | Türkçe English Overview CVE-2026-8732 is a critical vulnerability CVSS 9.8 in the WP Maps Pro wp-google-map-gold WordPress plugin version = 6.1.0. Unauthenticated attackers can create WordPress administrator accounts by abusing...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 es una vulnerabilidad crítica de inyección de objetos PHP no autenticada con CVSS 9.8 en el plugin Everest Forms de WordPress CVE-2026-3296 — Escáner de Inyección de Objetos PHP en Everest Forms Plugin: Everest Forms – Formulario de contacto, formulario de pago,...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF a Sobrescritura Arbitraria de Archivos en el Plugin Optimole de WordPress Resumen Una vulnerabilidad de Cross-Site Request Forgery CSRF en el plugin Optimole para WordPress versiones = 4.2.5 permite a atacantes no autenticados sobrescribir silenciosamente activos existentes d...

wp2shell-vulnerability-scanner

WP2Shell Scanner Una herramienta de auditoría de seguridad de solo lectura y no destructiva que escanea instalaciones de WordPress en busca de la cadena de vulnerabilidades wp2shell. Resumen WP2Shell Scanner es una utilidad bash que busca recursivamente en un árbol de directorios instalaciones de...

Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

Acyber Wordpress 插件 !WARNING 针对 CVE-2026-60137 和 CVE-2026-63030 wp2shell 的临时紧急缓解措施 针对 wp2shell 漏洞链的临时紧急风险缓解措施 🇬🇧 英文说明 这个轻量级 WordPress 插件可作为针对关键的 wp2shell 漏洞利用链（CVE-2026-60137 和 CVE-2026-63030 ）的临时虚拟补丁（缓解措施）。 该漏洞利用链允许攻击者在未经身份验证的情况下，在标准 WordPress 安装（6.9 及以上版本）上实现远程代码执行（RCE）。 工作原理： 1. 严格净化： 它会拦截...

wordpress-rce-vapt-cve-2020-25213

WordPress: Explotación y Mitigación de RCE CVE-2020-25213 📌 Resumen del Proyecto Este proyecto fue desarrollado como parte del módulo IE4012 – Tácticas y Estrategias de Hacking Ofensivo. Demuestra un ciclo de vida completo de un ataque cibernético en un entorno de laboratorio controlado,...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...