CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2024-9224

CVE-2024-9224 Hello World = 2.1.1 - Authenticated Subscriber+ Arbitrary File Read Description The Hello World plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 2.1.1 via the helloworldlyric function. This makes it possible for authenticated...

CVE-2024-13800

CVE-2024-13800 Popup Plugin For WordPress - ConvertPlus = 3.5.30 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing...

CVE-2024-10793

CVE-2024-10793 PoC Set this lines to your hosts file: 127.0.0.1 goodcms.lab 127.0.0.1 attacker.com Launch Wordpress using docker: $ sudo systemctl start docker $ sudo docker-compose up -d Open http://goodcms.lab:2121 and do installation wordpress steps. Install wp-security-audit-log.5.2.1 or olde...

CLEANSTART-2023-VL53503 potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3

Security vulnerability affects the spamassassin package. A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3...

CLEANSTART-2024-YN87876 jQuery Validation Plugin provides drop-in validation for your existing forms

Security vulnerability affects the otrs package. The jQuery Validation Plugin provides drop-in validation for your existing forms...

CVE-2023-2744

Exploit Title: WP Plugins WP ERP = 1.12.2 - SQL Injection Date: 15-10-2023 Exploit Author: Arvandy Software Link: https://wordpress.org/plugins/erp/ Vendor Homepage: https://wperp.com/ Version: 1.12.2 Tested on: Windows, Linux CVE: CVE-2023-2744 Product Description WP ERP is the first full-fledge...

CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7...

CVE-2023-6036

CVE-2023-6036 POC about Wordpress plugin Web3 – Crypto wallet Login & NFT token gating 3.0.0 - Authentication Bypass This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handleloginrequest’ function and ‘handleauthrequest' function Vulnerability I have...

CVE-2024-6132

CVE-2024-6132 Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload Usage usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY NXPLOIT - KHALED ALENAZI...

CVE_2026_7515

CVE20267515 CVE-2026-7515: BetterDocs Pro = 3.8.0 - Unauthenticated Local File Inclusion TO RCE EXPLOİT...

CVE-2025-10897

CVE-2025-10897 WooCommerce is an open-source e-commerce plugin for WordPress that turns websites into online stores. WooCommerce Designer Pro is a WordPress plugin developed by JMA Plugins that enables customers to design and customize products directly on WooCommerce stores. IMPORTANT :...

CVE-2025-4336

eMagicOne Store Manager for WooCommerce 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo...

CVE-2024-51818

CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-0566

CVE-2024-0566 Smart Manager 8.27.0 - Post-Authenticated SQL Injection Exploit Title: Smart Manager 8.27.0 - Post-Authenticated SQL Injection Date: 2024-01-18 Exploit Author: Ivan Spiridonov - xbz0n Vendor Homepage: https://www.storeapps.org/ Software Link:...

CVE-2025-22352

1️⃣ Component type WordPress plugin 2️⃣ Component details Component name ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Vulnerable version = 1.4.8 Component slug elex-bulk-edit-products-prices-attributes-for-woocommerce-basic Component link...

CLEANSTART-2024-VI40953 Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome)

Security vulnerability affects the grafana-image-renderer package. Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome...

CVE-2023-6421

CVE-2023-6421 Download Manager 3.2.83 - Unauthenticated Protected File Download Password Leak Description The plugin does not protect file download's passwords, leaking it upon receiving an invalid one POC python3 CVE-2023-6421.py https://kubernetes.docker.internal No link generated for ID 1. No...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - Unauthenticated PHP Object Injection Description The Partners plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject...