CVE-2026-14962

CVE-2026-14962 Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection ELEX WooCommerce Request a Quote WordPress plugin elex-request-a-quote ≤ 2.4.0 — unauthenticated SQL injection via the public elexraqaddtoquote AJAX action. For authorized testing only. Do not run this...

CVE-2024-50492

🚨 CVE-2024-50492 - ScottCart 🔥 Exploit Script for ScottCart 🧑‍💻 By Nxploit – Khaled Alenazi 📌 Description The ScottCart plugin for WordPress versions ≤ 1.1 is vulnerable to Remote Code Execution RCE. This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a...

PT-2026-90600

🚨 CVE-2026-85200 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw posts locator ajax info window loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on t...

CVE-2025-47646

CVE-2025-47646 PoC Unauthenticated Privilege Escalation exploit for WordPress PSW Front-end Login Registration Plugin ≤ 1.12 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-47646 , targeting a vulnerability in the WordPress PSW Front-end Login Registration Plugin ≤...

CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in a...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated...

CVE-2025-5781

FreePBX CVE-2025-57819 Exploit Description This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 CVE-2025-57819, allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-trigger...

CVE-2026-3891

🚀 CVE-2026-3891 – Pix for WooCommerce Unauthenticated File Upload RCE Proof‑of‑Concept exploit for CVE-2026-3891 – unauthenticated arbitrary file upload leading to remote code execution in the Pix for WooCommerce WordPress plugin ≤ 1.5.0. 📖 Overview CVE-2026-3891 is a critical vulnerability in th...

CVE-2026-15439

The GamiPress WordPress plugin (versions up to and including 7.9.7 ) is vulnerable to authenticated SQL injection via the q parameter in the wpForo integration AJAX action gamipress_wpforo_get_posts. The input is filtered only by $wpdb->esc_like() and interpolated directly into a single-quoted...

WordPress Simple Ajax Chat plugin <= 20260811 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HEI LAI SZE in WordPress Plugin Simple Ajax Chat versions = 20260811...

CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of...

js-jobs

js-jobs JS Job Manager 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation Description The jsjobsajax AJAX action of the plugin available to both authenticated and unauthenticated users does not have proper authorisation and CSRF checks, in particular when using the...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the...

CVE-2026-81825

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-19991

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-15462

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

CVE-2026-11496

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

hackazon

Hackazon Hackazon es un sitio de prueba vulnerable gratuito que es una tienda en línea construida con las mismas tecnologías utilizadas en las aplicaciones móviles y de cliente enriquecido actuales. Hackazon tiene una interfaz AJAX, flujos de trabajo estrictos y API RESTful utilizadas por una...