318926 matches found
WordPress Search Regex plugin <= 3.5 - Authenticated (Subscriber+) Remote Code Execution vulnerability
Authenticated Subscriber+ Remote Code Execution vulnerability discovered by R3D in WordPress Plugin Search Regex versions = 3.5...
WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...
WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter vulnerability
Unauthenticated Privilege Escalation to 'role' Parameter vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Profile Builder versions = 4.0.3...
WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MDTF versions = 1.4.0...
WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by ssophiz in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...
WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability
Other vulnerability Type vulnerability discovered by Peter Tang in WordPress Plugin Booking and Rental Manager versions = 2.8.0...
WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.7 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin ELEX WordPress HelpDesk & Customer Ticketing System versions = 3.3.7...
WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dzaku in WordPress Plugin AI Engine versions = 3.8.3...
WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WordLift versions = 3.54.15...
WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetSmartFilters versions = 3.8.6...
WordPress WP Booking System plugin <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Booking System versions = 2.1.0.1...
WordPress User Registration & Membership plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name vulnerability
Authenticated Subscriber+ Arbitrary Shortcode Execution via displayname vulnerability discovered by hashiramasenju333 in WordPress Plugin User Registration versions = 5.2.8...
CVE-2021-24307-all-in-one-seo-pack-admin-rce
Admin PHP unserialization RCE in All in one SEO pack CVE-2021-24307 Simple PoC of an admin authenticated RCE in AISEO = 4.1.0.1 provided as an example. Full write-up here: https://darkpills.com/php-unserialize-write-up-with-admin-rce-in-all-in-one-seo-pack-cve-2021-24307/ Usage: php exploit.php u...
WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Theklis in WordPress Plugin Forminator versions = 1.58.1...
WordPress Mang Board plugin <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin Mang Board WP versions = 2.4.3...
CVE_2026_2576_PoC
CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for WordPress ≤ 6.4.21 Table of Contents Vulnerability Overview Technical Analysis Lab Requirements Lab Setup Running the PoC Expected Output Patch Analysis References...
WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.8 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Azgnt in WordPress Plugin miniorange otp verification versions = 5.5.8...
CVE-2024-11613-wp-file-upload
CVE-2024-11613-wp-file-upload Exploit by Chirag Artani https://3rag.com for CVE-2024-11613 in WordPress File Upload Here is information - The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to,...
WordPress InstaWP Connect – 1-click WP Staging & Migration plugin <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by thevietronin in WordPress Plugin InstaWP Connect versions = 0.1.4.1...
CVE-2025-6934
CVE-2025-6934 Auto Exploit ⚡ Overview CVE-2025-6934 is a proof-of-concept PoC exploit targeting WordPress Plugin: Opal Estate Pro ≤ 1.7.5. This exploit demonstrates unauthenticated administrator account creation. Disclaimer: This PoC is for educational purposes only. Do not use on systems without...