CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...

CVE-2023-38146

PoC para el exploit ThemeBleed CVE-2023-38146 temas de Windows 11 Muy inspirado en https://github.com/gabe-k/themebleed, que solo se ejecuta en Windows la razón por la que decidí escribir esto. Se usó código modificado del smbserver.py de impacket...

Blackash-CVE-2025-4322

CVE-2025-4322 : Unauthenticated Privilege Escalation via Password Update "Account Takeover 🔥" Description : The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a...

CVE-2025-5394

🚨 CVE-2025-5394 - Subida Arbitraria de Plugins No Autenticada en el Tema Alone 📌 Producto afectado: Alone – Tema WordPress multipropósito para caridad sin fines de lucro Versiones: = 7.8.3 CVE: CVE-2025-5394 Puntuación CVSS: 9.8 Crítico 🔥 Resumen de la vulnerabilidad: El tema Alone para WordPress...

CVE-2023-41425

https://sploitus.com/exploit?id=3A833277-4844-5F02-AFEF-5EA6BA8AC1AC Wonder CMS RCE | | Description : XSS to RCE, Wonder CMS 3.2.0 evil/evil.php EOF root@kitploit: zip -r evil.zip evil/ JS payload that will install the new theme root@kitploit: cat xssrce.js var xhr=new XMLHttpRequest;...

ThemeBleedPy

Un agradecimiento enorme a gabek por el PoC inicial en C, y por descubrir este CVE, esta es una recreación de su código en Python, reutilizando sus archivos de stage. Para ver el PoC inicial, visita su página aquí: https://github.com/gabe-k/themebleed ThemeBleedPy Una prueba de concepto en Python...

CVE-2025-5394

CVE-2025-5394 CVE‑2025‑5394 WP Alone theme ≤ 7.8.3...

EUVD-2026-77430

A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side reque...

CVE-2026-90710

CVE-2026-90710 is a Server-Side Request Forgery (SSRF) vulnerability in taisan tarzan-cms version 1.0.0 . The flaw resides in the openConnection function within the Theme Download Function component, specifically in the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java. By manipulat...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC:...

CVE-2026-6279.py

Description This Python script is an exploit tool for CVE-2026-6279 targeting Avada Builder = 3.15.2. Key behavior: scans targets for fusionloadnonce via Avada-specific shortcode/page patterns discovers AJAX endpoint and origin IP bypass if Cloudflare blocks admin-ajax builds exploit requests for...

CVE-2024-13346

CVE-2024-13346 Avada Theme 7.11.14 - Ejecución arbitraria de shortcodes no autenticada CVE-2024-13346 script de explotación Código de instalación root@kitploit: git clone https://github.com/tausifzaman/CVE-2024-13346.git root@kitploit: cd CVE-2024-13346 root@kitploit: pip install -r...

CVE-2025-69080

Gecko Theme LFI Exploit CVE-2025-69080 Unauthenticated Local File Inclusion LFI vulnerability in WordPress Gecko Theme = 1.9.8 ⚠️ Description This exploit targets a high-severity CVSS 8.1 Local File Inclusion vulnerability in the JanStudio Gecko WordPress theme. The vulnerability allows an...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Instalación no autenticada de plugins arbitrarios Descripción El tema Pubnews para WordPress es vulnerable a la instalación no autorizada de plugins arbitrarios debido a una falta de comprobación de capacidades en la función pubnewsimporterpluginactionfornotice e...

CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Autorización faltante mediante activateplugin Descripción El tema Square para WordPress es vulnerable a la activación no autorizada de plugins debido a una falta de verificación de capacidades en la función activateplugin llamada mediante una acción AJAX en version...

CVE-2025-4524

CVE-2025-4524 WordPress Madara Theme 2.2.2.1 - Inclusión de Archivos Locales...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - Escalada de Privilegios No Autenticada 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 Escalada de Privilegios No Autenticada 📌 Resumen Este repositorio contiene una herramienta de prueba de concepto en Python para CVE-2025-39459 , que afecta al tema de WordPress...

WordPress Bridge - Creative Multipurpose WordPress Theme theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

WordPress Bridge - Creative Multipurpose WordPress Theme theme = 30.8.9.1 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by João Pedro Soares de Alcântara in WordPress Theme Bridge Theme versions = 30.8.9.1...

CVE-2021-3030

CVE-2021-3030 — Cute Editor 6.4 Reflected Cross-Site Scripting XSS CVE ID: CVE-2021-3030 Status: Reserved by the CVE Program MITRE on 2021-01-06. No public record has ever been published for this ID — this document is the public reference required to complete that publication. Vulnerability type:...