Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

A vulnerability in the Wordpress Media-Library-Assistant plugins in version 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration. id: CVE-2023-4634 info: name: Media Library Assistant 3.09 - Remote Code Execution/Local File Inclusion...

WordPress My Calendar <3.4.22 - SQL Injection

WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route. id: CVE-2023-6360 info: name: WordPress My Calendar 3.4.22 - SQL Injection author: xxcdd severity: critical...

CVE-2021-24959

CVE-2021-24959 Descripción El plugin WP Email Users de WordPress hasta la versión 1.7.6 no escapa el parámetro dataraw en la acción AJAX weuselectedusers1, disponible para cualquier usuario autenticado, permitiéndoles realizar ataques de inyección SQL. root@kitploit: CVE CVE-2021-24959 CVSS 8.8...

CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read

CVE-2025-2539 - Lectura Arbitraria de Archivos en el Plugin File Away de WordPress 📋 Resumen Ejecutivo CVE ID: CVE-2025-2539 Plugin: File Away Versiones = 3.9.9.0.1 Tipo de Vulnerabilidad: Lectura Arbitraria de Archivos Autenticada Puntuación CVSS: 8.5 Alta Disponibilidad de Exploit: PoC Público...

CVE-2025-9816

CVE-2025-9816 XSS Almacenado en el Plugin WP-Statistics Escáner Detección y PoC "El plugin WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del encabezado User-Agent en todas las versiones hasta, e incluyend...

Exploit for CVE-2026-87902

CVE-2026-87902 — Unauthenticated local file inclusion in WordP...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon Proyecto para Trabajos del Curso NT205.P21.ANTT Ciberataque Explota el servidor Windows 2019 vulnerable a Zerologon con Garble, Chisel, Evil-WinRM, Impacket y un plugin de Wordpress vulnerable en una máquina Cliente Demostración en video:...

CVE-2026-39492

CVE-2026-39492 — Escáner de Inyección SQL Ciega de WP Maps SQLi ciega basada en tiempo pre-autenticación vía evasión con acentos graves → Extracción de BD Descripción General CVE-2026-39492 es una vulnerabilidad de inyección SQL ciega no autenticada de severidad crítica CVSS 9.3 en el plugin WP...

CVE-2023-6063-PoC

CVE-2023-6063-PoC Explotación de la vulnerabilidad de inyección SQL en WP Fastest Cache CVE-2023-6063...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit El script CVE-2024-10793.yaml es necesario para buscar un plugin. El script CVE-2024-10793.sh es el exploit en sí. Para post-explotación, puedes usar beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log El plugin WP Activity Log para...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible en Docker Inyección SQL de segundo orden no autenticada en All-in-One WP Migration and Backup WordPress que escala a filtrado de la ai1wmsecretkey y, con ella, a ejecución remota de código RCE. Lee esto en: English · Español...

CVE-2026-2942

ProSolution WP Client — Escáner de Subida de Archivos No Autenticada y RCE Plugin: prosolution-wp-client Versión Afectada: Tipo de Vulnerabilidad: Subida de Archivos Arbitraria No Autenticada → Ejecución Remota de Código Nivel de Riesgo: 🔴 Crítico CVSS 9.8 Requisito: Página pública que contiene e...

WordPress WP Customer Reviews plugin <= 3.7.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Quang in WordPress Plugin WP Customer Reviews versions = 3.7.8...

WordPress WP Import Export Lite plugin < 3.9.35 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.35...

CVE-2026-9231

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit Unauthenticated Admin Takeover | CVSS 9.8 | Ready to use 🔥 What you get Fully working Python exploit for CVE-2026-8732 Unauthenticated administrator account creation Returns magic login URL – instant site takeover Works against WP Maps Pro ≤ 6.1.0...

CVE-2026-9231

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-93778

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text imported via wpyelpdownloadsource in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...