WordPress_4.9.8_RCE_POC

Summary A simple PoC for WordPress RCE author priviledge, refer to CVE-2019-8942 and CVE-2019-8943. Affected Version WordPress = 4.9.8 verified WordPress = 5.0.0 Test Environment Docker Image docker pull avfisherdocker/wordpress:4.9.8 docker run -d -p 80:80 avfisherdocker/wordpress:4.9.8 Mysql &...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress root@kitploit: $ make up-wp Step2. Run Attacker web server root@kitploit: $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend root@kitploit: $ echo -en...

WordPress Insert or Embed Articulate Content into WordPress plugin < 4.3000000025 - Author+ Upload to RCE vulnerability

Author+ Upload to RCE vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Insert or Embed Articulate Content into WordPress versions 4.3000000025...

WordPress CatFolders Document Gallery & PDF Library plugin < 2.0.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...

CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-77788 Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

EUVD-2025-210823

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2026-81757 WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability

Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...

BIT-WORDPRESS-MULTISITE-2026-65640

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...

CVE-2026-16959

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

PT-2026-80003

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the upload files capability This issue affects all versions of WordPress...

WordPress Atarim plugin <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta vulnerability

Authenticated Author+ Arbitrary File Deletion via 'wpattachedfile' Meta vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Atarim versions = 5.1.1...

WordPress WP Custom HTML Pages plugin <= 0.6.2 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin WP Custom HTML Page versions = 0.6.2...

WordPress YMC Filter plugin < 3.12.9 - Author+ Stored XSS via SVG Icon Upload vulnerability

Author+ Stored XSS via SVG Icon Upload vulnerability discovered by Artus KG in WordPress Plugin Filter & Grids versions 3.12.9...

CVE-2026-19615 Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

CVE-2026-19697 GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...

WordPress Brizy - Page Builder plugin < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset vulnerability

WordPress Brizy - Page Builder plugin 2.8.19 - Author+ Stored XSS via brizysetproject Global Project Code Asset vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Brizy versions 2.8.19...

WordPress Meow Gallery plugin < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text vulnerability

Author+ Stored XSS via Attachment Alt-Text vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Meow Gallery versions 5.5.2...

CVE-2026-18202

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...