CVE-2026-81294 WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions...

CVE-2026-81289

CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...

CVE-2026-81288 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

CVE-2026-81288

CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...

CVE-2026-81286 WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

EUVD-2026-69923

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2026-81286

CVE-2026-81286 is an unauthenticated SQL Injection in the WCFM Marketplace WordPress plugin, affecting versions 3.8.1 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 score of 9.3 (CRITICAL) with a changed scope, indicating high confidentiality impact and low availability impact with no requ...

CVE-2026-84781

CVE-2026-84781 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress Gallery PhotoBlocks plugin, affecting versions ≤ 1.3.4 . The flaw was discovered by V1T via Patchstack. An attacker with at least Contributor privileges can inject malicious scripts that execute in ano...

CVE-2026-81283 WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

EUVD-2026-69922

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-84781 WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

CVE-2025-34085

📂 Simple File List – Unauthenticated RCE Exploit CVE-2025-34085 ⚠️ Exploit Code by: Mrj Haxcore A fully working Python exploit for the WordPress Simple File List plugin = 4.2.3, which is vulnerable to unauthenticated remote code execution RCE due to insecure file upload and rename logic. 💣...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit CVE-2025-0316 Exploit Toolkit 🚨 Auth Bypass Exploit for WordPress Plugin WP Directorybox Manager 🔥 Automated exploit script for CVE-2025-0316 — Auth Bypass via vulnerable AJAX action. ⚠️ Legal Notice This tool is intended strictly for: Research Red Team simulation Authorized...

WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by momopon1415 in WordPress Plugin RTMKit versions = 2.1.5...

CVE-2026-1357-POC

CVE-2026-1357 — WPvivid Backup & Migration RCE CVE Credit: Lucas Montes NiRoX Tool By: CyberTechAjju CVSS: 9.8 Critical | Affected: ≤ 0.9.123 | Patched: 0.9.124 ⚠️ Disclaimer For authorized security testing only. Unauthorized access to systems is illegal. Overview Unauthenticated RCE in WPvivid...

WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Migrate Guru – Site Migration & Cloning versions = 6.65...

WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MalCare Security versions = 6.69...

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TwinSecKR in WordPress Plugin WP Statistics versions = 14.16.11...

CVE-2018-6574-go-get-RCE

CVE-2018-6574-Solution root@kitploit: gcc -shared -o attack.so -fPIC attack.c...

CVE-2021-43798

Grafana CVE-2021-43798 Exploit Overview This repository demonstrates the exploitation of CVE-2021-43798, a directory traversal vulnerability in Grafana. This vulnerability allows attackers to read arbitrary files on the server. CVE Details CVE : CVE-2021-43798 Description : Directory traversal...