EUVD-2025-211055

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...

CVE-2026-87841

The UnitechPay WordPress plugin, version 1.0.6.3 and below , contains a vulnerability where it fails to verify the authenticity of incoming payment notifications. This allows unauthenticated attackers to bypass payment processes by marking orders as paid without actual payment or forcing other or...

CVE-2025-15700

The AWP Classifieds WordPress plugin before version 4.4.9 contains a vulnerability where it fails to validate file types extracted from uploaded ZIP archives during the listing-import feature. This allows users with management capabilities to upload arbitrary PHP files to a publicly accessible, n...

CVE-2026-106095

The Code Snippets WordPress plugin, versions prior to 3.10.0 , is vulnerable to unauthorized snippet management due to a missing capability check . The update_code_snippet action fails to verify permissions and incorrectly derives the network scope from the request rather than the stored record. ...

EUVD-2026-95504

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

EUVD-2026-95501

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin, affecting versions up to and including 1.0 , contains a vulnerability where it fails to perform capability or nonce checks on two specific AJAX actions. Because these actions are accessible to unauthenticated users , an attacker can permanentl...

CVE-2026-92990

The SendPress Newsletters WordPress plugin, version 1.26.1.20 and below, is vulnerable to an unauthenticated newsletter sending log disclosure . The root cause is a hardcoded token used to protect a logging endpoint; because this token is identical across all installations instead of being a uniq...

CVE-2026-88931

The Social Web Suite WordPress plugin (version 4.1.12 and below ) contains a vulnerability where it fails to restrict which settings can be modified via an unauthenticated endpoint . This flaw allows an attacker to overwrite arbitrary plugin options, including the shared secret used to protect th...

BurpWpsScan

Support Development If this project helps your work, support ongoing maintenance and new features. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. BurpWpsScan A Burp Suite extension that detects WordPress sites during web applicati...

sudowp-hooks-visualizer

SudoWP Hooks Visualizer Contributors: SudoWP, WP Republic Original Authors: Stuart O'Brien, cxThemes Tags: hooks, actions, filters, developer-tool, debug, security-fork, cve-2024-6297 Requires at least: 5.8 Tested up to: 6.7 Stable tag: 1.3.2 License: GPLv2 or later Security Notice CVE-2024-6297...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

CVE-2020-24186-wpDiscuz-7.0.4-RCE

POC CVE-2020-24186-wpDiscuz-7.0.4-RCE WordPress wpDiscuz 7.0.4 Remote Code Execution A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

CVE-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin Example PoC - https://youtu.be/n1e4aFmXvOk Links CVE-2021-38314...

NekoBotV1

NekoBotV1Rev | Auto Exploiter With 500+ Exploit 2000+ Shell For Old version NekobotV1 NekoBotV1Rev is an auto exploit tool to facilitate the penetration of one or many websites Wordpress, Joomla, Drupal, Magento, Opencart,and Etc. Features : + Wordpress : 1- Cherry-Plugin 2- download-manager Plug...

CVE-2023-5360

CVE-2023-5360 Elementor File Upload Exploit The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. / / | / / / / / | | / / / / / | |/ /// /...

CVE-2024-1071-Docker

CVE-2024-1071 con Docker 🎯 ¿Quieres practicar con el nuevo CVE de WordPress? Sigue las instrucciones Montar el laboratorio 1. Instala Docker: https://docs.docker.com/get-docker/ 2. Clona el proyecto: git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Ve al proyecto: cd...

CVE-2024-8353

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias acuokon, quien descubrió esta vulnerabilidad. Introducción Análisis adicional de CVE-2024-5932 EQST Insight R&Tarchivo PDF. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353...

Wordpress-DOS-Attack-CVE-2018-6389

Wordpress-DOS-Attack-CVE-2018-6389 El archivo load-scripts.php, cuyo propósito es recuperar varios paquetes de JavaScript a través de una sola solicitud. $ chmod +x Execute.sh $ ./Execute.sh ¡Cómo funciona! El problema radica en el archivo load-scripts.php, cuyo propósito es recuperar varios...