CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an unauthenticated arbitrary file upload vulnerability affecting: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin This flaw allows attackers to upload arbitrary files to the server without authentication, potentially leading to remote code execution RC...

CVE-2024-32136

BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Date: 14 Apr 2024 Exploit Author: Ivan Spiridonov xbz0n Software Link: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135 Version: 2.0.3...

CVE-2024-1512

CVE-2024-1512 Proof of Concept Vulnerability Overview CVE-2024-1512 exposes a critical vulnerability in the MasterStudy LMS WordPress Plugin, specifically within the implementation of the /lms/stm-lms/order/items REST route. The issue arises from the plugin's failure to properly escape the 'user'...

CVE-2021-24155.rb

WordPress-Backup-RCE This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard versions prior to 1.6.0. This is due to an incorrect check of the uploaded file extension whi...

CVE-2023-32243

CVE-2023-32243. Essential Addons for Elementor 5.4.0-5.7.1 - Unauthenticated Privilege Escalation Info The plugin does not validate the password reset key, which could allow unauthenticated attackers to reset arbitrary account's password to anything they want, by knowing the related email or...

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

CVE-2026-12277

CVE-2026-12277 Frontend File Manager Plugin WordPress = 23.6 - Unauthenticated Arbitrary File Deletion to RCE Summary...

CVE-2024-8856

CVE-2024-8856: Vulnerabilidad de subida arbitraria de archivos en el plugin WP Time Capsule de WordPress Resumen CVE-2024-8856 es una vulnerabilidad de seguridad encontrada en el plugin WP Time Capsule para WordPress que permite a usuarios no autenticados subir archivos arbitrarios al servidor...

CVE-2025-23942-poc

WP Load Gallery 漏洞利用 CVE-2025-23942 📌 描述 NgocCode WP Load Gallery 中存在危险类型文件无限制上传漏洞，允许向 Web 服务器上传 Web Shell。该漏洞影响 WP Load Gallery 版本：从 n/a 至 2.1.6。 ⚠️ 漏洞详情 CVE ID: CVE-2025-23942 受影响插件: WP Load Gallery 受影响版本: 最高 2.1.6 漏洞类型: 无限制文件上传 严重性: 严重 CVSS 9.1 攻击向量: 已验证用户 作者级+ 远程代码执行 RCE 补丁可用性: ❌ 尚无官方补丁 🚀...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

CVE-2024-8353-PoC

Código de Prueba de Concepto para CVE-2024-8353 Este repositorio contiene un script para explotar la vulnerabilidad CVE-2024-8353 en el plugin GiveWP para WordPress. Esta vulnerabilidad permite la inyección de objetos PHP sin autenticación, lo que potencialmente puede conducir a la ejecución remo...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message an...

CVE-2023-5412

CVE-2023-5412 Image horizontal reel scroll slideshow = 13.2 - Authenticated Subscriber+ SQL Injection via Shortcode Description: The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to...

CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Privilege Escalation to Administrator 🔗 Stay Updated For the latest zero-days, exploits, and security research 📋 Vulnerability Overview 🔍 Technical Description Root Cause Analysis The vulnerability exists in EM\Archetypes::mapmetacap within...

CVE-2025-2005

CVE-2025-2005 WordPress Front End Users Plugin = 3.2.32 is vulnerable to Arbitrary File Upload WordPress Front-End Users Plugin Exploit Vulnerability Information Plugin Name : Front-End Users Plugin Version Affected : = 3.2.32 Vulnerability Type : Arbitrary File Upload CVSS Score : 10 Critical Ri...

Wordpress-CVE-2020-35749

Wordpress Plugin Simple Job Board 2.9.3 LFI Vulnerability CVE-2020-35749 Exploit Summary WordPress Plugin Simple Job Board is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Autorización faltante para la actualización arbitraria de opciones Suscriptor+ Descripción: El complemento InstaWP Connect – 1-click WP Staging & Migration para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de...

-CVE-2022-1609

CVE-2022-1609 Bash poc for CVE-2022-1609 WordPress Weblizar Backdoor How to install ? root@kitploit: wget https://raw.githubusercontent.com/0xSojalSec/CVE-2022-1609/main/exploit.sh chmod +x exploit.sh ./exploit.sh How to use it ? root@kitploit: GH0ST3exP10it$ ./exploit.sh http://127.0.0.1:8080 +...

CVE-2023-30777

CVE-2023-30777 Generador de URL de Prueba de Concepto PoC para una vulnerabilidad XSS reflejado en el plugin Advanced Custom Fields de WordPress. PoC generado por: Alucard0x1 Crédito del Exploit:...