CVE-2023-32961

CVE-2023-32961 This repository is about XSS vulnerability in Wordpress Zotpress Plugin. Component details Component name Zotpress Vulnerable version ≤ 7.3.3 Component slug zotpress Component link https://wordpress.org/plugins/zotpress/ Pre-requisite Unauthenticated Vulenerability details Short...

CVE-2023-29439

CVE-2023-29439 This repository is about XSS vulnerability in Wordpress Foogallery Plugin. Vulenerability details Description In Foogallery 2.2.35 and earlier, the function foogalleryimageeditormodal in foogallery/includes/admin/class-gallery-attachment-modal.php is vulnerable to XSS attack...

CVE-2019-9978

Social Warfare Plugin Wordpress 3.5.2 Remote Code Execution Wordpress Social Warfare Remote Code Execution AUTO UPLOAD SHELL Date: March, 2019 Download Link: https://wordpress.org/plugins/social-warfare/ Reference: https://wpvulndb.com/vulnerabilities/9259 Version: CVE: 2019-9978 USAGE: python...

Exploit-CVE-2026-1357

의존성 설치 pip3 install pycryptodome requests 기본 익스플로잇 python3 wpvivi.py http://target.com 커스텀 웹셸 python3 wpvivi.py http://target.com --shell backdoor.php python3 wpvivi.py http://target.com --code "" 기술적 설명: Null Byte Key: RSA 복호화가 실패하면 false를 반환하며, phpseclib는 이를 "\x00\x00\x00"으로 처리합니다. AES-128 ECB...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload There are multiple unrestricted file uploads that result in the arbitrary execution of PHP code. Authenticated Vulnerable Pages: localhost/officeadmin/?pid=54&action=add root@kitploit: -----------------------------181967832439954202373233921976...

CVE-2022-0739

CVE-2022-0739 BookingPressWordPress Plugin SQLInjection BookingPress before 1.0.11...

exploit-CVE-2015-8351

Gwolle Guestbook WordPress Plugin RFI Exploit This Python script exploits a critical Remote File Inclusion RFI vulnerability in the Gwolle Guestbook WordPress Plugin, which can be exploited by a non-authenticated attacker to include a remote PHP file and execute arbitrary code on the vulnerable...

Python-CVE-2020-25213

Python-CVE-2020-25213 Python Interactive Exploit for WP File Manager Vulnerability. The File Manager wp-file-manager plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php...

CVE-2024-6460

CVE--2024-6460 Grow by Tradedoubler 2.0.22 - Unauthenticated LFI Usage root@kitploit: ausage: CVE-2024-6460.py -h -u URL -U USERNAME -P PASSWORD -c COMPONENT Grow by Tradedoubler 2.0.22 - Unauthenticated LFI options: -h, --help show this help message and exit -u URL, --url URL Target WordPress si...

CVE-2026-0911

CVE-2026-0911 — Hustle Module Import PoC A research / pentest helper tool that tests the upload behavior via the authenticated module import endpoint for the WordPress plugin Hustle wordpress-popup, WPMU DEV under CVE-2026-0911. The CVE-2026-0911.py script in this repository or file set should on...

CVE-2026-11387-WooCommerce-SMS-OTP

CVE-2026-11387 SMS Alert ≤ 3.9.5 — unauthenticated privilege escalation via arbitrary password reset A critical improper-authentication flaw in the WordPress plugin SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery. When OTP verification is enabled for password...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

CVE-2026-1844

PixelYourSite PRO - 인증되지 않은 저장형 크로스 사이트 스크립팅CVE-2026-1844 개요 WordPress용 PixelYourSite PRO 플러그인은 12.4.0.2까지의 모든 버전에서 'pysTrafficSource' 매개변수와 'pyslandingpage' 매개변수를 통한 저장형 크로스 사이트 스크립팅에 취약하며, 이는 불충분한 입력 검증 및 출력 이스케이프 때문입니다. 이로 인해 인증되지 않은 공격자가 페이지에 임의의 웹 스크립트를 주입할 수 있으며, 사용자가 주입된 페이지에 접근할 때마다 해당...

WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – Unauthenticated Arbitrary File Upload Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff :...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE Unauthenticated arbitrary file upload leading to RCE in the Realtyna WPL / Organic IDX WordPress plugin real-estate-listing-realtyna-wpl ≤ 5.2.0. The plugin registers an "I/O service" on the public WordPress...

CVE-2026-3844

CVE-2026-3844 Mass Exploit CVE-2026-3844 – Breeze Cache WordPress =2.4.4 allows unauthenticated file upload via fetchgravatarfromremote when local gravatar hosting is enabled. Installation Download repository root@kitploit: git clone https://github.com/im-hanzou/CVE-2026-3844 Go to repository...

CVE-2016-15041-mainwp-dashboard

CVE-2016-15041 실습 - MainWP Dashboard 저장형 XSS CVE-2016-15041 취약점 실습: MainWP Dashboard WordPress 플러그인 = 3.1.2에서 인증 없이 발생하는 저장형 XSS 빠른 시작 root@kitploit: docker compose up -d --build 자동 설정을 위해 약 30초 기다립니다. 준비가 완료되면 실습에서 배너를 출력합니다. root@kitploit: docker compose logs -f wordpress 접근...

cve-2019-14206-poc

CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File Deletion 📋 Index 1. About the Vulnerability 2. Prerequisites 3. Installation 4. Testing Methods Quick Test Full Test with Docker Test with Nuclei Manual Test 5. Interpreting Results 6. Cleanup 7. Troubleshooting 8. Mitigation 9. Legal...

CVE-2026-86475

Appointment Hour Booking is a WordPress plugin that allows scheduling of time-based appointments. Versions prior to 1.5.95 are affected by a capacity validation flaw: when a multi-appointment booking submission is received, the plugin does not verify each individual appointment against the capaci...