CVE-2024-3806

CVE-2024-3806 Porto = 7.1.0 - Unauthenticated Local File Inclusion via portoajaxposts Description The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers...

CVE-2026-23550

🧨 CVE-2026-23550 – Modular Connector Admin Bypass Unauthenticated WordPress Admin Login viaorigin=mo Parameter Modular Connector Plugin ≤ 2.5.1 📖 Description The Modular Connector plugin for WordPress versions ≤ 2.5.1 contains a critical authentication bypass vulnerability. An unauthenticated...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

CVE-2020-24913-exploit

qcubed-exploit You need Bun to be installed: https://bun.sh To install dependencies: bun install To run: show help bun run exploit -h test for vulnerability bun run exploit vulnerable -u https://site.com/framework/assets/core/php/profile.php create a session for a new target bun run exploit creat...

CVE-2024-50483

CVE-2024-50483 Meetup = 0.1 - Authentication Bypass via Account Takeover Description: The Meetup plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them v...

CVE-2025-39538

🛡️ CVE-2025-39538 - WordPress WP-Advanced-Search = 3.3.9.3 Arbitrary File Upload CVE-2025-39538 Published: 2025-04-16 Vulnerability Type: Arbitrary File Upload Unrestricted Upload of File with Dangerous Type Affected Plugin: WP-Advanced-Search by Mathieu Chartier Affected Versions: All versions up...

CVE-2025-14855-POC

CVE-2025-14855: SureForms WordPress Plugin Stored XSS Proof of Concept Target: WordPress Plugin "SureForms" Plugin Wordpress: https://wordpress.org/plugins/sureforms/ Vulnerability Type: Stored Cross-Site Scripting XSS CVE: CVE-2025-14855 Refer:...

CVE-2024-9707-Poc

CVE-2024-9707-Poc 🌐 Description This script exploits the vulnerability in the WordPress Hunk Companion plugin CVE-2024-9707, allowing unauthorized attackers to install and activate arbitrary plugins via the /wp-json/hc/v1/themehunk-import REST API endpoint. Features Feature| Description ---|---...

CVE-2024-6330

CVE-2024-6330 GEO my WordPress ivv900fnzbln0dem43z7zmzjjgigz...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Subscriber+ Arbitrary Options Update Description The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner is a powerful and user-friendly tool designed to identify potential vulnerabilities in WordPress sites by inspecting their API endpoints. The scanner aims to assist website owners, developers, and security professionals in proactively...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

wpprobe

"Because why scan blind when WordPress exposes itself?" WPProbe A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5000 plugins detectable without brute-force, thousands mo...

CVE-2024-8522

CVE-2024-8522 LearnPress – WordPress LMS Plugin execute class-lp-course-db.php:564, LPCourseDB-getcourses Courses.php:241, LearnPress\Models\Courses::getcourses class-lp-rest-courses-v1-controller.php:502, LPJwtCoursesV1Controller-getcourses class-wp-rest-server.php:1230,...

CVE-2024-43917

CVE-2024-43917 A proof of concept developed to exploit CVE-2024-43917. Based on PatchStack's article. Usage usage: python CVE-2024-43917.py --help TI WooCommerce Wishlist WordPress plugin = 2.8.2 CVE-2024-43917 PoC positional arguments: COMMAND SQL command to execute SHAREKEY share key of the wis...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

wpbf

wpbf! wpbf is a bruteforce tool to remotely test password strength, username enumeration and plugin detection on a WordPress site. Description ^^^^^^^^^^^ The script will try to login into the WordPress dashboard through the login form using a mixture of enumerated usernames, a wordlist and...

CVE-2023-3460_POC

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. Made with Golang ╔══════════════════════════════════════════════════╗ ╔══════════════════════════════════════════════════╗ ║ DISCLAIMER ║ ║ ABOUT THE PROJECT ║ ║ ║ ║ ║ ║ This Proof of Concept PoC has...

CVE-2026-10795

CVE-2026-10795 CVE-2026-10795 – UpdraftPlus Authentication Bypass CVE-2026-10795 – UpdraftPlus Authentication Bypass PoC ⚠️ Disclaimer: This repository is for educational purposes only. Only use this on systems you own or have explicit permission to test. The author is not responsible for any...

wpscan

WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin INSTALL Prerequisites Optional but highly recommended: rbenv Ruby = 3.3 - Recommended: latest stable Curl = 7.72 - Recommended: latest stable The 7.29 has a segfault The 7.72 could result in...