CVE-2024-25092

CVE-2024-25092 Exploit Overview CVE-2024-25092 is a high-severity vulnerability affecting the WordPress NextMove Lite plugin versions = 2.17.0. This vulnerability allows a subscriber+ user to install and activate arbitrary plugins on a WordPress site due to missing authorization checks. Details...

CVE-2021-29447

WAV iXML XXE Exploit Generator Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks e.g., BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET...

Wordpress-ebook-CVE-2016-10924

Wordpress eBook Download 1.1 plugin has a file disclosure vulnerability by abusing it's get parameter in the filedownload.php file. This script brute forces different processes on the server using this vulnerability. USAGE: python pidbrute.py...

CVE-2024-0235-PoC

CVE-2024-0235-PoC The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog Usage: usage: CVE-2024-0235.py -h --url URL CVE-2024-0235.py: error:...

CVE-2024-50476

CVE-2024-50476 GRÜN spendino Spendenformular = 1.0.1 - Unauthenticated Arbitrary Options Update Description: The GRÜN spendino Spendenformular – Mehr Spenden! Weniger Arbeit! plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a...

CVE-2025-32140

🚨 CVE-2025-32140 – WP Remote Thumbnail Exploit Arbitrary File Upload 📝 Description CVE-2025-32140 is a critical vulnerability in the WP Remote Thumbnail plugin for WordPress. It enables authenticated attackers with contributor or higher permissions to upload arbitrary files , such as web shells ,...

Bash-exploit-for-CVE-2022-0739

Bash exploit for CVE-2022-0739 Unauthenticated SQL Injection for BookingPress 1.0.11. Usage: ./exploit.sh options Options: -u, --url VALUE Set the URL ex: http://example.com required -e, --event-dir VALUE Set the event directory ex: events -h, --help Display this help message...

CVE-2024-6529

Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2026-15981

CVE-2026-15981 SAML Single Sign On = 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 SAML Single Sign On ≤ 5.4.4 — Unauthenticated Authentication Bypass Proof-of-Concept Exploit Malformed Signature → opensslverify returns -1 → PHP loose cast to true →...

CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export Description The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admininit functi...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

CVE-2024-25600

CVE-2024-25600 Unauthenticated Remote Code Execution – Bricks Usage: python3 bricks.py Example: python3 bricks.py https://example.org reference: https://github.com/Chocapikk/CVE-2024-25600...

CVE-2025-8570

CVE-2025-8570 BeyondCart Connector = 2.1.0 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation 🚨 BeyondCart Connector = 2.1.0 - JWT Privilege Escalation CVE-2025-8570 🛡️ Vulnerability Overview The BeyondCart Connector plugin for WordPress, in versions 1.4.2 through 2.1.0 ...

Hippoo-Mobile-App-For-WooCommerce-CVE-Report

Hippoo-Mobile-App-for-WooCommerce-CVE-Report Disclosure for CVE-2025-13339 CVE-2025-13339 - Vulnerability in Hippoo Mobile App for WooCommerce This repository discloses a vulnerability discovered in Hippoo Mobile App for WooCommerce = 1.6.1,WordPress plugin developed by hippooo. 🛠 Affected Versio...

CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Shortcode Addons = 3.2.5 – Authenticated Admin+ Arbitrary File Upload CVE ID: CVE-2024-31114 CVSS Score: 9.1 Critical 🛠️ Vulnerability Description The Shortcode Addons – with Visual Composer, Divi, Beaver Builder, and Elementor Extension...

CVE-2024-24134

CVE-2024-24134 : Online Food Menu - Cross-Site-Scripting Proof of ConceptPoc : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24134.md Proof of ConceptPoc : https://github.com/BurakSevben/CVE-2024-24134/blob/main/CVE-2024-24134.md...

CVE-2024-13483

CVE-2024-13483 LTL Freight Quotes – SAIA Edition = 2.2.10 - Unauthenticated SQL Injection Description The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 2.2.10 due to...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w UR...

CVE-2024-7627

Exploit for CVE-2024-7627 — Bit File Manager WordPress Unauthenticated RCE Exploit 📌 Description This repository contains a proof-of-concept PoC exploit for CVE-2024-7627 , a critical Unauthenticated Remote Code Execution RCE vulnerability in the Bit File Manager WordPress plugin versions 6.0 –...