CVE-2023-28121

CVE-2023-28121 usage: CVE-2023-28121.py -h -v RHOST RPORT WooCommerce Payments WordPress plugin = 5.6.1 CVE-2023-28121 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-28121 positional arguments: RHOST remote host RPORT remote port optional arguments: -h, --help show this help message an...

XSS2Shell

XSS2Shell XSS2Shell is an educational proof of concept for CVE-2026-64638 , demonstrating the impact of a pre-authentication XSS issue in vulnerable WordPress installations. With an administrator's explicit participation, the PoC captures a WordPress Application Password, publishes a temporary...

wp2shell-scan

wp2shell-scan Detect and clean upwp2shell CVE‑2026‑63030 compromise across one or many WordPress sites. wp2shell is the pre‑authentication remote‑code‑execution vulnerability fixed in WordPress 7.0.2 / 6.9.5 / 6.8.6 2026‑07‑17. A public PoC appeared within a day and mass‑exploitation followed...

CVE-2023-1430

Update 2023-06-12: You no longer need the snippet. WPManageNinja patched the vulnerability two hours after public disclosure 93 days after reporting. Update 2024-01-27: The related issue with with everlasting hash values is now fully addressed. Responsible disclosure of unpatched vulnerability...

CVE-2025-4631

🚨 CVE-2025-4631 - Profitori WordPress Plugin Privilege Escalation Exploit 📌 Vulnerability Summary Profitori Plugin versions 2.0.6.0 to 2.1.1.3 is vulnerable to unauthenticated privilege escalation due to a missing capability check in the /wp-json/stocktend/v1/stocktendobject endpoint. This allows...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

CVE-2020-12696

CVE-2020-12696 ██╗ ██╗███████╗███████╗ ╚██╗██╔╝██╔════╝██╔════╝ ╚███╔╝ ███████╗███████╗ ██╔██╗ ╚════██║╚════██║ ██╔╝ ██╗███████║███████║ ╚═╝ ╚═╝╚══════╝╚══════╝ Iframe iframe src="javascript:confirmdocument.cookie" width="100%" height="500" Version plugin: 4.4 Tested on: WordPress 5.2.4 Researche...

CVE-2023-29386

CVE-2023-29386 — Manager for Icomoon This README documents a disclosed vulnerability for educational and defensive use only. Donot run tests against production systems or systems you do not own or have explicit permission to test. Discovered by: deokhunKim Status: Public Disclosure Date Reported:...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ -----------------------------124662954...

CVE-2026-81780-Hash-Form

CVE-2026-81780-Hash-Form CVE-2026-81780 — Hash Form RCE The Vulnerability Unauthenticated file upload in WordPress Hash Form plugin ≤ 1.4.2. The plugin allows arbitrary file uploads without proper authentication or file type validation, leading to Remote Code Execution RCE. Exploit Chain Step...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

CVE-2023-47504-POC

CVE-2023-47504 POC Exploit for CVE-2023-47504. According to NIST, this vulnerability should allow unauthenticated users to access functionalities in the Elementor Website Builder Plugin. Based on my research into the vulnerability, and also judging by the URL from Patchstack that describes the...

CVE-2022-21661

CVE-2022-21661 POC Video | WordPress Core 5.8.2 - 'WPQuery' SQL Injection CVE-2022-21661 : EDB : https://www.exploit-db.com/exploits/50663...

CVE-2024-2876

CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

CVE-2024-1071-Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Go to the project : cd...