CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...

CVE-2018-1000529

CVE-2018-1000529 NVD CVE-2018-1000529: https://nvd.nist.gov/vuln/detail/CVE-2018-1000529 MITRE CVE-2018-1000529: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000529 Stored XSS in Grails Fields Plugin =2.2.7 This repository was used to demonstrate a proof of concept of the vulnerability fo...

CVE-2025-2807

CVE-2025-2807: Motors Plugin Exploit By: Nxploited | Khaled Alenazi ⚠️ Vulnerability Summary Plugin: Motors 📅 Expected to be mass-exploited due to its simplicity and critical impact. 🚫 Technical Details Vulnerable Endpoint: /wp-admin/admin-ajax.php Vulnerable Action: mvlsetupwizardinstallplugin...

sudowp-clickfunnels-zurich

SudoWP Zurich for ClickFunnels Contributors: SudoWP, WP Republic Original Authors: Etison, LLC Tags: clickfunnels, security-patch, legacy, landing pages, funnels, sudowp Requires at least: 4.3 Tested up to: 6.7 Stable tag: 0.1.1 License: GPLv2 or later Security Notice This is a community-maintain...

CVE-2025-2539---File-Away-WordPress-Plugin-Arbitrary-File-Read

CVE-2025-2539 - File Away WordPress Plugin Arbitrary File Read 📋 Executive Summary CVE ID: CVE-2025-2539 Plugin: File Away Versions = 3.9.9.0.1 Vulnerability Type: Authenticated Arbitrary File Read CVSS Score: 8.5 High Exploit Availability: Public PoC Available Impact: Unauthorized file disclosur...

wp-file-manager

wp-file-manager WP File Manager 6.9 - Arbitrary File Upload leading to RCE usage: wp-file-manager.py -h -u URL -f FILE optional arguments: -h, --help show this help message and exit -u URL, --url URL URL of host to check will need http or https -f FILE, --file FILE File of URLS to check + Testing...

LearnDash

LearnDash Sqli LearnDash = 4.25.6 - Admin+ SQL Injection Description LearnDash Wordpress plugin version below 4.25.6 is vulnerable to Admin+ SQL Injection. Details Type : plugin Slug : sfwd-lms Affected Version : CVSS Score : 9.8 CVSS Rating : Critical CVSS Vector :...

CVE-2023-32243

CVE-2023-32243. Essential Addons for Elementor 5.4.0-5.7.1 - Unauthenticated Privilege Escalation Info The plugin does not validate the password reset key, which could allow unauthenticated attackers to reset arbitrary account's password to anything they want, by knowing the related email or...

CVE-2025-9967

Exploit: Unauthenticated OTP Password Reset Browser Console PoC no authentication required async = async function getNonceAndAjaxUrl if window.resetpassobj return nonce: resetpassobj.ajaxnonce, ajaxUrl: resetpassobj.ajaxurl ; const home = await fetch'http://localhost/wordpress/'.thenr = r.text;...

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

WP-GDPR-Compliance-Plugin-Exploit

Exploit of Vulnerability CVE-2018-19207 in WP GDPR Compliance Plugin WordPress This python script creates a user with role admin. Change the varbiables baseurl, username, email for your specific case. A working email is needed, because an email is sent to this adress in order to setup a password...

better-auth

Discord · Website · Issues Better Auth Better Auth is a framework-agnostic authentication and authorization framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

ida_ifl

IFL - Interactive Functions List License: CC-BY https://creativecommons.org/licenses/by/3.0/ A small plugin with a goal to provide user-friendly way to navigate between functions and their references. Additionally, it allows to import reports generated by i.e. PE-sieve into IDA. Supports: .tag...

CVE-2026-1375

CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...

SPIPScan

SPIPScan SPIP CMS Scanner for penetration testing purpose written in Python, and released under MIT License. This tool has been designed to perform detection of SPIP installs during penetration testing. Currently, the tool detects the version of the SPIP install and tries to detect if the platfor...

CVE-2026-6279

╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder = 3.15.2 ║ ║ Unauthenticated RCE via calluserfunc ║ ╚══════════════════════════════════════════════════════════════╝ 📋 Summary Field| Detail ---|--- CVE ID| CVE-2026-6279 Affected| Avada Builder Fusio...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...