CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint -un -p -ru Disclaimer This script is for educational and rese...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload ⚠️ Disclaimer THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. The...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2024-6244

🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache Targets versions ≤2.7.5 vulnerable to CVE-2023-5359 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS =...

CVE-2023-47668

CVE-2023-47668 Description Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin Example of the result Log file content: 2024-12-24 20:47:19 - wprcpdiscounts table upgrade to 202003311 successful. 2024-12-24 20:47:19 -...

CVE-2024-50498

CVE-2024-50498 WP Query Console body background-color: fff; color: 222; font-family: sans-serif; pre margin: 0; font-family: monospace; a:link color: 009; text-decoration: none; background-color: fff; a:hover text-decoration: underline; table...

cve-2023-1874

CVE-2023-1874 Disclaimer THIS SCRIPT IS DESIGNED FOR WHITE HAT AND EDUCATIONAL PURPOSES ONLY. ANY USE OF THIS AGAINST A DEVICE YOU ARE NOT AUTHORIZED TO TEST ON OR DO NOT OWN IS YOUR OWN RESPONSIBILITY. THE AUTHOR OF THIS SCRIPT TAKES NO RESPONSIBILITY FOR ANYTHING YOU DO WITH THIS SCRIPT. YOUR...

CVE-2024-6624

CVE-2024-6624 JSON API User = 3.9.3 - Unauthenticated Privilege Escalation Description The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for...

CVE-2024-50478

CVE-2024-50478 1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover Description: The 1-Click Login: Passwordless Authentication plugin for WordPress is vulnerable to authentication bypass in version 1.4.5. This is due to the plugin not properly verifying a...

Poc-CVE-2025-9519

Easy Timer v4.2.1 - Prerequisites Docker Engine installed Docker Compose installed Refer to the official Docker docs for installation: Docker Engine Install 1. Start WordPress with Docker From your project directory: sudo docker-compose up -d mkdir -p wp-content/plugins cd wp-content/plugins wget...

CVE-2025-11171

CVE-2025-11171: Missing Authentication in Chartify WordPress Plugin Keywords: CVE-2025-11171, Chartify WordPress vulnerability, missing authentication, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-306, WordPress chart plugin security, authentication bypass...

CVE-2024-12542-PoC

CVE-2024-12542-PoC Missing Authorization to Unauthenticated Sensitive Information Exposure Vulnerability Description The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the phpinfo function in all versions up to, and...

CVE-2021-34646

CVE-2021-34646 PoC this vulnerability detail by NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink...

CVE-2012-20004

The K-news plugin for WordPress (versions prior to 1.1.1 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the failure to sanitize input supplied through the 'ff' parameter . Unauthenticated attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/font...

CVE-2012-20004 K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Unauthenticated Arbitrary File Upload Research by: Atomic Edge Severity: Critical | CVSS: 9.8 | Auth Required: None ⚠️ v2 — Technical corrections applied based on community feedback. See Changelog for details. Overview A critical unauthenticated arbitrary...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Read Description The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including,...