vulnerable-bsr-lab-CVE-2023-6933

CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions ≤1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...

CVE-2025-3102

SureTriggers 🔥 Developed by 0xgh057r3c0n 📌 Vulnerability Details Plugin Name: SureTriggers Affected Versions: --newmail --newuser --newpassword 🔍 Example: python3 CVE-2025-3102.py -u https://target-site.com --newuser hacker --newpassword Pass123! 📋 Options Argument| Descri...

CVE-2025-1639

🔓 Exploit Script for CVE-2025-1639 📝 Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

poc-cve-xss-inventory-press-plugin

Update - 6-23-2023 The CVE-2023-2579 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Details Title: Authenticated Reflected Cross-Site Scripting in InventoryPress Plugin for WordPress CMS Date: 2023-04-21 Autho...

CVE-2023-23488-PoC

CVE-2023-23488-PoC Unauthenticated SQL Injection - Paid Memberships Pro 2.9.8 WordPress Plugin Running this script against a WordPress instance with Paid Membership Pro plugin tells you if the target is vulnerable. As the SQL injection technique required to exploit it is Time-based blind, instead...

CVE-2022-45354

Download Monitor = 4.7.60 - Sensitive Information Exposure via REST API CVE-2022-45354:version found on http://wordpress.lan Details : CVE-2022-45354:version matched at http://wordpress.lan Protocol : HTTP Full URL : http://wordpress.lan/wp-content/plugins/download-monitor/readme.txt Timestamp :...

CVE-2026-14894

CVE-2026-14894 — Super Forms ≤ 6.3.313 Overview Unauthenticated Arbitrary File Upload → Remote Code Execution in the WordPress plugin Super Forms versions ≤ 6.3.313. The vulnerability resides in the AJAX handler supersubmitform which processes file uploads through a datauristring field without...

file-away-exploit

File-Away Exploit CVE-2025-2539 & CVE-2025-2512 📌 Purpose This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management. This plugin contains two vulnerabilities that can lead to remote code execution Tested on File-Away...

CVE-2025-2563

CVE-2025-2563 User Registration & Membership = 4.1.1 - Unauthenticated Privilege Escalation Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available...

CVE-2025-2807

CVE-2025-2807: Motors Plugin Exploit By: Nxploited | Khaled Alenazi ⚠️ Vulnerability Summary Plugin: Motors 📅 Expected to be mass-exploited due to its simplicity and critical impact. 🚫 Technical Details Vulnerable Endpoint: /wp-admin/admin-ajax.php Vulnerable Action: mvlsetupwizardinstallplugin...

CVE-2024-32700

CVE-2024-32700 Unauthenticated Arbitrary File Upload in Kognetiks Chatbot WordPress plugin...

CVE-2025-9345

Proof of Concept Path Traversal in File Manager, Code Editor, and Backup by Managefy Vulnerability Type: Path Traversal Arbitrary File Download Affected Function: ajaxdownloadfile Impact: Authenticated users with low privilege Subscriber+ can download arbitrary files from the server, including...

CVE-2026-15282

CVE-2026-15282 — Instant Appointment Mass RCE Exploit Pre-Auth filegetcontents + fileputcontents → PHP Webshell Overview CVE-2026-15282 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Instant Appointment WordPress plugin ≤ 1.2. The addservicefront AJAX action is...

CVE-2025-3102

CVE-2025-3102 The SureTriggers WordPress plugin contains a critical authentication bypass vulnerability CVE-2025-3102 that affects all versions up to and including 1.0.78...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critical Unrestricted File Upload vulnerability in Elementor Pro Potentially leading to Remote Code Execution RCE ⚠️ Overview CVE-2026-32475 is a critical security vulnerability affecting Elementor Pro , a widely deployed WordPress...

CVE-2024-52375

WordPress Datasets Manager 💥 Exploit by: Nxploit Khaled Alenazi 📅 CVE Published: November 14, 2024 🧠 CVSS Score: 10.0 Critical 🛠 CWE-434: Unrestricted Upload of File with Dangerous Type 📌 Description A critical vulnerability was discovered in the Datasets Manager by Arttia Creative WordPress...

CVE-2020-36842

CVE-2020-36842 CVE-2020-36842 - WPvivid Plugin Arbitrary File Upload Vulnerability Overview CVE ID: CVE-2020-36842 Disclosure / Update Date: October 16, 2024 Affected Plugin: WPvivid - Migration, Backup, Staging Affected Versions: Up to and including 0.9.35 Vulnerability Type: Arbitrary File Uplo...

CVE-2023-28121

CVE-2023-28121 usage: CVE-2023-28121.py -h -v RHOST RPORT WooCommerce Payments WordPress plugin = 5.6.1 CVE-2023-28121 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28121 positional arguments: RHOST remote host RPORT remote port optional arguments: -h, --help show this help message an...

CVE-2023-1430

Update 2023-06-12: You no longer need the snippet. WPManageNinja patched the vulnerability two hours after public disclosure 93 days after reporting. Update 2024-01-27: The related issue with with everlasting hash values is now fully addressed. Responsible disclosure of unpatched vulnerability...