CVE-2021-24356

CVE-2021-24356 Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Subscriber + Arbitrary Plugin Installation Description A lack of capability checks and insufficient nonce check on the AJAX action in the plugin, made it possible for authenticated users to install arbitrary plugins on vulnerabl...

CVE-2026-86802

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2022-0739

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit, based on destr4ct's POC - just prettier. Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress with a vulnerable bookingpress plugin version 1.0.10. root@kitploit: python booking-sqlinjector.py -u...

CVE-2025-2539

CVE-2025-2539 - WordPress File Away = 3.9.9.0.1 - Arbitrary File Read 🔥 Vulnerability Summary The WordPress plugin File Away version = 3.9.9.0.1 is vulnerable to an unauthenticated arbitrary file read vulnerability. This allows attackers to read any file on the server, such as wp-config.php,...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2025-6934

CVE-2025-6934 unauthenticated privilege escalation in opal estate pro Description CVE-2025-6934 is a critical vulnerability in the Opal Estate Pro WordPress plugin ≤ v1.7.5. This bug allows an unauthenticated attacker to create a new administrator account by sending a crafted request to:...

CVE-2024-25600-Bricks-Builder-plugin-for-WordPress

CVE-2024-25600 Exploit Tool 🚀 Description 📝 This tool 🛠️ is designed to exploit the CVE-2024-25600 vulnerability 🕳️ found in the Bricks Builder plugin for WordPress. The vulnerability allows for unauthenticated remote code execution on affected websites 💻. The tool automates the exploitation...

CVE-2026-32488

CVE-2026-32488 CVE-2026-32488 Nonce değerini değişkene al $NONCE = "c82a4f80ba" curl.exe -s -X POST "http://localhost/wp-admin/admin-ajax.php" -d "action=userregistrationuserformsubmit" -d "urfrontendformnonce=$NONCE" -d "formid=6" -d...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

HT Mega < 3.0.7 - Sensitive Information Disclosure

The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation. id: CVE-2026-4106 info: name: HT Mega 3.0.7 - Sensitive Information Disclosure author: EFETR severity: high description: |...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE

CVE Writeups for CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 root@kitploit: -------------- CVE-2025-67586 Exploit PoC -------------- Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control Software Link: https://wordpress.org/plugins/highlight-and-share/ Version: Description A broken...

CVE-2023-6036

CVE-2023-6036 POC about Wordpress plugin Web3 – Crypto wallet Login & NFT token gating 3.0.0 - Authentication Bypass This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handleloginrequest’ function and ‘handleauthrequest' function Vulnerability I have...

CVE-2025-10377

Proof of Concept CVE-2025-10377 Cross-Site Request Forgery CSRF in Plugin System Dashboard Funtion sdtogglelogs Vulnerability Type: Cross-Site Request Forgery CSRF Affected Function: sdtogglelogs CVSS v3.1: 4.3 Medium Vector: AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N Note: Score reflects unauthorized...

CVE-2026-8732

⚔️ CVE-2026-8732 WP Maps Pro ≤ 6.1.0 — Unauthenticated Privilege Escalation 8-Fase Automasi Eksploitasi | Multiprocessing + Asyncio | Admin Creation Terverifikasi 🎯 Tentang Kerentanan Plugin WordPress WP Maps Pro versi ≤ 6.1.0 memiliki kerentanan eskalasi hak istimewa tanpa autentikasi. Penyerang...

rcno-reviews

Recencio Book Reviews A WordPress plugin for managing and displaying book reviews. Custom post type, 7 taxonomies, 13 shortcodes, 7 widgets, 6 templates, 5 extensions. All data stored in standard WordPress post meta — no custom tables. Background Recencio Book Reviews was created by Kemory Grubb...

CVE-2026-8732

CVE-2026-8732 — WP Maps Pro ≤ 6.1.0 ♡ Unauthenticated Privilege Escalation via Administrator Account Creation ♡ === shadow ♡ & friska === 📋 Vulnerability Info Field| Details ---|--- CVE ID| CVE-2026-8732 CVSS Score| 9.8 Critical CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type|...

EUVD-2026-83674

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...

CVE-2026-92410 Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability...