CVE-2024-9756

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756 📌 Overview This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - رفع وسائط غير مصرح به الوصف لا يحتوي إضافة WordPress User Profile Builder قبل الإصدار 3.11.8 على صلاحية مناسبة، مما يسمح للمستخدمين غير الموثوقين برفع ملفات الوسائط عبر وظيفة التحميل غير المتزامن في WP. الاستخدام: root@kitploit: usage:...

CVE-2024-6244

🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...

CVE-2024-9707-Poc

CVE-2024-9707-Poc 🌐 Description This script exploits the vulnerability in the WordPress Hunk Companion plugin CVE-2024-9707, allowing unauthorized attackers to install and activate arbitrary plugins via the /wp-json/hc/v1/themehunk-import REST API endpoint. Features...

CVE-2024-56249

🛠️ WordPress Master Toolkit Exploit CVE-2024-56249 🌟 Overview This script exploits an Arbitrary File Upload vulnerability in the WordPress WPMasterToolKit plugin, allowing an attacker to upload a web shell to the server. The vulnerability exists in versions -un -p -fn 📋 Parameters...

CVE-2024-56071

🚨 Simple Dashboard = 2.0 - Unauthenticated Privilege Escalation 📄 Description The Simple Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to elevate their privileges to that of an...

CVE-2024-6132

CVE-2024-6132 Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload Usage root@kitploit: usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY NXPLOIT -...

CVE-2024-52380-Exploit

CVE-2024-52380-Exploit إضافة Picsmize لووردبريس معرضة لثغرة رفع الملفات العشوائية. الوصف هذا السكربت يستغل ثغرة CVE-2024-52380 في إضافة Picsmize لووردبريس، مما يسمح للمهاجمين غير المصادق عليهم بتنفيذ رفع ملفات عشوائي. هذه الثغرة موجودة في جميع إصدارات Picsmize حتى 1.0.0 والإصدارات الأقدم. استغلال...

CVE-2024-51793

🛡️ WordPress RepairBuddy प्लगइन शोषण 📜 CVE जानकारी CVE-ID: CVE-2024-51793 प्रकाशित: 2024-11-11 अपडेट: 2024-11-11 शीर्षक: WordPress RepairBuddy प्लगइन = 3.8115 - मनमाना फ़ाइल अपलोड भेद्यता विवरण: Webful Creations Computer Repair Shop में खतरनाक प्रकार के फ़ाइल के अप्रतिबंधित अपलोड की भेद्यता वेब...

CVE-2024-54262

CVE-2024-54262 CVE-2024-54262 का शोषण: WooCommerce के लिए Import Export में मनमाना फ़ाइल अपलोड अवलोकन यह स्क्रिप्ट "Import Export for WooCommerce" WordPress प्लगइन में एक कमजोरी का शोषण करती है। यह कमजोरी अनधिकृत उपयोगकर्ताओं को मनमानी फ़ाइलें अपलोड करने की अनुमति देती है, जिससे संभावित रिमोट कोड...

CVE-2024-3673

CVE-2024-3673 CVE-2024-3673 Exploit: Local File Inclusion in Web Directory Free WordPress Plugin before 1.7.3 Overview CVE-2024-3673 describes a critical vulnerability in the Web Directory Free WordPress plugin versions prior to 1.7.3. The plugin fails to validate a parameter before using it in a...

CVE-2024-50492

🚨 CVE-2024-50492 - ScottCart 🔥 Exploit Script for ScottCart 🧑‍💻 By Nxploit – Khaled Alenazi 📌 Description The ScottCart plugin for WordPress versions ≤ 1.1 is vulnerable to Remote Code Execution RCE. This allows unauthenticated attackers to execute arbitrary PHP functions on the server through a...

CVE-2024-30485

CVE-2024-30485 Exploit 📌 Overview CVE-2024-30485 is a high-severity vulnerability found in the Finale Lite plugin for WordPress versions = 2.18.0. The vulnerability allows authenticated users Subscriber+ to install and activate arbitrary plugins without proper authorization. Severity : HIGH CVSS...

CVE-2024-51788

💀 CVE-2024-51788 - WordPress The Novel Design Store Directory Plugin = 4.3.0 - Unauthenticated Arbitrary File Upload 🚨 Overview CVE-2024-51788 is a newly disclosed critical vulnerability affecting the The Novel Design Store Directory WordPress plugin = v4.3.0. This flaw allows unauthenticated...

CVE-2024-49668

🚨 CVE-2024-49668: WordPress Verbalize WP Plugin Arbitrary File Upload Vulnerability 📋 Overview CVE-2024-49668 is a critical vulnerability in the WordPress Verbalize WP plugin versions 1.0 and below. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shell...

CVE-2024-49653

📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 Vulnerability Details Title: WordPress Portfolleo plugin = 1.2 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell...

CVE-2024-10674

CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Overview This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitra...

CVE-2024-12542-PoC

CVE-2024-12542-PoC Missing Authorization to Unauthenticated Sensitive Information Exposure Vulnerability Description The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the phpinfo function in all versions up to, and...

CVE-2024-11972-PoC

CVE-2024-11972-PoC Hunk Companion 1.9.0 - Unauthenticated Plugin Installation Description The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin befo...

CVE-2024-10673

🔥 نظرة عامة يستغل هذا السكريبت CVE-2024-10673 ، وهي ثغرة أمنية حرجة موجودة في قالب ووردبريس Top Store = 1.5.4. تسمح هذه الثغرة للمستخدمين الموثّقين بصلاحية مستوى المشترك أو أعلى بتثبيت وتفعيل إضافات عشوائية عبر طلبات AJAX غير محمية. ⚠️ الخطورة والأثر تثبيت الإضافات غير المصرح به : يمكن للمهاجمين...