CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2026-10580

WordPress - Hippoo Mobile App for WooCommerce = 1.9.4 - Authentication Bypass to Admin Account Takeover Overview This tool is a proof-of-concept exploit for CVE-2026-10580 , an authentication bypass vulnerability affecting the Hippoo Mobile App for WooCommerce WordPress plugin versions = 1.9.4. T...

CVE-2024-4898

CVE-2024-4898-Poc CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration = 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation...

CVE-2022-1442

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Improper Access Control Allowing Unauthenticated Sensitive Information Disclosure Description The is vulnerable to sensitive information disclosure due to improper access control in the /core/forms/action.php file which can be exploited by an...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2022-1598

CVE-2022-1598 WPQA where ID is numeric and can be bruteforced! Nuclei Template: CVE-2022-1598.yaml VIDEO POC: https://www.youtube.com/watch?v=MbhiQKWvivQ References: https://wpscan.com/vulnerability/0416ae2f-5670-4080-a88d-3484bb19d8c8 https://vulners.com/cve/CVE-2022-1598...

CVE-2025-9216

StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Upload The StoreEngine plugin contains a vulnerability in it's CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2024-4295-Poc

CVE-2024-4295-Poc CVE-2024-4295 Email Subscribers by Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...

CVE-2016-10924

CVE-2016-10924 CVE-2016-10924 - Directory traversal vulnerability in WordPress ebook-download plugin1.2. PoC + PID Bruteforce in Python. Usage git clone https://github.com/rvizx/CVE-2016-10924 cd CVE-2016-10924 python pidbrute.py...

CVE-2025-4334

🔓 Simple User Registration = 6.3 - Unauthenticated Privilege Escalation 📄 Description The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplie...

CVE-2025-60188-Atarim-Plugin-Exploit

CVE-2025-60188-Atarim-Plugin-Exploit CVE-2025-60188: Atarim Plugin Authentication Bypass via HMAC Forgery Overview This repository contains a Proof of Concept PoC and technical analysis for CVE-2025-60188, a critical vulnerability discovered in the Atarim WordPress plugin. This flaw allows...

CVE-2021-24959

CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...

CVE-2025-9286

CVE-2025-9286 Appy Pie Connect for WooCommerce = 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation ⚠️ Appy Pie Connect for WooCommerce = 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via resetuserpassword 📝 Description The Appy Pie Connect for WooCommerc...

cve-2016-10924-POC

CVE-2016-10924-POC This repository contains a Proof-of-Concept PoC exploit script for the Directory Traversal vulnerability CVE-2016-10924 found in the WordPress plugin ebook-download versions Note: This PoC is for educational and authorized testing purposes only. Misuse of this information can...

CVE-2018-20555

CVE-2018-20555 The Wordpress Plugin called Social Network Tabs, made by the company Design Chemical, is leaking twice the Twitter accesstoken, accesstokensecret, consumerkey and consumersecret of their user which is leading to a takeover of their Twitter account. This is caused by the following...

CVE-2025-22652

CVE-2025-22652 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Payment Forms for Paystack Vulnerable version = 4.0.1 Component slug payment-forms-for-paystack Component link https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Authentication Bypass Description: The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login...

CVE-2024-6028-Poc

CVE-2024-6028-Poc CVE-2024-6028 Quiz Maker method getquestionscategories image image image Poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML,...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2022-1329

CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...