WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.7 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin ELEX WordPress HelpDesk & Customer Ticketing System versions = 3.3.7...

WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dzaku in WordPress Plugin AI Engine versions = 3.8.3...

WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WordLift versions = 3.54.15...

WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetSmartFilters versions = 3.8.6...

WordPress WP Booking System plugin <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Booking System versions = 2.1.0.1...

WordPress User Registration & Membership plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via displayname vulnerability discovered by hashiramasenju333 in WordPress Plugin User Registration versions = 5.2.8...

CVE-2021-24307-all-in-one-seo-pack-admin-rce

Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: php exploit.php u...

CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector

CYBERDUDEBIVASH Modular DS CVE-2026-23550 Detector Overview This is an authorized CYBERDUDEBIVASH ECOSYSTEM tool for detecting CVE-2026-23550 in WordPress Modular DS plugin. It non-destructively checks for vulnerable versions = 2.5.1 by parsing the plugin's readme.txt. Ideal for cybersecurity...

CVE-2026-1357-POC

CVE-2026-1357 — WPvivid Backup & Migration RCE CVE Credit: Lucas Montes NiRoX Tool By: CyberTechAjju CVSS: 9.8 Critical | Affected: ≤ 0.9.123 | Patched: 0.9.124 ⚠️ Disclaimer For authorized security testing only. Unauthorized access to systems is illegal. Overview Unauthenticated RCE in WPvivid...

CVE-2026-1056-POC

CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitrary File Deletion PoC This repository contains a Proof of Concept PoC for a critical vulnerability in the Snow Monkey Forms WordPress plugin versions send; // Direct execution flow to send // CSRF check is only performed for other method...

CVE-2026-1844

PixelYourSite PRO - Unauthenticated Stored Cross-Site ScriptingCVE-2026-1844 Overview The PixelYourSite PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pysTrafficSource' parameter and the 'pyslandingpage' parameter in all versions up to, and including, 12.4.0.2 due ...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...

CVE-2026-23550-PoC

CVE-2026-23550-PoC CVE-2026-23550 - Modular DS WordPress Plugin Unauthenticated Admin Access Proof-of-Concept PoC demonstrating CVE-2026-23550 - critical unauthenticated admin account takeover in Modular DS WordPress plugin versions ≤2.5.1. Actively exploited in the wild. Attack Summary : Flawed...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Theklis in WordPress Plugin Forminator versions = 1.58.1...

WordPress Mang Board plugin <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin Mang Board WP versions = 2.4.3...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for WordPress ≤ 6.4.21 Table of Contents Vulnerability Overview Technical Analysis Lab Requirements Lab Setup Running the PoC Expected Output Patch Analysis References...

WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.8 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Azgnt in WordPress Plugin miniorange otp verification versions = 5.5.8...

CVE-2024-11613-wp-file-upload

CVE-2024-11613-wp-file-upload Exploit by Chirag Artani https://3rag.com for CVE-2024-11613 in WordPress File Upload Here is information - The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to,...

CVE-2026-6227

CVE-2026-6227: Local File Inclusion in BackWPup Advisory Summary BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion LFI vulnerability via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The flaw was caused by non-recursive...

Poc-CVE-2025-9519

Easy Timer v4.2.1 - Prerequisites Docker Engine installed Docker Compose installed Refer to the official Docker docs for installation: Docker Engine Install 1. Start WordPress with Docker From your project directory: sudo docker-compose up -d mkdir -p wp-content/plugins cd wp-content/plugins wget...