TypeHub-Exploiter

TypeHub Exploiter This script exploits a vulnerability CVE-2021-25094 in the TypeHub WordPress plugin...

CVE-2022-21661

🛡️ CVE-2022-21661 A Proof-of-Concept PoC exploit written in Python for CVE-2022-21661, which is a critical vulnerability in WordPress that allows an unauthenticated attacker to perform an object injection attack , which under certain conditions can lead to Remote Code Execution RCE. This...

POC-CVE-2014-0166

POC&EXP of CVE-2014-0166 WordPress 3.8.2 cookie forgery vulnerability Details of this vulnerability can be found athere There are three files: wpzerocookiegenerator.php POC to verify this vulnerability. It won't send any requests, just a local brute-forcer. Redefine variables to supply info and i...

Python-CVE-2020-25213

Python-CVE-2020-25213 Python Interactive Exploit for WP File Manager Vulnerability. The File Manager wp-file-manager plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php...

CVE-2025-25163-Nuclei-Template

Nuclei Template for CVE-2025-25163 🚀 Overview This repository features a Nuclei template specifically designed to detect the Path Traversal vulnerability CVE-2025-25163 in the Plugin A/B Image Optimizer for WordPress. This vulnerability poses a critical security risk, allowing unauthorized access...

CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...

CVE-2019-9978

CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'cat /etc/passwd' ✅ Step 2 – Start a Python HTTP Server Use Python to serve your payload: python3 -m http.server 8000 This will make your payload.txt accessible at: http://:8000/payload.txt ✅ Step 3 – Run the Exploit python3 CVE-2019-9978....

CVE-2017-8295

CVE-2017-8295 Wordpress has a password reset feature that contains a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication. Such attack could lead to an attacker gaining unauthorised access to a victim's WordPress account...

CVE-2024-6205

CVE-2024-6205 pip install requests This is a python written PoC of a recent vulnerability in a wordpress plugin. More information on that here https://nvd.nist.gov/vuln/detail/CVE-2024-6205 https://cvefeed.io/vuln/detail/CVE-2024-6205...

Exploit_CVE-2021-24762

exploitcve-2021-24762 This repo shows an exploit to CVE-2021-24762. This is an Blind SQLi exploit that, on default config, greps the admin password. While doing a lab, based on Wordpress with PerfectSurvey plugin, I stucked on a sql vulnerability. The only available PoC I found were based on sqlm...

CVE-2025-2011-poc

WordPress Depicter Plugin 3.6.1 - SQL Injection usage: exploit.py -h -u URL -D DATABASE -T TABLE -C COLUMN...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Authentication Bypass Description: The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login...

CVE-2024-11635

WordPress File Upload This README documents a disclosed vulnerability for educational and defensive use only. Donot run tests against production systems or systems you do not own or have explicit permission to test. Discovered by: abrahack Status: Public Disclosure Date Reported: 2025-01-07 CVE I...

CVE-2025-6058

🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit Unauthenticated Arbitrary File Upload Exploit targeting WordPress WPBookit Plugin ≤ 1.0.4 Exploit allows remote shell upload and full command execution. Author: 0xgh057r3c0n 📌 About The Vulnerability CVE-2025-6058 is...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...

CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port LOCALPORT...

CVE-2022-1119

CVE-2022-1119 1.Introduction WordPress Simple File List 3.2.8 FileRead POC 2.Usage poc -f host.txt // Batch scan poc -h 192.168.1.1 // Single scan 3.Disclaimer This tool is only for learning, research, and self-assessment. It should not be used for illegal purposes. Please comply with relevant la...

CVE-2025-34085

Cyberlone Indonesia 🛠️ WordPress Simple File List RCE Scanner + Auto-Clean Automated tool to detect and exploit unauthenticated Remote Code Execution RCE on the WordPress Simple File List plugin, specifically those vulnerable to CVE-2025-34085. Equipped with an automatic target cleaning system and...

CVE-2026-6279

╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder = 3.15.2 ║ ║ Unauthenticated RCE via calluserfunc ║ ╚══════════════════════════════════════════════════════════════╝ 📋 Summary Field| Detail ---|--- CVE ID| CVE-2026-6279 Affected| Avada Builder Fusio...