CVE-2022-1565

WordPress Plugin WP All Import = 3.6.7 - Ejecución remota de código RCE Autenticado root@kitploit: Fecha: 05 de noviembre de 2023 Autor del exploit: Việt HÙng https://github.com/phanthibichtram12 Sitio web del proveedor: https://www.wpallimport.com/ Enlace del software:...

CVE-2026-82221-PoC

CVE-2026-82221 - Unauthenticated Reflected XSS in RegistrationMagic Overview This repository contains a Proof-of-Concept PoC for CVE-2026-82221 , an unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered in the RegistrationMagic WordPress plugin. The vulnerability affects the...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate 5.3.0 - Carga arbitraria de archivos sin autenticar que deriva en ejecución remota de código CVE-2026-13714 — WPL Real Estate RCE sin autenticar Realtyna Organic IDX plugin + WPL Real Estate para WordPress 5.3.0 Carga arbitraria de...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 es una vulnerabilidad crítica de inyección SQL descubierta en el plugin de WordPress The Events Calendar. Esta vulnerabilidad afecta a versiones hasta la 6.6.4 inclusive. El problema surge por un escape insuficiente del parámetro 'order' en la función tribehasnextevent...

cve-2025-1323

cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Disclaimer This tool is intended for authorized security testing and educational use only. Do not use against systems without explicit permission. Misuse may be illegal. ✅ Requirements Python 3.x requests module Install dependencies:...

WordPress Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin myCred versions = 3.2.4...

CVE-2026-8181

CVE-2026-8181 - Exploit de Bypass de Autenticación en Burst Statistics Python 2.7 exploit para la vulnerabilidad del plugin Burst Statistics CVE-2026-8181 que permite a atacantes no autenticados evadir la autenticación de la API REST, recuperar contraseñas de aplicación y crear nuevos usuarios...

WordPress WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin <= 2.23.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WooCommerce Google Feed Manager versions = 2.23.7...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...

CVE-2022-1421

CVE-2022-1421 Una Prueba de Concepto para CVE-2022-1421 Discy Referencias https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249...

WordPress WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPFunnels versions = 3.12.13...

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 XSS Almacenado mediante Cookie CVE-2026-5513 — Bookly ≤ 27.2 XSS Almacenado mediante Cookie CVE CVSS Tipo Autenticación https://t.me/FreeToolsCpa Archivo CVE en el grupo Resumen...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Denial vulnerability discovered by Wordfence PRISM in WordPress Plugin Awesome Support versions = 6.3.9...

WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description : User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress versions up to and including...

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon

wp-file-manager-exploit-CVE-2020-25213-with-Zerologon Proyecto para Trabajos del Curso NT205.P21.ANTT Ciberataque Explota el servidor Windows 2019 vulnerable a Zerologon con Garble, Chisel, Evil-WinRM, Impacket y un plugin de Wordpress vulnerable en una máquina Cliente Demostración en video:...

CVE-2025-4396

CVE-2025-4396 — Inyección SQL en Relevanssi Ciega Basada en Tiempo Descargo de responsabilidad: Este repositorio está destinado únicamente a pruebas de penetración autorizadas, investigación de seguridad y fines educativos. El acceso no autorizado a sistemas informáticos es ilegal y poco ético...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate Unauthenticated RCE -red.svg Critical Unauthenticated Remote Code Execution CVSS 10.0 — Realtyna Organic IDX + WPL Real Estate ≤ 5.2.0 This tool exploits CVE-2026-57811 , a critical vulnerability in the Realtyna Organic IDX + WPL Real Estate...