CVE-2026-9055

CVE-2026-9055 — Amelia Booking Plugin Unauthenticated Privilege Escalation Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for this vulnerability. An unauthenticated privilege escalation vulnerability in the Amelia Premium WordPress...

CVE-2026-82221-PoC

CVE-2026-82221 - Unauthenticated Reflected XSS in RegistrationMagic Overview This repository contains a Proof-of-Concept PoC for CVE-2026-82221 , an unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered in the RegistrationMagic WordPress plugin. The vulnerability affects the...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week. Review those...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...

CVE-2026-7567-POC

Description This repository contains a Proof of Concept PoC for CVE-2026-7567. The vulnerability affects Wordpress Temporary Login Plugin = 1.0.0 and allows an attacker to authentication bypass to account takeover. I only developed the exploit/PoC for educational and research purposes. How to use...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms Fix A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution CVE-2026-39440, CVSS 9.9. The Vulnerability Field| Value ---|--- CVE ID| CVE-2026-39440 CVSS Score| 9.9 Critical Affected|...

cve-2026-4257

CVE-2026-4257 This exploits CVE-2026-4257, a Server-Side Template Injection SSTI vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution. The vulnerability exists in the...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - AdForest WordPress Authentication Bypass PoC Description Simple Proof of Concept for CVE-2026-1729 PoC - Authentication bypass vulnerability in AdForest WordPress Theme. Authored by f3ds cr3w est 2oo2 blog Features ✅ Direct admin access without credentials ✅ Works on production...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...

cve-2026-64638-banner-poc

CVE-2026-64638 — Universal Banner PoC A single-file, dependency-free PoC generator for the WordPress CVE-2026-64638 reflected HTML-injection on wp-login.php striptags vs. KSES parser differential. It produces a self-submitting trigger page: when the victim opens the file, the page silently POSTs...

ODH-BricksBuilder-CVE-2024-25600-THM

ODH-BricksBuilder-CVE-2024-25600-THM Overview This repository hosts a Python-based vulnerability scanner developed by Oblivion Development & Hosting OD&H to detect CVE-2024-25600 in the Bricks Builder plugin for WordPress. This tool is designed primarily for use within Try Hack Me THM exercises,...

CVE-2025-68001

CVE-2025-68001 WordPress g-FFL Checkout Plugin 📡 Stay ahead of the curve. Join @KNxploited on Telegram — your exclusive source for the latest CVEs, zero-days, and cutting-edge exploit research. Updated constantly. Not for everyone. 📋 Overview CVE-2025-68001 is a critical Unauthenticated Arbitrary...

CVE-2025-11627

Send a crafted request to the AJAX handler with the extracted nonce. = // 1 find the inline script that contains the AJAX URL const s = ...document.scripts.findsc = sc.textContent.includes'billminozzijserrorcatched'; if !s console.error'Script with ajax URL not found. Is wphead present?'; return;...

PoC_CVE-2025-2568

PoC CVE-2025-2568 Overview The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the vayublocksgettoggleswitchvaluescallback and vayublockssavetoggleswitchcallback...

Orbit-Fox_SSRF_CVE-2025-10874

CVE-2025-10874 - Orbit Fox SSRF Proof of Concept Proof of concept exploit demonstrating Server-Side Request Forgery SSRF vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass. Detailed blog post: https://ryanmroth.com/articles/orbit-fox-ssrf Vulnerability Details Detail|...

CVE-2026-1581-Analysis-Lab

CVE-2026-1581 — wpForo Forum GET'wpfob' → wpforosanitizeorderby..., context, default Behav...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.2.8...

exploit-CVE-2023-3460

title: "IT Security - CVE 2023-38408" Analysis and exploitation of CVE-2023-3460 CVE ID| CVSS Score| Discovered| Affected Plugin| Vulnerability Type ---|---|---|---|--- CVE-2023-3460| | 07/04/2023| Ultimate Member| Unauthorized Admin Access Table of Contents Introduction General vulnerability...

CVE-2025-8625

CVE-2025-8625 — PoC Overview This repository contains the source files for an article on Xakep.ru. The repository contains demonstration materials intended exclusively for security research, education, and testing in isolated laboratory environments. The repository is not intended for use against...

CVE-2025-57926

Sink: According to the mechanism of WordPress Core, XSS is prevented in post content, but with this plugin, the content is encoded and then decoded when rendered, unintentionally creating an XSS vulnerability." PoC: The base64 encoded payload is PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...