CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

Vitepos-CVE-Report

Vitepos-CVE-Report Disclosure for CVE-2025-13156 CVE-2025-13156 - Vulnerability in Vitepos – Point of Sale POS for WooCommerce This repository discloses a vulnerability discovered in Vitepos – Point of Sale POS for WooCommerce =' \ -H 'X-WP-Nonce: ' \ -F 'categoryname=evil' \ -F 'categoryparent=0...

Flo-Forms-CVE-Report

Flo-Forms-CVE-Report Disclosure for CVE-2025-13159 CVE-2025-13159 - Vulnerability in Flo Forms – Easy Drag & Drop Form Builder This repository discloses a vulnerability discovered in Flo Forms – Easy Drag & Drop Form Builder ' \ -F 'flo-form-model=' \ -F 'flo-form-schema="groups":' \ -F...

CVE-2025-6934

🚨 WordPress OpalEstate Plugin - Unauthenticated Privilege Escalation Vulnerability 🔎 Description The OpalEstate plugin for WordPress contains a critical vulnerability in its AJAX registration handler, allowing unauthenticated users to register as administrators. The issue lies in the insecure...

EventON-Lite-CVE-Report

EventON-Lite-CVE-Report Disclosure for CVE-2025-8091 CVE-2025-8091 - Vulnerability in EventON Lite This repository discloses a vulnerability discovered in EventON Lite = 2.4.6,WordPress plugin developed by Ashan Perera. 🛠 Affected Version Product : EventON Lite Version : v2.4.6 URL :...

CVE-2022-0739-Exploitation

CVE-2022-0739-Exploitation An exploitation of CVE-2022-0739. It about BookingPress WordPress plugin before 1.0.11. By using bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection. Since the plugin fails to properly sanitize...

CVE-2016-10924

CVE-2016-10924 CVE-2016-10924 - Directory traversal vulnerability in WordPress ebook-download plugin1.2. PoC + PID Bruteforce in Python. Usage git clone https://github.com/rvizx/CVE-2016-10924 cd CVE-2016-10924 python pidbrute.py...

CVE-2018-15877-RCE

CVE-2018-15877-RCE RCE via the Planview Activity Monitor plugin for wordpress. Requirements: Python3 Selenium Usage: ./exploit.py...

CVE-2024-8484

CVE-2024-8484 REST API TO MiniProgram = 4.7.1 - Unauthenticated SQL Injection CVE: CVE-2024-8484 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Score: 7.5 Slugs: rest-api-to-miniprogram Description: The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the...

CVE-2024-3922-Poc

CVE-2024-3922-Poc Dokan Pro Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.110.184:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/126.0.0.0 Safari/537.36 Accept:...

WordPress-NotificationX-CVE-2024-1698

Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2025-22652

CVE-2025-22652 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Payment Forms for Paystack Vulnerable version = 4.0.1 Component slug payment-forms-for-paystack Component link https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class...

WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Suphakit Phrmduang TORTY in WordPress Plugin WP Dark Mode versions = 5.3.17...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticated Privilege Escalation Python 3 PoC for CVE-2026-14281 in the WordPress plugin Automation Web Platform automation-web-platform — WAWP / Notifications & OTP for WooCommerce. PoCbit Listed on PoCbit — community catalog:...

CVE-2025-30567

Introduction Unauthorized Arbitrary File Download in WordPress WP01！ Environment setup Step 1: Download the WP01 Plugin，But... Haha, don't worry, here is the source code of the plugin. Step 2: Package the provided wp01 folder and upload it to the WordPress plugins section.like this-- Analysis It'...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation Exp CVE-2024-28000Scan.py This script first identifies the version to determine if it is a vulnerable version, then attempts to confirm whether the log file exists. If it exists, it will try to send a request and then request the log file again to search for...

CVE-2023-6036

CVE-2023-6036 POC about Wordpress plugin Web3 – Crypto wallet Login & NFT token gating 3.0.0 - Authentication Bypass This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handleloginrequest’ function and ‘handleauthrequest' function Vulnerability I have...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC: https://www.youtube.com/watch?v=MbhiQKWvivQ References: https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 https://vulners.com/cve/CVE-2022-1598...