CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3...

file-away-exploit

File-Away Exploit CVE-2025-2539 & CVE-2025-2512 📌 Purpose This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management. This plugin contains two vulnerabilities that can lead to remote code execution Tested on File-Away...

CVE-2024-43919

CVE-2024-43919 YARPP = 5.30.10 - Missing Authorization Description The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the /includes/yarppprosetdisplaytypes.php file in all versions up to, and including,...

CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module Description The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions ...

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.3.7 due to...

CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Unauthenticated SQL Injection The plugin fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

poc-cve-xss-inventory-press-plugin

Update - 6-23-2023 The CVE-2023-2579 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Details Title: Authenticated Reflected Cross-Site Scripting in InventoryPress Plugin for WordPress CMS Date: 2023-04-21 Autho...

CVE-2024-52382

CVE-2024-52382 Matix Popup Builder = 1.0.0 - Unauthenticated Arbitrary Options Update Description The Matix Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a function in all versions u...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Unauthenticated PHP Object Injection Description The DS.DownloadList plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-50477

CVE-2024-50477 Stacks Mobile App Builder = 5.2.3 - Authentication Bypass via Account Takeover Description: The Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,...

CVE-2024-10124

CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce = 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Description The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized...

CVE-2020-36842

CVE-2020-36842 CVE-2020-36842 - WPvivid Plugin Arbitrary File Upload Vulnerability Overview CVE ID: CVE-2020-36842 Disclosure / Update Date: October 16, 2024 Affected Plugin: WPvivid - Migration, Backup, Staging Affected Versions: Up to and including 0.9.35 Vulnerability Type: Arbitrary File Uplo...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Unauthenticated PHP Object Injection Description The VRPConnector plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers t...

CVE-2024-52375

WordPress Datasets Manager 💥 Exploit by: Nxploit Khaled Alenazi 📅 CVE Published: November 14, 2024 🧠 CVSS Score: 10.0 Critical 🛠 CWE-434: Unrestricted Upload of File with Dangerous Type 📌 Description A critical vulnerability was discovered in the Datasets Manager by Arttia Creative WordPress...

CVE-2024-10571

CVE-2024-10571 Chartify – WordPress Chart Plugin = 2.9.5 - Unauthenticated Local File Inclusion via source Description The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This make...

CVE-2025-1639

🔓 Exploit Script for CVE-2025-1639 📝 Description The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This...

CVE-2019-18818

CVE-2019-18818 Usage : url Reference : https://vulners.com/cve/CVE-2019-18818 https://thatsn0tmysite.wordpress.com/2019/11/15/x05/...

CVE-2024-32700

CVE-2024-32700 Unauthenticated Arbitrary File Upload in Kognetiks Chatbot WordPress plugin...

CVE-2026-14282

CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: nullwhisper Use case: authorized security research / vulnerability validation only. What is this? GoDAM WordPress plugin versions = 1.12.2 register a WPForms field called godamrecord. The upload handler savevideofile is hooked into the public...