CVE-2022-0739

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit, based on destr4ct's POC - just prettier. Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress with a vulnerable bookingpress plugin version 1.0.10. python booking-sqlinjector.py -u http://metapress.htb -nu...

CVE-2025-11986

1 Extract the public cryptoajax nonce from the restricted page UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' NONCE=$curl -s "http://localhost/wordpress/" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

CVE-2025-11627

Send a crafted request to the AJAX handler with the extracted nonce. = // 1 find the inline script that contains the AJAX URL const s = ...document.scripts.findsc = sc.textContent.includes'billminozzijserrorcatched'; if !s console.error'Script with ajax URL not found. Is wphead present?'; return;...

CVE-2025-11988

1 Extract the public cryptoajax nonce UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

WordPress Bricks Builder Theme - RCE

Exploit Title: WordPress Bricks Builder Theme - RCE Date: 2026-06-25 Exploit Author: Jared Brits K3ysTr0K3R Vendor Homepage: https://bricksbuilder.io/ Software Link: https://bricksbuilder.io/ Version: Bricks Builder Hello, Friend!" print"" h...

Exploit for CVE-2026-5118

Divi Form Builder ⚠️ WARNING: This tool is for authorized p...

📄 WordPress Real Estate 7 3.5.2 Privilege Escalation

This Metasploit auxiliary scanner module targets a privilege escalation vulnerability in WordPress Real Estate 7 plugin version 3.5.2. The flaw allows unauthenticated attackers to register a new user account with administrator privileges by abusing the ctaddnewmember AJAX action...

Exploit for Missing Authorization in Themepunch Slider_Revolution

CVE-2024-34444 - Slider Revolution Missing Authorization Scann...

Exploit for Unrestricted Upload of File with Dangerous Type in Greenshiftwp Greenshift_-_Animation_And_Page_Builder_Blocks

Metasploit Module: Greenshift WordPress Plugin Arbitrary File...

Exploit for CVE-2025-14124

CVE-2025-14124 WordPress Team Plugin - Unauthenticated SQL...

UBUNTU-CVE-2025-27587

OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVPDigestSign API, and then using the private key to extract the K value nonce from the signatures. Next, based on the bit size of t...

CVE-2025-27587

OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVPDigestSign API, and then using the private key to extract the K value nonce from the signatures. Next, based on the bit size of t...

Exploit for CVE-2025-28915

CVE-2025-28915 - WordPress ThemeEgg ToolKit Arbitrary File Upl...

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

Description The plugin is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handleauthrequest' and 'hadleloginrequest'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an...

FL3R FeelBox <= 8.1 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. 1. Visit a blog post and extract the nonce from the source search for "feelboxAjax", and extract the "token" curl -s...

Events Made Easy < 2.2.81 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Obtain a valid nonce visit the "Events" page, default is /events/, and extract it from the source while looking for...

Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection

The plugin does not validate and escape the calendar parameter before using it in a SQL statement via the abcbookinggetSingleCalendar AJAX action available to both unauthenticated and authenticated users, leading to an unauthenticated SQL injection PoC 1. Install the vulnerable plugin...

Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection

The plugin does not validate and escape the calendar parameter before using it in a SQL statement via the abcbookinggetSingleCalendar AJAX action available to both unauthenticated and authenticated users, leading to an unauthenticated SQL injection 1. Install the vulnerable plugin...

Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass

Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Date: 2019-12-21 Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version:...