CVE-2021-34646

CVE-2021-34646 PoC para CVE-2021-34646 Título del Exploit: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Bypass de Autenticación Fecha: 2021-09-16 Autor del Exploit: Sebastian Kriesten 0xB455 Contacto: https://twitter.com/0xB455 Plugin Afectado: Booster for WooCommerce Plugin Slug:...

CVE-2024-10586

CVE-2024-10586 Debug Tool = 2.2 - Unauthenticated Arbitrary File Creation Description: The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including,...

CVE

CVE Writeups for CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 -------------- CVE-2025-67586 Exploit PoC -------------- Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control Software Link: https://wordpress.org/plugins/highlight-and-share/ Version: Description A broken access control...

CVE-2025-32579

⚠️ CVE-2025-32579 - Critical RCE via Sync Posts Plugin WordPress 📦 Affects: Sync Posts 🧨 CVSS Score: 9.9 CRITICAL 📁 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 🧠 Vulnerability Overview The Sync Posts WordPress plugin by SoftClever Limited is vulnerable to an Unrestricted File Upload...

CVE-2026-0594-ListSiteContributors-Plugin-Exploit

CVE-2026-0594-ListSiteContributors-Plugin-Exploit 🛡️ Description CVE-2026-0594 is a critical Reflected Cross-Site Scripting XSS vulnerability found in the List Site Contributors WordPress plugin. This exploit automates the discovery of vulnerable endpoints via the WordPress REST API wp-json and...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update Description: The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Descripción El plugin Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX para WordPress es vulnerable a la modificación no autorizada de...

CVE-2023-3460

🚨 CVE-2023-3460 - WordPress Ultimate Member Privilege Escalation Exploit This is a proof-of-concept PoC exploit for CVE-2023-3460, a critical vulnerability in the WordPress plugin Ultimate Member. It allows unauthenticated users to escalate their privileges to Administrator by crafting a maliciou...

CVE-2025-22777

CVE-2025-22777 GiveWP – Plugin de Donaciones y Plataforma de Recaudación de Fondos = 3.19.3 - Inyección de Objetos PHP No Autenticada Descripción El plugin GiveWP – Plugin de Donaciones y Plataforma de Recaudación de Fondos para WordPress es vulnerable a la Inyección de Objetos PHP en todas las...

CVE-2023-5360

CVE-2023-5360 Un EXPLOIT de código abierto para El plugin de WordPress Royal Elementor Addons and Templates anterior a la versión 1.3.79 no valida correctamente los archivos subidos, lo que podría permitir a usuarios no autenticados subir archivos arbitrarios, como PHP, y lograr RCE. Tabla de...

CVE-2023-2744

Título del Exploit: WP Plugins WP ERP = 1.12.2 - Inyección SQL Fecha: 15-10-2023 Autor del Exploit: Arvandy Enlace del software: https://wordpress.org/plugins/erp/ Página del proveedor: https://wperp.com/ Versión: 1.12.2 Probado en: Windows, Linux CVE: CVE-2023-2744 Descripción del producto WP ER...

CVE-2024-7703

CVE-2024-7703 CVE-2024-7703 Exploit: Stored Cross-Site Scripting XSS via SVG File Upload in ARMember WordPress Plugin Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2024-7703. The vulnerability affects the ARMember WordPress Plugin,...

CVE-2024-52380-Exploit

CVE-2024-52380-Exploit El plugin Picsmize para WordPress es vulnerable a subidas de archivos arbitrarias. Descripción Este script explota una vulnerabilidad CVE-2024-52380 en el plugin Picsmize para WordPress, permitiendo a atacantes no autenticados realizar subidas de archivos arbitrarias. Esta...

CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Subida Automática de Shell en WordPress Royal Elementor 1.3.78 Subida de Shell...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2025-13486

CVE-2025-13486 explotación Plugin ACF Extended para WordPress — Ejecución Remota de Código y Escalada de Privilegios Explotación de la CVE-2025-13486 descubierta por Marcin Dudek dudekmar ⚠️ Aviso legal Este repositorio se proporciona únicamente con fines de investigación y seguridad defensiva. El...

CVE-2025-13486

🔴 CVE-2025-13486 - Exploit del Plugin de WordPress Advanced Custom Fields Extended ACFE 📋 Resumen Exploit de prueba de concepto para CVE-2025-13486 , una vulnerabilidad crítica en el plugin de WordPress Advanced Custom Fields: Extended ACFE que permite la Ejecución Remota de Código que conduce a ...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP & % in the command; spaces become $IFS. Pass a form id if discovery misses. Pass -g if the script cannot find an enabled gateway. The donation request often returns HTTP 500 or times out. That is expected. The session write...

CVE-2026-3584

CVE-2026-3584 – WordPress Kali Forms = 2.4.9 - Unauthenticated Remote Code Execution via formprocess 🔥 Vulnerability Summary The WordPress Kali Forms plugin versions = 2.4.9 contain a critical unauthenticated remote code execution RCE vulnerability. This flaw allows unauthenticated attackers to...

CVE-2024-54239

CVE-2024-54239 ईयवियर प्रिस्क्रिप्शन फॉर्म = 4.0.18 - अनधिकृत मनमाना विकल्प अद्यतन के लिए अनुपलब्ध प्राधिकरण विवरण वर्डप्रेस के लिए ईयवियर प्रिस्क्रिप्शन फॉर्म प्लगइन डेटा के अनधिकृत संशोधन के लिए संवेदनशील है जो प्रिविलेज एस्केलेशन का कारण बन सकता है, क्योंकि 4.0.18 तक और सहित सभी संस्करणों में...