CVE-2025-4578

CVE-2025-4578 File Provider = 1.2.3 - Unauthenticated SQL Injection Description The File Provider plugin for WordPress is vulnerable to SQL Injection via the 'fileId' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary File Upload -purple 📌 Description The CSV Mass Importer plugin ≤ 1.2 for WordPress contains an Admin+ Arbitrary File Upload vulnerability. Due to improper validation of uploaded files, high-privilege users such as admin can upload...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Critical 📝 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to...

cve-2020-9006

CVE-2020-9006: Wordpress Popup-Builder Plugin Exploit Usage: Create and upload payload Also see: php create-serialized-payload.php -h $ php create-serialized-payload.php | curl -F 'sprunge=-' http://sprunge.us http://sprunge.us/XXXXXX Run exploit $ nmap --script ./cve-2020-9006 --script-args...

CVE-2026-15964-PoC

CVE-2026-15964 - Single Sign On For TNG = 2.0.0 Unauthenticated privilege escalation via unverified password change in the WordPress plugin Single Sign On For TNG. | ---|--- Severity| Critical 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE| CWE-620 Unverified Password Change Affected|...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

CVE-2026-44024_exploit

CVE-2026-44024 — Fluentd outfile $tag Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Fluentd's outfile plugin via the $tag placeholder. outfile lets operators template the output path with a $tag placeholder e.g. path /var/log/fluent/$tag. Outputextractplaceholders...

WPKiller

WPKiller v1.0 ✔ Wordpress Security Scanner, WPKiller Allows you to search for vulnerabilities on the Wordpress site as well as scan Plugins and find Exploit customized versions and Plugins Installation How to install this tool? $ git clone https://github.com/Dark-Grizzly/WPKiller $ cd WPKiller $...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2024-7627

Exploit for CVE-2024-7627 — Bit File Manager WordPress Unauthenticated RCE Exploit 📌 Description This repository contains a proof-of-concept PoC exploit for CVE-2024-7627 , a critical Unauthenticated Remote Code Execution RCE vulnerability in the Bit File Manager WordPress plugin versions 6.0 –...

Orbit-Fox_SSRF_CVE-2025-10874

CVE-2025-10874 - Orbit Fox SSRF Proof of Concept Proof of concept exploit demonstrating Server-Side Request Forgery SSRF vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass. Detailed blog post: https://ryanmroth.com/articles/orbit-fox-ssrf Vulnerability Details Detail|...

CVE-2025-2005

CVE-2025-2005 WordPress Front End Users Plugin = 3.2.32 is vulnerable to Arbitrary File Upload WordPress Front-End Users Plugin Exploit Vulnerability Information Plugin Name : Front-End Users Plugin Version Affected : = 3.2.32 Vulnerability Type : Arbitrary File Upload CVSS Score : 10 Critical Ri...

CVE-2019-19033

CVE-2019-19033: Jalios JCMS 10 Backdoor Account / Authentication Bypass I. VULNERABILITY Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account using any username and a specific password. II. CVE REFERENCE...

CVE-2026-65540

CVE-2026-65540 Popup for CF7 with Sweet Alert Hello document.getElementById'csrf'.submit; 2. Log in to WordPress as an administrator 3. Visit the malicious page 4. Optional Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in thewdkgenerateautologinlink function. This is due to the feature using a...

cve-2025-13486-vuln-setup

CVE-2025-13486 Vulnerable Test Environment One-shot Docker setup for testing ACF Extended RCE vulnerability. Quick Start 1. Download plugins run once ./download-plugins.sh 2. Start environment docker-compose up -d --build 3. Wait 30 seconds for setup, then test nuclei -t CVE-2025-13486.yaml -u...

CVE-2024-34444-Exploit-Poc

CVE-2024-34444 - Slider Revolution Missing Authorization Scanner Professional mass scanner for CVE-2024-34444 affecting Slider Revolution WordPress plugin 6.7.0 Banner 🎯 Description CVE-2024-34444 is a Missing Authorization vulnerability in the Slider Revolution WordPress plugin versions 6.7.0...

CVE-2025-11627

Send a crafted request to the AJAX handler with the extracted nonce. = // 1 find the inline script that contains the AJAX URL const s = ...document.scripts.findsc = sc.textContent.includes'billminozzijserrorcatched'; if !s console.error'Script with ajax URL not found. Is wphead present?'; return;...

hobbits

About Hobbits was developed at Mahlet in 2019 as an integrated data analysis tool. It was open-sourced and is now passively maintained by Adam and anyone who wants to contribute. Join the Discord server if you want to ask questions, contribute, or just chat about binary analysis tools...

MalConfScan

Concept MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a...