Lucene search
+L

16140 matches found

Kitploit
Kitploit
added 2026/08/28 8:55 a.m.4 views

CVE-2023-6553

CVE-2023-6553 Exploit Development for CVE-2023-6553 on Backup Plugin in Wordpress This is a critical CVE with a CVSS score of 9.8 The vulnerability allows attacker to send commands to the server running the vulnerable version of the plugin Vulnerable Version Backup = 1.3.7 Set up 1. git clone the...

9.8CVSS8.5AI score0.97846EPSS
SaveExploits16
Kitploit
Kitploit
added 2026/08/28 7:57 a.m.1 views

wpscvn

wpscvn은 침투 테스터와 웹사이트 소유자가 자신의 사이트에 취약한 플러그인이나 테마가 있는지 테스트하기 위한 도구입니다. 저자는 이 도구의 잘못된 사용에 대해 어떠한 책임도 지지 않습니다. 사전 동의 없이 대상을 공격하는 것은 불법이며 법에 의해 처벌된다는 점을 기억하십시오. 필요사항: Python 3 사용법: python3 script.py http://site...

5.4AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/28 7:03 a.m.2 views

CVE-2026-0920

Escáner CVE-2026-0920 Un escáner basado en Python para detectar y validar la exposición a CVE-2026-0920 en sitios WordPress que utilizan versiones vulnerables del plugin LA-Studio Element. Resumen Esta herramienta está diseñada para automatizar la identificación de objetivos WordPress...

9.8CVSS6.1AI score0.01097EPSS
SaveExploits5
Kitploit
Kitploit
added 2026/08/28 2:54 a.m.5 views

CVE-2024-11635

WordPress File Upload Este README documenta una vulnerabilidad divulgada únicamente con fines educativos y defensivos.No ejecutes pruebas contra sistemas de producción o sistemas que no poseas o para los que no tengas permiso explícito de prueba. Descubierto por: abrahack Estado: Divulgación...

9.8CVSS8.9AI score0.01474EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/08/27 8:42 a.m.2 views

CVE-2024-1071-Docker

Docker के साथ CVE-2024-1071 🎯 नए WordPress CVE के साथ अभ्यास करना चाहते हैं? निर्देशों का पालन करें लैब तैयार करें 1. Docker इंस्टॉल करें : https://docs.docker.com/get-docker/ 2. प्रोजेक्ट क्लोन करें : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. प्रोजेक्ट में जाएँ : cd...

9.8CVSS9AI score0.89431EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/08/27 6:30 a.m.2 views

SSI-CVE-2022-21661

SSI-CVE-2022-21661 Secondo compito di Sicurezza dei Sistemi Informativi Studiare e sfruttare la vulnerabilità CVE-2022-21661 che consente SQL Injection tramite richieste POST dei plugin alle versioni di WordPress inferiori alla 5.8.3. Configurazione dell'ambiente Per avviare e configurare...

8CVSS8.1AI score0.97795EPSS
SaveExploits14References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.95 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS4.7AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.18 views

WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion

The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. id: CVE-2024-6460 info:...

9.8CVSS5.7AI score0.04826EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.24 views

Push Notification for Post and BuddyPress <= 1.93 - SQL Injection

Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to SQL Injection via the 'onesignalexternalid' and 'onesignalgetsubscriptionoptionsid' paramters in all versions up to, and including, 1.93 due to insufficient escaping on the user supplied parameter and lack of sufficie...

9.8CVSS5.9AI score0.02758EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.57 views

LearnPress < 4.2.6.8.1 - Information Disclosure

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by incorrect implementation of getitemspermissionscheck function in all versions up to 4.2.6.8, letting unauthenticated attackers extract user emails and basic information. id: CVE-2024-5483 info: name: LearnPress...

5.3CVSS5.1AI score0.01008EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.98 views

Breeze <= 2.4.4 - Arbitrary File Upload

Breeze Cache WordPress plugin = 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetchgravatarfromremote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled. id:...

9.8CVSS9AI score0.27701EPSS
SaveExploits9References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.21 views

WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

9.8CVSS5.7AI score0.04458EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.86 views

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

7.5CVSS7.4AI score0.02437EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.25 views

WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure

Jordy Meow Perfect Images Manage Image Sizes, Thumbnails, Replace, Retina versions up to 6.4.5 contain a vulnerability that exposes sensitive information to unauthorized actors, letting attackers access confidential data, exploit requires no specific conditions. id: CVE-2023-44982 info: name:...

7.5CVSS7.8AI score0.01425EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.17 views

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. id: CVE-2019-17232 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated Options Import and Export author: daffainfo severity: high description: |...

7.5CVSS8.1AI score0.03518EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.54 views

WP Go Maps <= 9.0.29 - Cross-Site Scripting

WP Go Maps formerly WP Google Maps plugin for WordPress versions before 9.0.30 is vulnerable to Reflected Cross-Site Scripting via the 'mapid' parameter in the admin map edit page. id: CVE-2024-29931 info: name: WP Go Maps = 9.0.29 - Cross-Site Scripting author: Shivam Kamboj severity: medium...

7.1CVSS8.6AI score0.00753EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.83 views

Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

7.5CVSS9AI score0.02667EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.17 views

WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)

The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the "themestylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability. id: CVE-2025-6174 info: name: WordPress Qwizcards alert'randstr'" matchers...

6.1CVSS5.2AI score0.0046EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.47 views

WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kunal Nagar Custom 404 Pro allows Reflected XSS.This issue affects Custom 404 Pro: from n/a through 3.11.1. id: CVE-2024-39646 info: name: WordPress Custom 404 Pro = 3.11.1 - Reflected XSS...

7.1CVSS5.2AI score0.00624EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.22 views

WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the album's name before outputting it in pages or posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting XSS attacks even when the unfiltered-html capabilit...

4.8CVSS5AI score0.009EPSS
SaveExploits2References3
Rows per page
Query Builder