WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Suphakit Phrmduang TORTY in WordPress Plugin WP Dark Mode versions = 5.3.17...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticated Privilege Escalation Python 3 PoC for CVE-2026-14281 in the WordPress plugin Automation Web Platform automation-web-platform — WAWP / Notifications & OTP for WooCommerce. PoCbit Listed on PoCbit — community catalog:...

CVE-2025-30567

Introduction Unauthorized Arbitrary File Download in WordPress WP01！ Environment setup Step 1: Download the WP01 Plugin，But... Haha, don't worry, here is the source code of the plugin. Step 2: Package the provided wp01 folder and upload it to the WordPress plugins section.like this-- Analysis It'...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py This script first identifies the version to determine if it is a vulnerable version, then attempts to confirm whether the log file exists. If it exists, it will try to send a request and then request the log file again to search for...

CVE-2023-6036

CVE-2023-6036 POC about Wordpress plugin Web3 – Crypto wallet Login & NFT token gating 3.0.0 - Authentication Bypass This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handleloginrequest’ function and ‘handleauthrequest' function Vulnerability I have...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC: https://www.youtube.com/watch?v=MbhiQKWvivQ References: https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 https://vulners.com/cve/CVE-2022-1598...

0-click-RCE-Exploit-for-CVE-2023-51409

CVE-2023-51409 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858586463777989073 This repository contains a proof-of-concept exploit for CVE-2023-51409, an unauthenticated arbitrary file upload vulnerability in the AI Engine: ChatGPT Chatbot WordPress plugin,...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

WP-CVE-2025-6934

WP-CVE-2025-6934 | Opal Estate Pro = 1.7.5 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2025-6934 vulnerability in the Opal Estate Pro = 1.7.5 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileg...

WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – Unauthenticated Arbitrary File Upload Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff :...

CVE-2026-8181

CVE-2026-8181 - Burst Statistics Authentication Bypass Exploit Python 2.7 exploit for the Burst Statistics plugin vulnerability CVE-2026-8181 that allows unauthenticated attackers to bypass REST API authentication, retrieve application passwords, and create new administrator users on vulnerable...

CVE-2024-10508

CVE-2024-10508 This tool scans WordPress sites for vulnerabilities in the RegistrationMagic plugin CVE-2024-10508. It checks for the presence of a specific version 6.0.2.6 and marks the site as vulnerable if found. The results are saved in a file vuln.txt for further analysis. Features: Scans...

WORDPRESS-CVE-2024-25600-EXPLOIT-RCE

WORDPRESS-CVE-2024-25600-EXPLOIT-RCE WORDPRESS-CVE-2024-25600-EXPLOIT-RCE - WordPress Bricks Builder Remote Code Execution RCE...

Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

A long-running Traffic Distribution System TDS known as Help TDS to a Russian-language affiliate program called Hotejka , which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners...

CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

CVE-2025-12139: Integrate Google Drive WordPress Plugin - Information Disclosure Exploit Description This is a Golang Proof of Concept PoC exploit for CVE-2025-12139. The vulnerability exists in the Integrate Google Drive plugin versions = 1.5.3 for WordPress. It allows unauthenticated attackers ...

TypeHub-Exploiter

TypeHub Exploiter This script exploits a vulnerability CVE-2021-25094 in the TypeHub WordPress plugin...

CVE-2025-25163-Nuclei-Template

Nuclei Template for CVE-2025-25163 🚀 Overview This repository features a Nuclei template specifically designed to detect the Path Traversal vulnerability CVE-2025-25163 in the Plugin A/B Image Optimizer for WordPress. This vulnerability poses a critical security risk, allowing unauthorized access...

CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...