CVE-2025-2594

CVE-2025-2594 User Registration & Membership = 4.1.2 - Authentication Bypass Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available resources, research,...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

CVE-2024-10924-PoC

PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924 We access the WordPress web page where we will see that it has MFA enabled through the vulnerable plugin: We must run the PoC and provide the login credentials: Automatically, the browser will open via a...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

CVE-2023-0157

CVE ID : CVE-2023-0157 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

CVE-2019-15858

CVE-2019-15858 Unauthenticated Remote Code Execution at Woody Ad Snippets PoC An unauthenticated options import vulnerability combined with a stored XSS vulnerability can lead to remote code execution in the WordPress Woody Ad Snippets 90,000+ active installations. Woody Ad Snippets is a plugin...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

CVE-2023-0156

CVE ID : CVE-2023-0156 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...

CVE-2019-15858

CVE-2019-15858 Unauthenticated Remote Code Execution at Woody Ad Snippets PoC The vulnerabilities discovered by nintechnet and exploit released by GeneralEG & X-Vector An unauthenticated options import vulnerability combined with a stored XSS vulnerability can lead to remote code execution in the...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2026-19598-PoC

CVE-2026-19598-PoC Proof of Concept for CVE-2026-19598 affecting Pods ⚠️ Security Research / Authorized Testing Only This repository contains a Proof of Concept for CVE-2026-19598. Affected Software WordPress Pods = 3.3.9 Vulnerability Unauthenticated privilege escalation. PoC The PoC demonstrates...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

CVE-2024-28000-Exploit-Lab

CVE-2024-28000 — WordPress LiteSpeed Cache Lab Authorized local-lab reproduction of CVE-2024-28000 , an unauthenticated privilege-escalation issue affecting vulnerable versions of the LiteSpeed Cache WordPress plugin. Scope: This repository documents testing performed only against an isolated,...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Improper Privilege Management | Unauthenticated registration with attacker-chosen staff role → patient PHI disclosure Overview Critical vulnerability in the KiviCare – Clinic & Patient Management System WordPress plugin versions...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...

CVE-2026-32475

🔴 CVE-2026-32475 — Elementor Pro Unrestricted File Upload → RCE Critical Unrestricted File Upload vulnerability in Elementor Pro Potentially leading to Remote Code Execution RCE ⚠️ Overview CVE-2026-32475 is a critical security vulnerability affecting Elementor Pro , a widely deployed WordPress...

CVE-2023-4279

CVE ID : CVE-2023-4279 Vulnerability Type : IP Address Spoofing Description : This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce : 1. In User...

CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Privilege Escalation to Administrator 🔗 Stay Updated For the latest zero-days, exploits, and security research 📋 Vulnerability Overview Attribute| Details ---|--- CVE ID| CVE-2026-18366 Severity| 🔴 CRITICAL CVSS 9.8 Plugin| Events Manager for...