CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress Plugin Mass Exploit Mass exploitation tool for CVE-2026-8206 – a critical vulnerability in the Kirki WordPress plugin versions ≤ 6.0.6 that allows unauthenticated attackers to hijack password reset links and take over any user account, including administrators...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 is a critical SQL injection vulnerability discovered in the WordPress plugin The Events Calendar. This vulnerability affects versions up to and including 6.6.4. The issue arises from insufficient escaping of the 'order' parameter in the tribehasnextevent function...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

CVE-2021-41277

CVE-2021-41277 plugin made for LeakiX...

cve-lfi-lab

🧠 CVE Lab: Tier 1 SOC Analyst Simulation CVE-2025-39507 | Local File Inclusion in WordPress Nasa Core Plugin 📝 Scenario: A Day in the SOC It’s a regular Monday. I’m logged into the SOC dashboard, reviewing alerts like usual. One comes in that catches my eye: ALERT: Possible Local File Inclusion L...

poc-cve-xss-uploading-svg

Details Title: Authenticated Reflected Cross-Site Scripting in "Uploading SVG, WEBP and ICO files" Plugin for WordPress CMS Date: 2023-08-10 Author: Danilo Albuquerque Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download Version: WordPress 6.3 Plugin's Name and...

CVE-2026-61797

CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injection Proof of Concept for CVE-2026-61797 , a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin. The vulnerability can be reached through: /marketplace/pdf/front/preference.form.php In the vulnerable implementation...

CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration !IMPORTANT Abstract: A High-Severity Cross-Site Request Forgery CSRF vulnerability CVE-2026-13156 was discovered in the official MailerSend SMTP Integration plugin for WordPress 1.0.8. The configuration eradication handler...

Exploit for CVE-2026-109384

CVE-2026-109384 — IvyForms Author: NØXCRYPT · @noxcrypt-...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2024-27956-RCE

CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

supernote-obsidian-plugin-PoC

Summary CVE status: requested, pending assignment. This finding is published as GHSA-3gx3-r874-5pp4. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-supernote-obsidian-plugin-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

WordPress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by rpgsec in WordPress Plugin WP ERP versions = 1.17.10...

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by churchill11 in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.4...

CVE-2026-19794

CVE-2026-19794 WP-Stats = 2.56 - Unauthenticated Stored Cross-Site Scripting Plugin URL https://wordpress.org/plugins/wp-stats/ Description Unauthenticated reflected XSS in the statsauthor GET parameter of statspage. The sanitization filter striptags is applied before urldecode, allowing an...

CVE-2026-82221-PoC

CVE-2026-82221 - Unauthenticated Reflected XSS in RegistrationMagic Overview This repository contains a Proof-of-Concept PoC for CVE-2026-82221 , an unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered in the RegistrationMagic WordPress plugin. The vulnerability affects the...

WordPress easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin EasyJobs versions = 2.8.4...

WordPress SEOPress – AI SEO Plugin & On-site SEO plugin <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin SEOPress versions = 10.3...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.198 - Unauthenticated Shortcode Injection vulnerability

Unauthenticated Shortcode Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin GeoDirectory versions = 2.8.198...