CVE-2023-6933

Introdução à Vulnerabilidade CVE-2023-6933 Descrição O plugin "Better Search Replace" para WordPress apresenta uma vulnerabilidade crítica conhecida como Injeção de Objeto PHP. Essa falha de segurança está presente em todas as versões até a 1.4.4 inclusive. Ela surge da desserialização de entrada...

CVE-2022-21661

CVE-2022-21661 CVE-2022-21661 docker and poc functions.php को मूल छवि के functions.php से बदलने की आवश्यकता है, docker-compose.yml में सीधे माउंट करें। poc root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0...

CVE-2024-11635

WordPress File Upload This README documents a disclosed vulnerability for educational and defensive use only. Donot run tests against production systems or systems you do not own or have explicit permission to test. Discovered by: abrahack Status: Public Disclosure Date Reported: 2025-01-07 CVE I...

CVE-2023-29386

CVE-2023-29386 — Manager for Icomoon This README documents a disclosed vulnerability for educational and defensive use only. Donot run tests against production systems or systems you do not own or have explicit permission to test. Discovered by: deokhunKim Status: Public Disclosure Date Reported:...

CVE-2022-0739

CVE-2022-0739 Minha abordagem do exploit CVE-2022-0739 BookingPress, baseada no POC do destr4ct — apenas mais bonita. Exemplo Exemplo de uso contra a máquina MetaTwo do HackTheBox, que hospeda um WordPress com o plugin bookingpress vulnerável versão 1.0.10. root@kitploit: python...

CVE-2025-2539

POC - CVE-2025-2539 File Away Aviso : Esta Prova de Conceito POC é feita apenas para fins educacionais e de teste ético. O uso desta ferramenta para atacar alvos sem consentimento mútuo prévio é ilegal. É responsabilidade do usuário final obedecer todas as leis locais, estaduais e federais...

CVE-2024-9935

CVE-2024-9935 - PDF Generator Addon for Elementor Page Builder = 1.7.5 - Download Arbitrário de Arquivo Não Autenticado Visão Geral O plugin PDF Generator Addon for Elementor Page Builder para WordPress é vulnerável a Path Traversal em todas as versões até, e incluindo, 1.7.5 por meio da função...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

CVE-2026-15798

Smart Slider 3 for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'slider' Block Attribute in all versions up to and including 3.5.1.38 , caused by insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inje...

CVE-2026-77365

The Optimole image optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'a' (above_fold_images ) parameter in all versions up to and including 4.2.10 . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attacker...

CVE-2026-11551-PoC

CVE-2026-11551 - Privilégio Não Autenticado no White Label & Branding, Customizador Gratuito da Página de Login White Label & Branding, Customizador Gratuito da Página de Login update $wpdb-users, $data, ... ← Line 2515: DOUBLE HASH TERSIMPAN Código Vulnerável inc/modules/login-screen/...

CVE-2025-2594

CVE-2025-2594 User Registration & Membership = 4.1.2 - Authentication Bypass Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available resources, research,...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Unauthenticated Privilege Escalation Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available...

CVE-2024-8856

CVE-2024-8856: Vulnerabilidade de Upload Arbitrário de Arquivos no Plugin WP Time Capsule para WordPress Visão Geral CVE-2024-8856 é uma vulnerabilidade de segurança encontrada no plugin WP Time Capsule para WordPress que permite que usuários não autenticados enviem arquivos arbitrários para o...

CVE-2024-10508

Unauthenticated Privilege Escalation via Password Recovery on RegistrationMagic = 6.0.2.6 Disclaimer : This information is provided for educational purposes only. This document aims to raise awareness of security vulnerabilities and should not be used for any unauthorized or malicious activities...

CVE-2026-2002-poc

ملخص إضافة Forminator Forms – Contact Form, Payment Form & Custom Form Builder لـ WordPress عرضة لـ Stored Cross-Site Scripting عبر معامل formname في جميع الإصدارات حتى 1.50.2، وذلك بسبب عدم كفاية تنظيف المدخلات وهروب المخرجات. هذا يتيح للمهاجمين الموثقين، بصلاحيات مستوى المشرف، حقن نصوص برمجية...

CVE-2024-11252-Sassy-Social-Share-XSS

CVE-2023-XXXX: Vulnerabilidade XSS no Plugin Sassy Social Share Descrição Este projeto demonstra a vulnerabilidade de Cross-Site Scripting XSS refletida no plugin Sassy Social Share para WordPress. Esta vulnerabilidade pode ser explorada através do parâmetro heateormastodonshare. Uso 1. PoC.html ...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...

CVE-2024-3922-Poc

CVE-2024-3922-Poc Dokan Pro Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.110.184:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/126.0.0.0 Safari/537.36 Accept:...

CVE-2024-3495-Poc

CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWe...