CVE-2022-1329

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Ejecución remota de código root@kitploit: Fecha: 16 de abril de 2023 Autor del exploit: Việt Hùng https://github.com/phanthibichtram12 Sitio web del proveedor: https://elementor.com/ Enlace del software:...

CVE-2024-44000

EN GenCookieSessionHijack is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies. This allows the attacker to hijack active admin sessions and gain unauthorized access to the WordPress admin dashboard. Features Extract cookies from WordPre...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Unauthenticated Arbitrary Options Update Description The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated...

CVE-2025-2011

CVE-2025-2011 PoC By: X3RX3S But Proudly ripped by Ash Wesker that GPT'd my code with his banner ; see here --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 You can even see my handle in 'his' code --' Purpose: A proof-of-concept tool to test for an SQL injection vulnerability CVE-2025-201...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

CVE-2025-23968

AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpoint’s file logic contains file renaming functionality that triggers after file...

cve-lfi-lab

🧠 CVE Lab: Tier 1 SOC Analyst Simulation CVE-2025-39507 | Local File Inclusion in WordPress Nasa Core Plugin 📝 Scenario: A Day in the SOC It’s a regular Monday. I’m logged into the SOC dashboard, reviewing alerts like usual. One comes in that catches my eye: ALERT: Possible Local File Inclusion L...

CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...

wordpress_cve-2021-29447

wordpresscve-2021-29447 WordPress XXE vulnerability Credit : https://github.com/motikan2010...

CVE-2023-6036

CVE-2023-6036 POC about Wordpress plugin Web3 – Crypto wallet Login & NFT token gating 3.0.0 - Authentication Bypass This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handleloginrequest’ function and ‘handleauthrequest' function Vulnerability I have...

CVE-2021-24299

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:41+00:00| seen| https://t.me/hackingAttack/9959 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/9959...

CVE-2018-18572

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...

CVE-2018-18694

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:17+00:00| seen| https://t.me/hackingAttack/27117 2026-09-01 20:02:17+00:00| seen|...

cve-2026-3359-exp

CVE-2026-3359 is an unauthenticated SQL Injection vulnerability situated within Web10's wordpress plugin "Form Maker" in all versions up to version 1.15.42. In order to use this PoC/exploit, first set up a virtual enviroment through the commands "virtualenv name of your enviroment here" or "venv...

CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage root@kitploit: python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist = 2.9.2 - Arbitrary File Upload 🔥 Vulnerability Summary The WordPress plugin TI WooCommerce Wishlist version = 2.9.2 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This allows attackers to upload any file type, including...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

Wordpress-Default-Password

Wordpress Default U/P python 2.7 Donation : BTC : 31mtLHqhaXXyCMnT2EU73U8fwYwigiEEU1 Perfect Money : U22270614 Encrypt By Azim !...

CVE-2025-11988

1 Extract the public cryptoajax nonce root@kitploit: UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s'...

CVE-2022-1442

CVE-2022-1442 WordPress 插件 Metform = 2.1.3 - 不恰当的访问控制导致未认证的敏感信息泄露 描述 由于 /core/forms/action.php 文件中存在不恰当的访问控制，该插件容易受到敏感信息泄露攻击，未认证的攻击者可以利用该漏洞查看所有集成的第三方 API 的密钥和机密信息，例如 PayPal、Stripe、Mailchimp、Hubspot、HelpScout、reCAPTCHA 等。 POC root@kitploit: bash metform.sh http://wordpress.lan "formtitle": "New Fo...