CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Authenticated Subscriber+ PHP Object Injection Description The ARPrice plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.0.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, wi...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Unauthenticated Remote Code Execution in Backup Migration WordPress Plugin. Run $ python exploit.py The following PHP script is executed. out.txt; ? References Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugin...

CVE-2025-2294

Kubio Page Builder LFI Exploit CVE-2025-2294 Local File Inclusion LFI exploit for Kubio Page Builder WordPress plugin versions ≤ 2.5.1. 📌 Description This tool exploits an unauthenticated LFI vulnerability in Kubio Page Builder plugin CVE-2025-2294, allowing attackers to read sensitive files on...

CVE-2024-9796

CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - Unauthenticated SQL Injection Description The PoC SQL injection will dump WordPress users and hashes. Disclaimer: This script is for educational use only. Do not use it for illegal purposes. If you do, it’s entirely your responsibility; I am not liable f...

CVE-2019-11223

CVE-2019-11223 Arbitrary File Upload in Wordpress Plugin SupportCandy Version 2.0 Below https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/ https://wordpress.org/plugins/supportcandy/developers...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Critical 📝 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to...

CVE-2023-5204

CVE-2023-5204 AI ChatBot = 5.0.12 AND time-based blind query SLEEP Payload: action=wpbosearchresponse&name=test&keyword=test&strid=1 AND SELECT 1436 FROM SELECTSLEEP5kZil Type: UNION query Title: Generic UNION que...

CVE-2025-8723

⚡️ Cloudflare Image Resizing Description: The plugin's REST API endpoint fails to authenticate users and improperly sanitizes input in the hookrestpredispatch method. This flaw enables attackers to inject and execute arbitrary PHP code by crafting malicious requests — with no login required. 🛠...

CVE-2025-47550

Instantio - Wordpress Plugin 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu...

wordpress-really-simple-security-authn-bypass-vulnerable-application

wordpress-really-simple-security-authn-bypass-vulnerable-application This is a vulnerable application to test the exploit for the Really Simple Security 9.1.2 authentication bypass CVE-2024-10924. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link Access-Control-Allow-Hea...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2024-7627-PoC

CVE-2024-7627-PoC Background This Proof-of-Concept PoC script is for WordPress plugin Bit File Manager version 6.0 - 6.5.5 Unauthenticated Remote Code Execution via Race Condition CVE-2024-7627 vulnerability. Information Description: The Bit File Manager plugin for WordPress is vulnerable to Remo...

CVE-2023-2986

Original Proof of Concept for CVE-2023-2986 Proof of Concept for vulnerability CVE-2023-2986 in 'Abandoned Cart Lite for WooCommerce' Plugin in WordPress Related Details NVD Link : https://nvd.nist.gov/vuln/detail/CVE-2023-2986 Plugin Source :...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

cve-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...

CVE-2023-4278

CVE-2023-4278 Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Software Link: https://stylemixthemes.com Version...

CVE-2026-13152

CVE-2026-13152: Unauthenticated Privilege Escalation in Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Advisory Overview CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin...

CVE-2015-4133

CVE-2015-4133 CVE 2015-4133 - Reflex Gallery 3.1.3 Arbitrary File Upload to RCE Description Reflex Gallery is a Wordpress plugins which has a vulnerability on its 3.1.3 version which can be exploited easily by attackers to upload arbitrary files, for example PHP code to achieve Remote Command...