CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Quietly Insights plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

ros2_CVE-2024-28231

This repo includes a vulnerable Docker image of ros2 iron based on ubuntu 22 and a matching exploit. We exploit the vulnerability in fastrtps version 2.10.3, enabling denial of service of a remote subscriber via heap buffer overflow. Vulnerable base image Fast RTPS version 2.10.3 and dependencies...

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields Description The plugin, used as a companion plugin for the Discy and Himer themes, does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any...

CVE-2024-7135

CVE-2024-7135 WordPress 的 Tainacan 插件在 0.21.7 及之前的所有版本中，由于 'getfile' 函数缺少权限检查，存在未授权访问数据的漏洞。该函数还存在目录遍历漏洞。这使得经过身份验证的攻击者（具有订阅者（Subscriber）级别及以上的访问权限）能够读取服务器上任意文件的内容，其中可能包含敏感信息。 用法 root@kitploit: WordPress CVE-2024-7135 Wordpress Tainacan 0.21.7 Arbitrary File Read options: -h, --help show this help...

CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Description The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attributevalue' and 'attributeid' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ リモートコード実行 使用方法 root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message and exit -w URL...

CVE-2023-5412

CVE-2023-5412 Image horizontal reel scroll slideshow = 13.2 - 通过短代码的已认证（订阅者+）SQL注入 描述： WordPress 的 Image horizontal reel scroll slideshow 插件在版本 13.2 及之前（包括 13.2）中，由于对用户提供的参数转义不足，且对现有 SQL 查询缺乏充分的预处理，存在通过插件短代码的 SQL 注入漏洞。这使得经过身份验证的攻击者（拥有订阅者及以上权限）能够将额外的 SQL 查询附加到现有查询中，从而提取数据库中的敏感信息。 root@kitploit: CV...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

WordPress Ninja Forms - Scheduled Exports plugin <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters vulnerability

WordPress Ninja Forms - Scheduled Exports plugin = 3.0.3 - Authenticated Subscriber+ Stored Cross-Site Scripting via REST API Parameters vulnerability discovered by Nguyen Truong Roll in WordPress Plugin Ninja Forms - Scheduled Exports versions = 3.0.3...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Plugin Update vulnerability discovered by KoreaInfoSec in WordPress Plugin Bookly versions = 27.2...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

CVE-2023-2833

CVE-2023-2833 Mass Exploit Generator by Alucard0x1 This repository contains an exploit for CVE-2023-2833, a privilege escalation vulnerability in the ReviewX plugin for WordPress versions up to and including 1.6.13. Description The ReviewX plugin is vulnerable to privilege escalation, allowing a...

CVE-2024-51665

CVE-2024-51665 Magical Addons For Elementor = 1.2.1 - Authenticated Subscriber+ Server-Side Request Forgery Description: The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Server-Side Request Forgery in...

CVE-2024-52429

CVE-2024-52429 WP Quick Setup history.pushState'', '', '/'; document.forms0.submit;...

CVE-2024-25092

CVE-2024-25092 NextMove Lite 2.18.0 - 订阅者及以上任意插件安装/激活 描述： NextMove Lite – WooCommerce 感谢页插件 for WordPress 存在因缺少对 'xladdoninstallation' 函数的能力检查而导致的数据未授权修改漏洞，影响版本直至 2.17.0（含）。该漏洞使得经过身份验证的攻击者（具有订阅者及以上权限）能够安装并激活任意插件。 root@kitploit: Severity: medium CVE ID: CVE-2024-25092 CVSS Score: 6.5 CVSS Metrics:...

CVE-2024-7703

CVE-2024-7703 root@kitploit: CVE-2024-7703 Exploit: Stored Cross-Site Scripting XSS via SVG File Upload in ARMember WordPress Plugin Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2024-7703. The vulnerability affects the ARMember WordPress...

CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

EUVD-2026-72062

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-52134-libiec61850

CVE-2026-52134：libiec61850 v1.6 中的 GOOSE 重放与消息新鲜度处理 状态 CVE-2026-52134 已被分配。相应 CVE 记录的发布尚待进行。 受影响产品 厂商：MZ Automation GmbH 产品：libiec61850 已测试版本：1.6 其他版本状态：未确认 受影响文件：src/goose/goosereceiver.c 受影响函数：parseGoosePayload 摘要 libiec61850 v1.6 中的 GOOSE 订阅者接收路径在更新订阅者可见状态并调用已注册的监听器回调之前，未能充分拒绝某些重放或过期的 GOOSE 消息...