CVE-2025-51529

CVE-2025-51529: WordPress Cookies and Content Security Policy Plugin DoS Vulnerability Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service database server...

CVE-2026-3584

CVE-2026-3584 – WordPress Kali Forms = 2.4.9 - تنفيذ رمز عن بُعد غير مصادَّق عبر formprocess 🔥 ملخص الثغرة إضافة ووردبريس Kali Forms الإصدارات = 2.4.9 تحتوي على ثغرة حرجة في تنفيذ رمز عن بُعد غير مصادَّق RCE. تسمح هذه الثغرة لـ المهاجمين غير المصادَقين بتنفيذ كود PHP عشوائي على الخادم والحصول على...

CVE-2022-41840-PoC

Zenario CMS 9.3 - استغلال تنفيذ تعليمات برمجية عن بُعد بدون مصادقة CVE-2022-41840 ثغرة تنفيذ تعليمات برمجية عن بُعد RCE بدون مصادقة تؤثر على Zenario CMS الإصدار 9.3 والإصدارات الأقدم. يستغل الاستغلال ثغرة رفع ملفات في نقطة نهاية AJAX لرفع قشرة ويب PHP وتحقيق تنفيذ التعليمات البرمجية. تفاصيل الثغر...

CVE-2025-24801

CVE-2025-24801 PoC for GLPI RCE This repository contains a proof-of-concept script poc.py that exploits CVE-2025-24801, an LFI-to-RCE vulnerability in GLPI 10.0.17. It automates: Logging into GLPI Enabling .php uploads by updating document type settings Uploading a PHP reverse shell via the AJAX...

CVE-2026-1555

CVE-2026-1555 WebStack = 1.2024 - Téléchargement arbitraire de fichier non authentifié 👤 By: Nxploited 🔗 Nxploited ZeroDay Hub — t.me/KNxploited 💀 CVE-2026-1555 — WebStack WordPress : téléchargement arbitraire de fichier Exécution de code à distance non authentifiée via le gestionnaire AJAXimgupl...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

wp-jobhunt-exploit

wp-jobhunt-exploit CVE-2018-19487, CVE-2018-19488, exploit for WordPress wp-jobhunt plugin wp-jobhunt plugin is a plugin used with JobCareer theme: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636 see changelog at the bottom Python exploit for CVE-2018-19487 AJ...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2025-4606

CVE-2025-4606- WordPress Sala Theme = 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover 🔥 Vulnerability Summary The WordPress theme Sala versions = 1.1.4 is vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attacke...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - تحميل ملف تعسفي غير مصادق عليه CVE-2026-3891 PoC 📜 الوصف CVE-2026-3891 هي ثغرة تحميل ملف تعسفي غير مصادق عليه في إضافة WordPress Pix for WooCommerce. تعرض الإضافة نقطة نهاية AJAX lknpixforwoocommercec6savesettings تقبل تحميل ملفات الشهادات دون أي مصادقة. يمكن الحصول...

CVE-2024-8682

CVE-2024-8682 - JNews Unauthenticated Registration PoC JNews = 11.6.6 has a vulnerability that allows unauthenticated user registration via the ?ajax-request=jnews endpoint, even when WordPress registration is disabled. This works by first retrieving a valid jnewsnonce through the jnewsrefreshnon...

CVE-2024-7928

FastAdmin Path Traversal Vulnerability exploit A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal...

CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes Theme = 4.4.0 - Privilege Escalation 🔥 Vulnerability Summary The WordPress theme RealHomes versions = 4.4.0 is vulnerable to a privilege escalation vulnerability. This allows authenticated users with low privileges such as subscribers to escalate their roles to...

CVE-2025-30567

Introduction Unauthorized Arbitrary File Download in WordPress WP01！ Environment setup Step 1: Download the WP01 Plugin，But... Haha, don't worry, here is the source code of the plugin. Step 2: Package the provided wp01 folder and upload it to the WordPress plugins section.like this-- Analysis It'...

EUVD-2026-70900

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2025-5394

CVE-2025-5394 – WordPress Alone Theme = 7.8.3 - Unauthenticated Arbitrary File Upload via Plugin Installation 🔥 Vulnerability Summary The WordPress theme Alone versions = 7.8.3 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to...

CVE-2025-6934

CVE-2025-6934 – استغلال WordPress Opal Estate Pro 📖 الوصف يحتوي هذا المستودع على إثبات المفهوم PoC exploit لـ CVE-2025-6934 ، ثغرة حرجة في إضافة WordPress: Opal Estate Pro = 1.7.5، تسمح بإنشاء حساب مدير دون مصادقة. ⚠️ إخلاء مسؤولية : هذه الأداة متوفرة فقط لأغراض تعليمية وبحثية أمنية. المؤلف غير...

CVE-2025-12585

MxChat Basic = 2.5.1 - MxChat – AI Chatbot for WordPress = 2.5.1 - Exposition d'informations non authentifiée Le plugin MxChat Basic ne vérifie pas la propriété de la session dans le point de terminaison AJAX mxchatfetchconversationhistory, ce qui permet à des utilisateurs non authentifiés...

CVE-2025-12135

WPBookit getparam'csscode'; $jscode= $request-getparam'jscode'; updateoption 'wpbcustomcodedata', 'csscode' = $csscode, 'jscode' = $jscode ; Выполнение кода из /core/shortcodes/class-wpbookit-shortcode-abstract.php:20-...

CVE-2026-3395-Lab

CVE-2026-3395 — Laboratoire RCE non authentifié MaxSite CMS Ce dépôt est destiné uniquement à des fins éducatives et de recherche. Tous les tests doivent être effectués dans un environnement de laboratoire Docker local. Ne déployez pas cette configuration sur des systèmes publics ou de production...