316455 matches found
WordPress Awin Data Feed <=1.6 - Cross-Site Scripting
WordPress Awin Data Feed plugin 1.6 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action, available to both unauthenticated and authenticated users. id: CVE-2022-1937 info: name: WordPress Awin Data Feed...
Member Hero <=1.0.9 - Remote Code Execution
WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...
The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting
The Wordpress plugin Code Snippets before 2.14.3 does not escape the snippets-safe-mode parameter before reflecting it in attributes, leading to a reflected cross-site scripting issue. id: CVE-2021-25008 info: name: The Code Snippets WordPress Plugin 2.14.3 - Cross-Site Scripting author: cckuailo...
Super Socializer < 7.13.52 - Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-2779 info: name: Super Socializer 7.13.52 - Cross-Site Scripting author: r3Y3r53...
LearnPress Plugin < 4.2.0 - Local File Inclusion
Local File Inclusion vulnerability in LearnPress โ WordPress LMS Plugin = 4.1.7.3.2 versions. id: CVE-2022-47615 info: name: LearnPress Plugin 4.2.0 - Local File Inclusion author: DhiyaneshDK severity: critical description: | Local File Inclusion vulnerability in LearnPress โ WordPress LMS Plugin...
URL Shortify <= 1.12.1 - Open Redirect
The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirectto' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentiall...
CVE-2018-15877-RCE
CVE-2018-15877-RCE RCE via the Planview Activity Monitor plugin for wordpress. Requirements: Python3 Selenium Usage: ./exploit.py...
CVE-2024-6536
Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...
CVE-2025-30567
Introduction Unauthorized Arbitrary File Download in WordPress WP01๏ผ Environment setup Step 1: Download the WP01 Plugin๏ผBut... Haha, don't worry, here is the source code of the plugin. Step 2: Package the provided wp01 folder and upload it to the WordPress plugins section.like this-- Analysis It'...
vulnerable-bsr-lab-CVE-2023-6933
CVE-2023-6933 Vulnerability Lab Overview This laboratory environment demonstrates CVE-2023-6933, a critical PHP Object Injection vulnerability in the Better Search Replace WordPress plugin versions โค1.4.4. Vulnerability Details CVE ID : CVE-2023-6933 CVSS Score : 9.8 Critical Affected Plugin :...
CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset
CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Information on the vulnerability Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lea...
CVE-2026-3576
CVE-2026-3576 - Wordpress Plugin Planyo Online Reservation System -f --disable-check python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd Example โโ$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd Checking if target is v...
CVE-2024-27956
WP Automatic Plugin SQL Injection Exploit CVE-2024-27956 A proof-of-concept exploit for the SQL injection vulnerability in WP Automatic plugin CVE-2024-27956 affecting WordPress sites. ๐ Description This exploit targets a critical unauthenticated SQL injection vulnerability in the WP Automatic...
wordpress-jetpack-broken-access-control-vulnerable-application
wordpress-jetpack-broken-access-control-vulnerable-application This is a vulnerable application to test the exploit for the Jetpack 13.9.1 broken access control CVE-2024-9926. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a...
CVE-2025-1639
๐ Exploit Script for CVE-2025-1639 ๐ Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...
CVE-2024-5326-Poc
CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin โ PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin โ PostX plugin for WordPress is vulnerable to unauthorized modification of data...
CVE-2024-10793
CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py This script first identifies the version to determine if it is a vulnerable version, then attempts to confirm whether the log file exists. If it exists, it will try to send a request and then request the log file again to search for...
CVE-2025-8359
CVE-2025-8359 AdForest Repo: Nxploited/CVE-2025-8359 Exploit Script: CVE-2025-8359.py ๐ Description CVE: CVE-2025-8359 Vulnerability Type: Authentication Bypass Affected Product: AdForest - Classified Ads WordPress Theme Affected Versions: Up to and including 6.0.9 CVSS Score: 9.8 Critical The...