CVE-2024-43917

CVE-2024-43917 A proof of concept developed to exploit CVE-2024-43917. Based on PatchStack's article. Usage usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wis...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2024-50483

CVE-2024-50483 Meetup = 0.1 - Authentication Bypass via Account Takeover Description: The Meetup plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them v...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Subscriber+ Arbitrary Options Update Description The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a...

CVE-2022-29455

CVE-2022-29455 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Vulnerable Version = 3.5.5 versions Proof of Concept Exploit https://add your target...

CVE-2023-3460_POC

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. Made with Golang ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ DISCLAIMER ║ ║ ABOUT THE PROJECT ║ ║ ║ ║ ║ ║ This Proof of Concept PoC has...

EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

CVE-2026-92536 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...

CVE-2024-24135

CVE-2024-24135: Product Inventory with Export to Excel - Cross-Site-Scripting Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24135.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24135/blob/main/CVE-2024-24135.md...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Proof of Concept This is a proof of concept PoC exploit for CVE-2023-3124, a vulnerability in WordPress Elementor Pro plugin. Description: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the...

CVE-2024-49668

🚨 CVE-2024-49668: WordPress Verbalize WP Plugin Arbitrary File Upload Vulnerability 📋 Overview CVE-2024-49668 is a critical vulnerability in the WordPress Verbalize WP plugin versions 1.0 and below. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shell...

WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution

WordPress Contact Form 7 before 1.3.3.3 allows unrestricted file upload and remote code execution by setting supportedtype to php% and uploading a .php% file. id: CVE-2020-12800 info: name: WordPress Contact Form 7 1.3.3.3 - Remote Code Execution author: dwisiswant0 severity: critical description...

WP Fastest Cache 1.2.2 - SQL Injection

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. id: CVE-2023-6063 info: name: WP Fastest Cache 1.2.2 - SQL Injection author: DhiyaneshDK...