CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary File Upload -purple 📌 Description The CSV Mass Importer plugin ≤ 1.2 for WordPress contains an Admin+ Arbitrary File Upload vulnerability. Due to improper validation of uploaded files, high-privilege users such as admin can upload...

CVE-2026-11551-PoC

CVE-2026-11551 - Unauthenticated Privilege in White Label & Branding, Free Login Page Customizer White Label & Branding, Free Login Page Customizer update $wpdb-users, $data, ... ← Line 2515: DOUBLE HASH TERSIMPAN Kode yang Vulnerable inc/modules/login-screen/signup-password.php:230-251 /...

CVE-2019-15858

CVE-2019-15858 Unauthenticated Remote Code Execution at Woody Ad Snippets PoC An unauthenticated options import vulnerability combined with a stored XSS vulnerability can lead to remote code execution in the WordPress Woody Ad Snippets 90,000+ active installations. Woody Ad Snippets is a plugin...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...

CVE-2022-0739

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit, based on destr4ct's POC - just prettier. Example Example usage against HackTheBox's MetaTwo machine, which hosts a WordPress with a vulnerable bookingpress plugin version 1.0.10. python booking-sqlinjector.py -u http://metapress.htb -nu...

CVE-2023-6875

CVE-2023-6875 Exploit for PostSMTP - Unauthorized Account Takeover. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

blackash-cve-2025-6389

🔥 CVE-2025-6389 — Critical WordPress Zero-Day RCE wpvultheme 🧩 What is it? CVE-2025-6389 is a Critical CVSS 9.8 vulnerability in the Sneeit Framework WordPress plugin ≤ 8.3, widely used by popular themes. It allows unauthenticated remote code execution — the most dangerous class of web...

CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critical CWE: CWE-502 — Deserialization of Untrusted Data Authentication Requirement: None Unauthenticated Impact: Remote Code Execution Table of Contents 1. Vulnerability Overvi...

WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection

WordPress Paytm Donation plugin through 1.3.2 is susceptible to authenticated SQL injection. The plugin does not sanitize, validate, or escape the id GET parameter before using it in a SQL statement when deleting donations. An attacker can possibly obtain sensitive information, modify data, and/o...

AccessAlly <3.5.7 - Sensitive Information Leakage

WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file "resource/frontend/product/product-shortcode.php" which is responsible for the accessallyorderform shortcode dumps serialize$SERVER, which contains all environment variables. The leakage occurs on all...

Pie Register < 3.7.1.6 - SQL Injection

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection. id:...

Pinterest Automatic < 4.14.4 - Unauthenticated Arbitrary Options Update

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wppinterestautomaticparserequest' function and the 'processform.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to...

10Web Photo Gallery < 1.5.55 - SQL Injection

WordPress plugin 10Web Photo Gallery versions before 1.5.55 contains a SQL injection caused by unvalidated input in the 'bwgsearchx' parameter in frontend/models/model.php, letting attackers execute arbitrary SQL commands, exploit requires attacker to control the 'bwgsearchx' parameter. id:...

CVE-2025-3102

CVE-2025-3102 The SureTriggers WordPress plugin contains a critical authentication bypass vulnerability CVE-2025-3102 that affects all versions up to and including 1.0.78...

CVE-2023-3460

CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin POC CVSS score: 9.1 Date: 07/04/2023 What is ultimate member plugin? Ultimate member plugin is a popular membership plugin for registering user's, the plugin has 200,000+ active installation. Quick Check A critical vulnerability...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

CVE-2015-9331

CVE-2015-9331 POC Vulnerability Description CVE-2015-9331 is an arbitrary file upload vulnerability in the WordPress plugin WP All Import. This vulnerability allows an unauthenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution. Affected Versions...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

JBWPer

JBWPer | CVE-2022-4061 - JobBoardWP Automatic Mass Tool for check and exploiting vulnerability in CVE-2022-4061 - JobBoardWP install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...