EUVD-2026-96737

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96735

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

EUVD-2026-96738

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2026-103694

The Mobile builder WordPress plugin (versions through 1.4.2 ) is vulnerable to a privilege escalation flaw. The plugin fails to properly restrict which user meta keys a logged-in user can update via one of its REST routes . This allows any user with a self-registered account, such as a customer, ...

CVE-2026-104028

The Anton Extensions WordPress plugin, in versions up to and including 1.2.2 , is vulnerable to an unauthenticated arbitrary file upload. The flaw exists because the plugin fails to perform capability checks , nonce verification , or file-type validation when writing attacker-supplied content to ...

CVE-2026-94235

The MemberHero WordPress plugin (version 6.9 and below) is vulnerable to an arbitrary email sending flaw due to a missing capability and nonce check on an AJAX action. Specifically, the wpr_send_email_to_user function allows any authenticated user , such as a subscriber, to force the site to send...

CVE-2025-0316-Exploit

CVE-2025-0316-Exploit CVE-2025-0316 Exploit Toolkit 🚨 Auth Bypass Exploit for WordPress Plugin WP Directorybox Manager 🔥 Automated exploit script for CVE-2025-0316 — Auth Bypass via vulnerable AJAX action. ⚠️ Legal Notice This tool is intended strictly for: Research Red Team simulation Authorized...

CVE-2026-8181-PoC

🚨 CVE-2026-8181 | Bypass de Autenticación en Burst Statistics -brightgreen.svg?style=for-the-badge !CAUTION ALERTA CRÍTICA: Esta vulnerabilidad permite a un atacante remoto no autenticado eludir la autenticación y obtener privilegios completos de Administrador en el sitio WordPress objetivo...

CVE-2024-1813-POC

CVE-2024-1813 - Simple Job Board ≤ 2.11.0 WordPress - Unauthenticated PHP Object Injection 🎥 Proof-of-Concept demo End-to-end: a guest stores a serialized PHP object through the public application form, the admin opens the applicants list, and the gadget chain drops a webshell. Unauthenticated PH...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentraladminlogin2faverify Function 🚨 CVE-2025-7955 | RingCentral Communications WordPress Exploit 📝 Vulnerability Overview CVE: CVE-2025-7955 Affected Plugin: RingCentral...

cve-2026-7665

CVE-2026-7665 — Unauthenticated Information Disclosure in Essential Addons for Elementor Field| Detail ---|--- CVE ID| CVE-2026-7665 Severity| Medium CVSS Score| 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Plugin| Essential Addons for Elementor Affected Versions| ≤ 6.6.4 Active Installs|...

CVE-2026-61946-Easy-Appointments-IDOR

CVE-2026-61946: One Appointment ID to Somebody Else's Booking I found an unauthenticated insecure direct object reference in the WordPress Easy Appointments plugin. The public reservation endpoint accepted an id from the query string and passed the resulting data into the plugin's database replac...

CVE-2019-9978-Social-Warfare-WordPress-Plugin-RCE

CVE-2019-9978 - Social Warfare WordPress Plugin RCE This repository contains a working Python exploit for CVE-2019-9978, a remote code execution vulnerability in the Social Warfare plugin for WordPress version system"bash -c \"bash -i & /...

CVE-2026-3844

CVE-2026-3844 PoC exploit for CVE-2026-3844, a critical unauthenticated file upload vulnerability in the WordPress Breeze plugin leading to RCE. 📌 Overview CVE-2026-3844 is a CRITICAL unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPr...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

wpstorecart-exploit

Simple PoC of wpstorecart before 2.5.30 plugin exploit CVE-2012-3576 written in bash...

CVE-2024-5084-Red-Team

🚀 HashForm Exploit – Lab Demo This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin. It’s meant only for learning, lab testing, and security research. 📌 About the Vulnerability CVE ID: CVE-2024-5084 Issue: Unauthenticated fi...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — Unauthenticated Privilege Escalation via Role Injection 🔥 Vulnerability Summary The WordPress plugin Doctreat Core versions = 1.6.8 is vulnerable to an unauthenticated privilege escalation vulnerability. This critical flaw allows unauthenticated attackers t...

CVE-2026-11551-PoC

CVE-2026-11551 - Unauthenticated Privilege in White Label & Branding, Free Login Page Customizer White Label & Branding, Free Login Page Customizer update $wpdb-users, $data, ... ← Line 2515: DOUBLE HASH TERSIMPAN Kode yang Vulnerable inc/modules/login-screen/signup-password.php:230-251 /...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...