21643 matches found
WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Equadio versions = 1.1.4...
WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Juno versions = 2.25...
WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme N7 | Golf Club Sports & Events versions = 2.21...
WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Invetex versions = 2.18...
WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Asia Garden versions = 1.3.1...
WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin ThemeStek Extras for LabtechCO Theme versions = 8.4...
CVE-2026-22241
CVE-2026-22241 : Open eClass Remote Code Execution RCE This exploit uses CVE-2026-22241 automates the login, ZIP creation, upload process and providing webshell directly on the server and removes it automatically once the exploit is completed. Description An Unrestricted File Upload vulnerability...
CVE-2026-29053
This is a rework of the Repo by rootxran for this same CVE - https://github.com/rootxran/CVE-2026-29053 During testing against specific Ghost CMS environments, the original theme payload triggered a Fatal Handlebars Error. The CMS failed to activate the malicious theme because it referenced a...
Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC
Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 CVE: CVE-2022-26965 About this: This script uploads shell.tar to the PluckCMS. An application will untar the package...
CVE-2024-0679
CVE-2024-0679 ColorMag = 3.1.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up...
CVE-2025-1306
Newscrunch Exploit CVE-2025-1306 🚨 Overview This exploit targets a Cross-Site Request Forgery CSRF to Arbitrary File Upload vulnerability CVE-2025-1306 in the Newscrunch WordPress theme. Due to missing nonce validation in the newscrunchinstallandactivateplugin function, an unauthenticated attacke...
CVE-2024-10674
CVE-2024-10674 Exploit - Th Shop Mania = 1.4.9 🚀 Overview This repository contains an exploit for the vulnerability identified as CVE-2024-10674 in the Th Shop Mania WordPress theme. The vulnerability allows authenticated users with at least Subscriber-level access to install and activate arbitra...
CVE-2024-10673
🔥 Overview This script exploits CVE-2024-10673 , a critical vulnerability found in the Top Store WordPress Theme = 1.5.4. The flaw allows authenticated users with subscriber-level access or higher to install and activate arbitrary plugins via unprotected AJAX requests. ⚠️ Severity & Impact...
CVE-2023-41425-WonderCMS-Authenticated-RCE
CVE-2023-41425-WonderCMS-Authenticated-RCE Description WonderCMS v3.2.0 - v3.4.2 is vulnerable. Remote attackers can take full control of the server using a Cross-Site Scripting XSS exploit For educational purposes only . Here's the game plan: How it works: The exploit abuses the installModule...
CVE-2025-57055
CVE-2025-57055: Authenticated Remote Code Execution in WonderCMS 3.5.0 Vulnerability Mechanics An authenticated Remote Code Execution RCE vulnerability exists in WonderCMS v3.5.0. The issue stems from how the application handles remote theme/module installations via JSON descriptors. When an admi...
CVE-2026-104671
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...
CVE-2026-104671 TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled...
WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Jacqueline versions = 2.22...