CVE-2025-9209

🍔 RestroPress – Sistema de Pedidos de Comida en Línea 3.0.0 - 3.1.9.2 🛡️ CVE-2025-9209.py — Explotación Automática Masiva y Herramienta de Extracción ⚠️ Resumen de la Vulnerabilidad RestroPress – Sistema de Pedidos de Comida en Línea versiones 3.0.0 hasta 3.1.9.2 están afectadas por una Exposición...

WordPress Sidebar Manager Light plugin <= 1.18 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Sidebar Manager Light versions = 1.18...

WordPress Redux Framework plugin <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13.1...

WordPress Contact Form 7 Captcha plugin 0.1.7-0.1.8 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Contact Form 7 Captcha versions 0.1.7-0.1.8...

CVE-2025-13595

CIBELES AI = 1.10.8 - Unauthenticated Arbitrary File Upload The Cibeles AI WordPress plugin versions 1.10.8 and below contain an unauthenticated remote code execution vulnerability in the actualizadorgit.php file. This file is directly accessible via HTTP without any authentication or authorizati...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List RCE no autenticado Un exploit automatizado para CVE-2025-34085 duplicado de CVE-2020-36847, una vulnerabilidad crítica de ejecución remota de código sin autenticación en el plugin WordPress Simple File List versiones ≤ 4.2.2. Nota: CVE-2025-34085 fue...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Autorización faltante para actualización limitada de opciones no autenticada El plugin Tutor LMS – eLearning and online course solution para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidades en la...

CVE-2025-12973

S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator = 1.7.7 - Authenticated Editor+ Arbitrary File Upload The WordPress S2B AI Assistant plugin versions 2.47 and prior contains an arbitrary file upload vulnerability that allows authenticated WordPress users with Editor role or...

Exploit_CVE-2021-24762

exploitcve-2021-24762 Este repositorio muestra un exploit para CVE-2021-24762. Es un exploit de Blind SQLi que, en la configuración predeterminada, obtiene la contraseña del administrador. Mientras realizaba un laboratorio, basado en WordPress con el plugin PerfectSurvey, me topé con una...

CVE-2026-5399

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2023-6875

CVE-2023-6875 Exploit for PostSMTP - Unauthorized Account Takeover. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2025-23968

AI Bud – Generador de contenido AI, Chatbot AI, ChatGPT, Gemini, GPT-4o El plugin AI Bud expone un endpoint de API REST /wp-json/ai-buddy/v1/wp/attachments que permite subir archivos a la biblioteca de medios de WordPress. La lógica de archivos del endpoint contiene funcionalidad de renombrado qu...

CVE-2025-10658

Exploit: Fuerza Bruta OTP de Invitado de SupportCandy → Toma de Control de Cuenta 1 Iniciar el flujo de inicio de sesión con OTP navegador Abrir: root@kitploit: /support/ Seleccionar inicio de sesión como invitado / OTP Ingresar el correo electrónico objetivo ej. [email protected] Enviar 2...

EUVD-2026-75366

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

EUVD-2026-75365

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5118

CVE-2026-5118 — Divi Form Builder = 5.1.2 — Escalada de Privilegios No Autenticada mediante Inyección de Rol 🔥 Resumen de la Vulnerabilidad El plugin de WordPress Divi Form Builder en versiones = 5.1.2 es vulnerable a una escalada de privilegios no autenticada. Esta falla crítica permite a...