CLEANSTART-2026-WV46306 Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser (Chromium/Chrome)

Security vulnerability affects the grafana package. Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headless browser Chromium/Chrome...

CLEANSTART-2026-MO80037 built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability

Security vulnerability affects the grafana package. The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability...

CVE-2024-55980

CVE-2024-55980 Wr Age Verification = 2.0.0 - Unauthenticated SQL Injection Description The Wr Age Verification plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability

WordPress Masteriyo - LMS plugin = 3.4.3 - Arbitrary Content Deletion vulnerability discovered by Sakri Koskimies Saggre in WordPress Plugin Masteriyo - LMS versions = 3.4.3...

PoC_CVE-2024-28157

PoC CVE-2024-28157 Overview Jenkins GitBucket Plugin veersion 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs. Exploitation Steps Setup Jenkins using docker: 1. Use docker...

CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - Unauthenticated SQLi The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks setup script: 1. git clone...

WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by sanghyeok Kim Hamoyeah in WordPress Plugin Widget Options versions = 4.2.5...

WordPress Enable Media Replace plugin 4.1.4-4.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Enable Media Replace versions 4.1.4-4.2.2...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin All In One Login versions = 2.4.1...

WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal plugin < 2.191 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Karthik in WordPress Plugin Security & Malware scan by CleanTalk versions 2.191...

CVE-2024-6244

🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...

CVE-2020-35667-PoC

CVE-2020-35667-PoC Overview DISCLAIMER The vulnerable behaviour illustrated below was verified empirically from decompiled, patched artifacts, which tries to resemble the original vulnerability inferred with an heuristic approach, since the original vulnerable plugin release is no longer availabl...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Pablo Alaniz in WordPress Plugin GiveWP versions = 4.19.0.1...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ...

CVE-2025-5961

🚨 Migration, Backup, Staging – WPvivid Backup & Migration 📈 This vulnerability affects a plugin with over700,000+ installs 📝 CVE Details CVE: CVE-2025-5961 CVSS: 7.2 High Published: July 3, 2025 🔍 Description The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is...

WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Filip Kowalski in WordPress Plugin User Registration versions = 5.3.0...

WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by mroccon in WordPress Plugin SMS Alert Order Notifications versions = 4.0.2...