hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2025-2294

Kubio Page Builder LFI Exploit CVE-2025-2294 Local File Inclusion LFI exploit for Kubio Page Builder WordPress plugin versions ≤ 2.5.1. 📌 Description This tool exploits an unauthenticated LFI vulnerability in Kubio Page Builder plugin CVE-2025-2294, allowing attackers to read sensitive files on...

EUVD-2026-104388

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...

CVE-2025-47550

Instantio - Wordpress Plugin 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu...

CVE-2024-7627-PoC

CVE-2024-7627-PoC Background This Proof-of-Concept PoC script is for WordPress plugin Bit File Manager version 6.0 - 6.5.5 Unauthenticated Remote Code Execution via Race Condition CVE-2024-7627 vulnerability. Information Description: The Bit File Manager plugin for WordPress is vulnerable to Remo...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

CVE-2023-4278

CVE-2023-4278 Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Software Link: https://stylemixthemes.com Version...

CVE-2026-13152

CVE-2026-13152: Unauthenticated Privilege Escalation in Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Advisory Overview CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin...

WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Peter Tang in WordPress Plugin weForms versions = 1.6.28...

WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability

Direct static code injection vulnerability discovered by changsheng in WordPress Plugin Classified Listing versions = 6.1.5...

CVE-2024-50498

CVE-2024-50498 Description Improper Control of Generation of Code 'Code Injection' vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console: from n/a through 1.0. Setup Netcat Listener: Open a terminal on your machine and start a Netcat listener to wait fo...

CVE-2024-10958-WPPA-Exploit

WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...

CVE-2025-4094

CVE-2025-4094 – WordPress Digits Plugin This method is useful for vi...

CVE-2022-32119

CVE-2022-32119 - Arox-Unrestricted-File-Upload There are multiple unrestricted file uploads that result in the arbitrary execution of PHP code. Authenticated Vulnerable Pages: localhost/officeadmin/?pid=54&action=add -----------------------------181967832439954202373233921976 Content-Disposition:...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthenticated Media Upload Description The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. Usage: usage:...

MpOperationLogs

CVE-2023-5538 wordpress plugin MpOperationLogs = 1.0.1 - Unauthenticated Stored Cross-Site Scripting...

CVE-2025-10897

CVE-2025-10897 WooCommerce is an open-source e-commerce plugin for WordPress that turns websites into online stores. WooCommerce Designer Pro is a WordPress plugin developed by JMA Plugins that enables customers to design and customize products directly on WooCommerce stores. IMPORTANT :...

CVE-2026-5718-Lab

CVE-2026-5718 Local Docker Lab Local-only vulnerable vs patched Docker lab for CVE-2026-5718 , affecting the WordPress plugin Drag and Drop Multiple File Upload for Contact Form 7. This lab demonstrates the difference between the vulnerable version 1.3.9.6 and the patched version 1.3.9.7 using a...

CVE-2024-50491

CVE-2024-50491 RSVP ME = 1.9.9 - Unauthenticated SQL Injection Description The RSVP ME plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-6433

CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance Item| Detail ---|--- Vector| Unauthenticated SQLi tunneled through plugin...