CVE-2024-9890

CVE-2024-9890 User Toolkit = 1.2.3 - Authenticated Subscriber+ Authentication Bypass Description: The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This...

CVE-2026-8380

CVE-2026-8380 CVE-2026-8380 — Frontend File Manager = 23.6 Arbitrary Post Deletion Overview A critical authorization flaw was identified in the WordPress plugin Frontend File Manager nmedia-user-file-uploader affecting versions = 23.6. The vulnerability allows authenticated users with low...

CVE-2025-49388

CVE-2025-49388 WordPress Miraculous Core Plugin Plugin OPTIONS Example: python CVE-2025-49388.py -u http://127.0.0.1/wordpress Main Options: Option| Description| Examp...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...

CVE-2025-11988

1 Extract the public cryptoajax nonce UA='Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:127.0 Gecko/20100101 Firefox/127.0' PAGEURL='http://localhost/wordpress//' NONCE=$curl -s "$PAGEURL" -A "$UA" | \ perl -0777 -ne 'print "$1\n" if /cryptoconnectChainAjax\s=\s^"nonce"\s:\s"^"+"/s' Fallback...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit CVE-2025-0316 Exploit Toolkit 🚨 Auth Bypass Exploit for WordPress Plugin WP Directorybox Manager 🔥 Automated exploit script for CVE-2025-0316 — Auth Bypass via vulnerable AJAX action. ⚠️ Legal Notice This tool is intended strictly for: Research Red Team simulation Authorized...

CVE-2023-36319

CVE-2023-36319 By modifying the compression plug-in command, the attacker can cause the server to execute arbitrary commands during the upload process. Only used for authorized security testing, please do not use it for illegal purposes. Violations have nothing to do with the author. Affected...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 The intel drops here first. Follow @KNxploited on Telegram — precision CVE disclosures, working exploits, and deep-dive vulnerability research. The channel for those who don't wait for the news — they make it. 🧠 Overview CVE-2025-15403 is a CVSS 9.8 Critical...

litespeed-cache-xss-poc

LiteSpeed Cache XSS PoC PoC for XSS vulnerability in the LiteSpeed Cache WordPress plugin allowing elevated privileges. This vulnerability was fixed in version 5.7.0.1 of the plugin, and was assigned CVE-2023-40000. According to the plugin's advanced view page, about 35% of users are still using ...

cve-2024-3552

Description The Plugin Web Directory Free WordPress prior to version 1.7.0 contains a SQL Injection vulnerability. The AJAX execution function is not properly filtered/sanitized, allowing an attacker to manipulate the SQL query or inject additional clauses UNION, time-based, error-based Context...

CVE-2025-5815-Nuclei-Template

📄 Nuclei Template for CVE-2025-5815 🚀 Overview This repository features a Nuclei template specifically designed to detect an Unauthenticated Bot Logging Disable Vulnerability CVE-2025-5815 in the Traffic Monitor WordPress plugin. This issue allows unauthenticated attackers to remotely disable bot...

instant-appointment-arbitrary-file-upload

instant-appointment-arbitrary-file-upload instant-appointment - Arbitrary File upload Description The Instant Appointment plugin for WordPress is vulnerable to Arbitrary File upload in versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload a shell and...

CVE-2024-6529

Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...

CVE-2026-5718-Lab

CVE-2026-5718 Local Docker Lab Local-only vulnerable vs patched Docker lab for CVE-2026-5718 , affecting the WordPress plugin Drag and Drop Multiple File Upload for Contact Form 7. This lab demonstrates the difference between the vulnerable version 1.3.9.6 and the patched version 1.3.9.7 using a...

CVE-2025-49029

🚨 WordPress Custom Login And Signup Widget Plugin 🔥 Base Score: 9.1 CRITICAL CWE ID: CWE-94 – Improper Control of Generation of Code 'Code Injection' 🧠 Description The plugin allows administrators to modify the contents of sn.php via the Sender’s Name field in the settings page. User-supplied inp...

ipyida

= IPyIDA IPyIDA is a python-only solution to add an IPython console to IDA Pro. Use to open a window with an embedded Qt console. You can then benefit from IPython's autocompletion, online help, monospaced font input field, graphs, and so on. You can also connect to the kernel outside of IDA usin...

CVE-2025-6934

CVE-2025-6934 unauthenticated privilege escalation in opal estate pro Description CVE-2025-6934 is a critical vulnerability in the Opal Estate Pro WordPress plugin ≤ v1.7.5. This bug allows an unauthenticated attacker to create a new administrator account by sending a crafted request to:...

CVE-2025-12721

g-FFL Cockpit 'returntrue', making it completely accessible to any unauthenticated visitor. Located in class-sync-endpoint.php: 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue', //...

CVE-2026-8181

CVE-2026-8181 — Burst Statistics 3.4.0 – 3.4.1.1 — Authentication Bypass to Admin Account Takeover Vulnerability Summary The WordPress plugin Burst Statistics versions 3.4.0 to 3.4.1.1 is vulnerable to an unauthenticated authentication bypass vulnerability that leads to full administrator account...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 Vulnerability discoverd by me CVE-2019-15053 Advisory: advisory.txt Basic Info Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and before Tested...