EUVD-2026-110640

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within t...

EUVD-2026-110629

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirkipostapis AJAX dispatcher due to a missing capability check. This make...

EUVD-2026-110624

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forgetpasswordlink' parameter in all versions up to, and including, 4.61.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-110632

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...

CVE-2022-0316_wordpress_multiple_themes_exploit

Wordpress Multiple themes - Unauthenticated Arbitrary File Upload CVE-2022-0316 Unauthenticated Arbitrary File Upload in multiple themes from ChimpStudio and PixFill. For more exploits and exclusive ones contact me on telegram @KtN1990. Themes Effected westand footysquare aidreform statfort...

CVE-2025-32579

⚠️ CVE-2025-32579 - Critical RCE via Sync Posts Plugin WordPress 📦 Affects: Sync Posts 🧨 CVSS Score: 9.9 CRITICAL 📁 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Vulnerability Overview The Sync Posts WordPress plugin by SoftClever Limited is vulnerable to an Unrestricted File Upload...

CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2024-44000-LiteSpeed-Cache

CVE-2024-44000-LiteSpeed-Cache CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. Preview How to use ? git clone...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

CVE-2024-28000

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 This repository contains a Proof of Concept PoC script for exploiting a privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin. The vulnerability, identified as CVE-2024-28000 , allows unauthenticated users to gain...

CVE-2024-9822

CVE-2024-9822 Pedalo Connector = 2.0.5 - Authentication Bypass to Administrator Description The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'loginadminuser' function. This make...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description : User Registration Advanced Fields = 1.6.20 - Unauthenticated Arbitrary File Upload Description The User Registration Advanced Fields plugin for WordPress versions up to and including...

CVE-2025-9816

CVE-2025-9816 Stored XSS On WP-Statistics Plugin Scanner Detection & PoC "The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to...

CVE-2024-55976

CVE-2024-55976 Critical Site Intel = 1.0 - Unauthenticated SQL Injection Description The Critical Site Intel plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

cve-2026-4257

CVE-2026-4257 This exploits CVE-2026-4257, a Server-Side Template Injection SSTI vulnerability in the "Contact Form" Wordpress plugin by Supsystic in versions 1.7.36 and before. This vulnerability allows an unauthenticated attacker to achieve Remote Code Execution. The vulnerability exists in the...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...

CVE-2024-12877

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: OttoKit SureTriggers Privilege Escalation Vulnerability Exploitation of CVE-2025-27007, a critical vulnerability in unauthorized privilege escalation in the OttoKit plugin formerly known as SureTriggers for WordPress. This repository outlines how an attacker can create an...