CVE-2023-23488-pmpro-2.8

Dockerizing a Vulnerability: CVE-2023-23488 This project aims to dockerize a specific vulnerability using Docker. The goal is to create an isolated environment in which the vulnerability can be exploited and tested securely. Vulnerable Application Paid Memberships Pro v2.9.8 WordPress Plugin -...

wp-ulike-cve-2025-32259-poc

WP ULike ≤ 4.7.9.1 - Unauthenticated Content Spoof CVE-2025-32259 🔬 A simple PoC demonstrating CVE-2025-32259 in the WP ULike plugin for WordPress. 🚨 Educational use only – do not test on systems without explicit authorization. 🧠 Overview WP ULike is a popular WordPress plugin that allows users t...

CVE-2022-1119

CVE-2022-1119 1.Introduction WordPress Simple File List 3.2.8 FileRead POC 2.Usage poc -f host.txt // Batch scan poc -h 192.168.1.1 // Single scan 3.Disclaimer This tool is only for learning, research, and self-assessment. It should not be used for illegal purposes. Please comply with relevant la...

CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration !IMPORTANT Abstract: A High-Severity Cross-Site Request Forgery CSRF vulnerability CVE-2026-13156 was discovered in the official MailerSend SMTP Integration plugin for WordPress 1.0.8. The configuration eradication handler...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2026-59550

CVE-2026-59550 - AWP Classifieds ≤ 4.4.7 unauthenticated SQL injection Unauthenticated time-based blind SQL injection in the WordPress plugin AWP Classifieds another-wordpress-classifieds-plugin, reachable through the plugin's anonymous guest AJAX ad-submission flow. | ---|--- CVE| CVE-2026-59550...

CVE-2022-0739

CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 Usage Supply the URL to where the Booking Press plugin is in use on the application. bash exploit.sh '' e.g. Hashes are redacted in this demo ┌──user@user-/ └─$ bash sqliexploit.sh 'http://localhost/calendar/' / / / / \ / / /...

CVE-2020-24148

CVE-2020-24148 Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action. Vulnerable code: /moove-actions.php: ... public function moovereadxml $args = array 'data' = escsql wpunslash $POST'data' ,...

CVE-2024-9234

CVE-2024-9234 GutenKit = 2.1.0 - Unauthenticated Arbitrary File Upload Description The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the...

CVE-2026-11961

CVE-2026-11961 Mass Exploit tool for CVE-2026-11961 affecting the WordPress User Registration & Membership plugin. Features Plugin version detection Single target support Batch target processing Multi-thread support Random or custom credentials HTTP/HTTPS proxy support Request timeout configurati...

wp-allowed-hosts

WP Allowed Hosts This plugin has been created after the vulnerability known as CVE-2017-8295 has been disclosed, this plugin will protect you from that attack with no hassle, just add simple line to your wp-config.php . Installation Just download the plugin from here and upload it to your site...

CVE-2023-2982

CVE-2023-2982 WordPress Social Login and Register Discord, Google, Twitter, LinkedIn = 7.6.4 - Authentication Bypass Info The WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4...

CVE-2024-49607

CVE-2024-49607 WP Dropbox Dropins = 1.0 - Unauthenticated Arbitrary File Upload Description: The WP Dropbox Dropins plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary file...

CVE-2025-22783

CVE-2025-22783 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name SEO Plugin by Squirrly SEO Vulnerable version = 12.4.01 Component slug squirrly-seo Component link https://wordpress.org/plugins/squirrly-seo/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...

exploit_cve-2023-26326_using_cve-2024-2961

Exploit BuddyForms CVE-2023-26326 using Iconv CVE-2024-2961 This work was done by me, Omar Elshopky, and Nour El Dien Bassiouny. This repository contains an exploit for the WordPress BuddyForms Plugin CVE-2023-26326, initially reported in the advisory by Joshua Martinelle. The exploit leverages a...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...

CVE-2022-4395

MASS CVE-2022-4395 Usage apt install python3 python3-pip -y pip3 install -r require.txt python3 main.py Preview Reference https://wpscan.com/vulnerability/80407ac4-8ce3-4df7-9c41-007b69045c40...

CVE-2025-54726

CVE-2025-54726 JS Archive List = 6.1.5 - Unauthenticated SQL Injection Description The JS Archive List plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2025-3054-Exploit

CVE-2025-3054 Exploit: Download here Details CVE ID : CVE-2025-3054 Published : June 5, 2025 CVSS : 8.8 Patch Available: No official patch yet Impact The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles functi...