CVE-2024-5084

Hash Form 9.9.1 file upload vulnerability Exploit The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

CVE-2025-1306

Newscrunch Exploit CVE-2025-1306 🚨 Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...

CVE-2024-54262

CVE-2024-54262 Exploit CVE-2024-54262: Arbitrary File Upload in Import Export for WooCommerce Overview This script exploits a vulnerability in the "Import Export for WooCommerce" WordPress plugin. The vulnerability allows unauthorized users to upload arbitrary files, leading to potential remote...

CVE-2025-23922

CVE-2025-23922 - WordPress iSpring Embedder CSRF to Arbitrary File Upload 📌 CVE Details CVE ID: CVE-2025-23922 Published: 2025-01-16 Plugin Affected: WordPress iSpring Embedder plugin Versions Affected: = 1.0 Author of Plugin: Harsh Vulnerability Type: Cross-Site Request Forgery CSRF → Arbitrary...

CVE-2024-51793

🛡️ WordPress RepairBuddy Plugin Exploit 📜 CVE Information CVE-ID: CVE-2024-51793 Published: 2024-11-11 Updated: 2024-11-11 Title: WordPress RepairBuddy plugin = 3.8115 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in Webful...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

CVE-2024-9234

CVE-2024-9234 GutenKit = 2.1.0 - Unauthenticated Arbitrary File Upload POC python CVE-2024-9234.py -h baseurl note This script is provided for educational purposes only. The author is not responsible for any damages caused by the misuse of this script...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. usage:...

CVE-2024-7985-PoC

CVE-2024-7985-PoC FileOrganizer = 1.0.9 - Authenticated Subscriber+ Arbitrary File Upload FileOrganizer Exploit - CVE-2024-7985 📌 Overview CVE-2024-7985 - WordPress Plugin FileOrganizer = 1.0.9 is vulnerable to authenticated arbitrary file uploads , allowing attackers with Subscriber+ privileges...

CVE-2024-1247-PoC

CVE-2024-1247-PoC Post Saint = 1.3.1 plugin for WordPress Arbitrary File Upload Description The Post Saint plugin for WordPress versions up to and including 1.3.1 is vulnerable to arbitrary file uploads due to missing capability checks and file type validation. Authenticated attackers with at lea...

CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Exploit Overview This script exploits an authenticated arbitrary file upload vulnerability in Pluck CMS v4.7.18 CVE-2023-50564. By leveraging this vulnerability, an authenticated attacker can upload a malicious PHP file, enabling the execution of arbitrary code ...

PoC-CVE-2025-3914-Aeropage-WordPress-File-Upload

CVE-2025-3914 - Arbitrary File Upload in Aeropage Sync for Airtable WordPress Description The Aeropage Sync for Airtable WordPress plugin ≤ v3.2.0 is vulnerable to authenticated arbitrary file uploads due to insufficient file type validation in the aeropagemediadownloader function. Attack Vector ...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

CVE-2024-9290

CVE-2024-9290 Exploit Tool | Super Backup & Clone Vulnerability The tool targets WordPress websites that use the Super Backup & Clone plugin and are vulnerable to arbitrary file upload. It attempts to upload a malicious shell into the /wp-content/uploads/isnapshots/ directory. Once uploaded, the...

WP-CVE-2023-5360

WP-CVE-2023-5360 Royal Elementor Addons and Templates = 1.3.78 – Unauthenticated Arbitrary File Upload Python 2.7 Buy Coffee : Bitcoin $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC How To Use? Install Python 2.7 Download Here python file.py Reff :...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Unauthenticated Arbitrary File Upload Research by: Atomic Edge Severity: Critical | CVSS: 9.8 | Auth Required: None ⚠️ v2 — Technical corrections applied based on community feedback. See Changelog for details. Overview A critical unauthenticated arbitrary...

CVE-2026-3891-Linux

root@kitploit: ███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗ ██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝ █████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗ ██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║ ██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝...

CVE-2023-29386

CVE-2023-29386 — Manager for Icomoon Este README documenta una vulnerabilidad divulgada únicamente con fines educativos y defensivos.No ejecutes pruebas contra sistemas de producción o sistemas que no poseas o para los que no tengas permiso explícito de prueba. Descubierto por: deokhunKim Estado:...