CVE-2026-102425

🖥️ BAForms-RCE — CVE-2026-102425 GUI Dark-neon GUI scanner/exploit untuk CVE-2026-102425 — Balbooa Forms combaforms 1.0.0–2.4.3.3: Unauthenticated RCE via field shortcode injection pada PHP-after-submission action eval. Standalone GUI implementation — rewritten from scratch based on the mechanism...

By-Poloss..-.CVE-2026-89274

CVE-2026-89274 PoC Poloss : @WPEF0 Proof-of-Concept exploit untuk CVE-2026-89274 — kerentanan Unauthenticated Arbitrary Shortcode Execution pada plugin WordPress WP Recipe Maker versi ≤ 10.8.1. ⚠️ LEGAL & ETHICAL WARNING This script is provided only for security research in a local environment...

CVE-2024-3105-PoC

CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

CVE-2025-7431

Proof of Concept – CVE-2025-7431 Knowledge Base = 2.3.1 - Authenticated Administrator+ Stored Cross-Site Scripting via Plugin Slug CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N ------- 4.4 Vulnerability Overview An authenticated attacker Administrator can exploit a Stored Cross-Site Scripting XSS...

CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Author-level User Extracts Full Database via Time-Based Blind Injection SUMMARY The plgcontentdpcalendar content plugin parses events order="..."/events shortcodes embedded in Joomla article bodies. The order...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia for WordPress, BuddyPress and bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

CVE-2023-0630

CVE-2023-0630 CVE-2023-0630 - Slimstat Analytics 4.9.3.3 - Subscriber+ SQL Injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2023-0630.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w URL, --url URL URL ...

By-Poloss..-..CVE-2017-20251

CVE-2017-20251: Insert PHP Plugin PHP Code Injection Vulnerability Title Unauthenticated PHP Code Injection via Shortcode Processing in Insert PHP Plugin Basic Information Field| Value ---|--- CVE ID| CVE-2017-20251 Plugin| Insert PHP now Woody Code Snippets Affected Versions| 3.3.1 tested on 1.3...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2024-12404

CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - Unauthenticated SQL Injection Description The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user...

CVE-2026-102425

CVE-2026-102425 — Balbooa Forms combaforms field shortcode → RCE Python 3 PoC for CVE-2026-102425 — balbooa.com Balbooa Forms Joomla extension — unauthenticated remote code execution via field shortcode injection in optional PHP-after-submission actions eval. | | | |---|---| | PoCbit |...

CVE-2024-38793-PoC

CVE-2024-38793-PoC Proof of Concept code for exploitation of CVE-2024-38793 Best Restaurant Menu by PriceListo = 1.4.1 - Authenticated Contributor+ SQL Injection. Proof Of Concept This is a proof of concept exploit for the vulnerability CVE-2024-38793, an SQL injection vulnerability for versions ...

CVE-2026-92229

CVE-2026-92229 — Forminator Unauthenticated Arbitrary Shortcode Execution Python 3 PoC scanner/exploit for CVE-2026-92229 in Forminator WPMU DEV. | ---|--- Plugin| forminator Affected| ≤ 1.57.2 Fixed in| 1.57.3+ CVSS| 9.1 Critical Auth| Unauthenticated Vector| POST parameter currenturl quiz AJAX...

CVE-2024-50450

CVE-2024-50450 WordPress Meta Data and Taxonomies Filter MDTF = 1.3.3.4 - Unauthenticated Arbitrary Shortcode Execution Description: The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.4. Th...

CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Shortcode Addons = 3.2.5 – Authenticated Admin+ Arbitrary File Upload CVE ID: CVE-2024-31114 CVSS Score: 9.1 Critical 🛠️ Vulnerability Description The Shortcode Addons – with Visual Composer, Divi, Beaver Builder, and Elementor Extension...

CVE-2024-9061

CVE-2024-9061 WP Popup Builder – Popup Forms and Marketing Lead Generation = 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wpajaxnoprivshortcodeApiAdd Description The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary...

CVE-2026-113493

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

EUVD-2026-109215

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...

CVE-2026-115807

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...