CVE-2021-24959

CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...

CVE-2025-6389

CVE-2025-6389 Sneeit Framework 📡 Don't miss the next drop. Follow @KNxploited on Telegram — the definitive channel for freshly disclosed CVEs, working exploits, and elite security research. First to know. First to act. 🧠 Overview CVE-2025-6389 is a CVSS 9.8 Critical Remote Code Execution...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2025-15521

CVE-2025-15521 The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. | | | | || | | | || | | | | | | | --| | | || | | | | ||| || | | || | ||/|| ||||| |||||...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 The intel drops here first. Follow @KNxploited on Telegram — precision CVE disclosures, working exploits, and deep-dive vulnerability research. The channel for those who don't wait for the news — they make it. 🧠 Overview CVE-2025-15403 is a CVSS 9.8 Critical...

CVE-2025-49388

CVE-2025-49388 WordPress Miraculous Core Plugin Plugin OPTIONS Example: python CVE-2025-49388.py -u http://127.0.0.1/wordpress Main Options: Option| Description| Examp...

CVE-2024-10673

🔥 Overview This script exploits CVE-2024-10673 , a critical vulnerability found in the Top Store WordPress Theme = 1.5.4. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. ⚠️ Severity & Impact...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. usage:...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

Vitepos-CVE-Report

Vitepos-CVE-Report Disclosure for CVE-2025-13156 CVE-2025-13156 - Vulnerability in Vitepos – Point of Sale POS for WooCommerce This repository discloses a vulnerability discovered in Vitepos – Point of Sale POS for WooCommerce =' \ -H 'X-WP-Nonce: ' \ -F 'categoryname=evil' \ -F 'categoryparent=0...

Flo-Forms-CVE-Report

Flo-Forms-CVE-Report Disclosure for CVE-2025-13159 CVE-2025-13159 - Vulnerability in Flo Forms – Easy Drag & Drop Form Builder This repository discloses a vulnerability discovered in Flo Forms – Easy Drag & Drop Form Builder ' \ -F 'flo-form-model=' \ -F 'flo-form-schema="groups":' \ -F...

CVE-2025-6934

🚨 WordPress OpalEstate Plugin - Unauthenticated Privilege Escalation Vulnerability 🔎 Description The OpalEstate plugin for WordPress contains a critical vulnerability in its AJAX registration handler, allowing unauthenticated users to register as administrators. The issue lies in the insecure...

EventON-Lite-CVE-Report

EventON-Lite-CVE-Report Disclosure for CVE-2025-8091 CVE-2025-8091 - Vulnerability in EventON Lite This repository discloses a vulnerability discovered in EventON Lite = 2.4.6,WordPress plugin developed by Ashan Perera. 🛠 Affected Version Product : EventON Lite Version : v2.4.6 URL :...

CVE-2022-0739-Exploitation

CVE-2022-0739-Exploitation An exploitation of CVE-2022-0739. It about BookingPress WordPress plugin before 1.0.11. By using bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection. Since the plugin fails to properly sanitize...

CVE-2016-10924

CVE-2016-10924 CVE-2016-10924 - Directory traversal vulnerability in WordPress ebook-download plugin1.2. PoC + PID Bruteforce in Python. Usage git clone https://github.com/rvizx/CVE-2016-10924 cd CVE-2016-10924 python pidbrute.py...

CVE-2018-15877-RCE

CVE-2018-15877-RCE RCE via the Planview Activity Monitor plugin for wordpress. Requirements: Python3 Selenium Usage: ./exploit.py...

CVE-2024-8484

CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - Unauthenticated SQL Injection CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram Description: The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the...

CVE-2024-3922-Poc

CVE-2024-3922-Poc Dokan Pro Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.110.184:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/126.0.0.0 Safari/537.36 Accept:...

WordPress-NotificationX-CVE-2024-1698

Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2025-22652

CVE-2025-22652 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Payment Forms for Paystack Vulnerable version = 4.0.1 Component slug payment-forms-for-paystack Component link https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class...