WordPress Mang Board plugin <= 2.4.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Mang Board WP versions = 2.4.4...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Unauthenticated SQL Injection via orderby Parameter Description The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3...

By-Poloss..-..CVE-2026-19125

CVE-2026-19125 — EthPress login; // wpsetauthcookie Execution continues into the login block, Address::login resolves the attacker-supplied wallet address to its owning WordPress user, and wpsetauthcookie authenticates that user. The response is "success":true,"data":"message":"Logged in". 2...

CVE-2024-56289

CVE-2024-56289 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Vulnerable version Since this plugin uses the REST API, the Permalink must be set to Post name. 2. Subsequently, accessing...

CVE-2024-56278

CVE-2024-56278 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name WP Ultimate Exporter Vulnerable version ⚠️ Since the 'WP Ultimate Exporter' plugin is an addon for the 'WP Ultimate CSV Importer' plugin, both plugins need to be installed. 1. Create a new post using the code...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

CVE-2026-1357

CVE-2026-1357 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File Upload → RCE Proof-of-concept for CVE-2026-32475 CVSS 9.0: an unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin ≤ 4.2.1 that leads to remote code execution. | ---|--- CVE| CVE-2026-32475 CVSS| 9....

Mass-Scanner-CVE-2026-3891

Mass Scanner CVE-2026-3891 A clean and animated GitHub presentation for a Python-based Mass Scanner CVE-2026-3891 focused on validating a specific WordPress AJAX behavior in controlled environments. This repository is intended strictly for authorized security testing, internal audits, lab...

Mass-Scanner-CVE-2026-2631

⚡ CVE-2026-2631 Async Mass Checker Private async mass-checker for internal WordPress validation 🚨 Warning This tool performs a destructive validation. It sends a POST request to the target endpoint and may changeshopsecret on vulnerable targets. Use it only on systems you own or are explicitly...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 Clean WordPress Mass Scanner for CVE-2026-1405 🧠 Overview A clean and lightweight scanner built to check CVE-2026-1405 exposure across multiple WordPress targets. It focuses on: fast multi-target scanning clean terminal output simple result classification easy usage f...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload ⚠️ Disclaimer THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. The...

WordPress NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability discovered by Eunho Kim in WordPress Plugin NotificationX versions = 3.3.3...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE Unauthenticated arbitrary file upload leading to RCE in the Realtyna WPL / Organic IDX WordPress plugin real-estate-listing-realtyna-wpl ≤ 5.2.0. The plugin registers an "I/O service" on the public WordPress...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 is an Unauthenticated SQL Injection SQLi vulnerability affecting the WP Ticket Customer Support Ticket System & Helpdesk plugin for WordPress up to and including version 6.0.4.The flaw occurs because the plugin takes the WordPress search parameter s and concatenates it...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...

CVE-2025-9286

CVE-2025-9286 Appy Pie Connect for WooCommerce = 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation ⚠️ Appy Pie Connect for WooCommerce = 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via resetuserpassword 📝 Description The Appy Pie Connect for WooCommerc...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution CVE-2026-13714 — WPL Real Estate Unauthenticated RCE Realtyna Organic IDX plugin + WPL Real Estate for WordPress 5.3.0 Unauthenticated arbitrary file upload via...

CVE-2025-8359

CVE-2025-8359 AdForest Repo: Nxploited/CVE-2025-8359 Exploit Script: CVE-2025-8359.py 📋 Description CVE: CVE-2025-8359 Vulnerability Type: Authentication Bypass Affected Product: AdForest - Classified Ads WordPress Theme Affected Versions: Up to and including 6.0.9 CVSS Score: 9.8 Critical The...

CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeover — Password Reset Email Hijacking in Kirki Customizer Framework CVSS v3.1 9.8 / 10.0 CRITICAL Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 1. Overview CVE-2026-8206 is an Unauthenticated Account Takeover vulnerability in Kirki Customizer...