CVE-2024-11613-wp-file-upload

CVE-2024-11613-wp-file-upload Exploit by Chirag Artani https://3rag.com for CVE-2024-11613 in WordPress File Upload Here is information - The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to,...

CVE-2026-6227

CVE-2026-6227: Local File Inclusion in BackWPup Advisory Summary BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion LFI vulnerability via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The flaw was caused by non-recursive...

Poc-CVE-2025-9519

Easy Timer v4.2.1 - Prerequisites Docker Engine installed Docker Compose installed Refer to the official Docker docs for installation: Docker Engine Install 1. Start WordPress with Docker From your project directory: sudo docker-compose up -d mkdir -p wp-content/plugins cd wp-content/plugins wget...

CVE-2026-3228

CVE-2026-3228 - NextScripts WordPress Plugin Stored XSS Scanner & Exploit https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/WordPress-Plugin-red Author: NULL200OK A comprehensive Python tool to scan for and exploit...

CVE-2025-5947_Exploit

🔍 WordPress Plugin Exploit — Service Finder sf-booking Overview The Service Finder plugin is a booking and service management system for WordPress. Because of its popularity and complexity, some versions have had security issues related to unauthenticated AJAX endpoints or improper access control...

CVE-2025-8081-Elementor

CVE-2025-8081 - Elementor Arbitrary File Read Vulnerability A critical arbitrary file read vulnerability in Elementor WordPress plugin that allows authenticated administrators to read any file accessible by the web server, including sensitive configuration files containing database credentials. 📋...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC Discovered by: Lucas Montes NiRoX Vulnerability: Unauthenticated Arbitrary File Upload leading to Remote Code Execution RCE CVE ID: CVE-2026-1357 CVSS: Critical9.8 Status: Patched in version 0.9.124 Overview This repository contains the analysis an...

WordPress-Flex-QR-Code-Generator---CVE-2025-10041

CVE-2025-10041: Arbitrary File Upload Vulnerability Analysis in the Flex QR Code Generator Plugin 1. Vulnerability Overview Plugin Name : Flex QR Code Generator Affected Versions : ≤ 1.2.5 all versions Vulnerability Type : Arbitrary File Upload → Remote Code Execution RCE Exploitation Conditions ...

WordPress InstaWP Connect – 1-click WP Staging & Migration plugin <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by thevietronin in WordPress Plugin InstaWP Connect versions = 0.1.4.1...

CVE-2026-0920

Exploit Research: CVE-2026-0920 - LA-Studio Element Kit Backdoor Technical analysis and Proof of Concept PoC for the critical backdoor discovered in LA-Studio Element Kit for Elementor versions ≤ 1.5.6.3. This vulnerability allows unauthenticated administrative account creation. Vulnerability...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; Elementor's editor sanitizes input on the client side, but the REST API endpoint /wp-json/wp/v2/posts/id accepts the elementordata meta field directly and bypasses that layer entirely. An authenticated Contributo...

CVE-2025-6934

CVE-2025-6934 Auto Exploit ⚡ Overview CVE-2025-6934 is a proof-of-concept PoC exploit targeting WordPress Plugin: Opal Estate Pro ≤ 1.7.5. This exploit demonstrates unauthenticated administrator account creation. Disclaimer: This PoC is for educational purposes only. Do not use on systems without...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - Missing Authorization to Authenticated Student+ Privilege Escalation to Administrator 🔴 Vulnerability Overview CVE-2026-4484 — Authenticated Privilege Escalation Student → Administrator Field| Details ---|--- CVE ID| CVE-2026-4484 Severity| HIGH — CVSS v3.1...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration 🔴 Vulnerability Overview CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration Field| Details ---|--- CVE ID| CVE-2026-1492 Severity| CRITICAL — CVSS...

CVE-2026-1375

CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...

Metasploit-Wordpress-Canto-Exploit-RCE

Metersploit exploit module canto RCE CVE-2024-25096 & CVE-2023-3452 This exploit is a proof-of-work exploit of the RFI vulnerabilities CVE-2024-25096 and CVE-2023-3452, which allow the attacker to establish an interactive remote shell session on the target. CVE-2024-25096 abuses the abspath...

CVE-2025-14998

Wordpress Branda – White Label & Branding, Free Login Page Customizer getrow $wpdb-prepare...

MegaQuagga_Pentesting_Report

MegaQuagga Pentesting Report This repository contains a full web application penetration test performed against a WordPress environment. The assessment includes vulnerability discovery, exploitation, post-exploitation, and documentation of real-world attack impact. 🔍 Project Overview Target:...

WordPress-6.9.1-Blind-SSRF

WordPress-6.9.1-Blind-SSRF The exploit has no cve assigned. Affected Versions 6.8 - 6.8.3 6.9 - 6.9.1 WordPress = 6.9.1 - Unauthenticated Blind SSRF via XML-RPC Pingback Discovery proof of concept PoC Usage 1. Install requests if not yet installed pip install requests 2. Change config variables...

WordPress Gwolle Guestbook plugin <= 5.1.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Gwolle Guestbook versions = 5.1.1...