file-away-exploit

File-Away Exploit CVE-2025-2539 & CVE-2025-2512 📌 Purpose This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management. This plugin contains two vulnerabilities that can lead to remote code execution Tested on File-Away...

CVE-2024-54292

CVE-2024-54292 Appsplate = 2.1.3 - Unauthenticated SQL Injection Description The Appsplate plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2024-43919

CVE-2024-43919 YARPP = 5.30.10 - Missing Authorization Description The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the /includes/yarppprosetdisplaytypes.php file in all versions up to, and including,...

Poleposph

Poleposph Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution RCE...

CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Unauthenticated SQL Injection The plugin fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an...

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.3.7 due to...

CVE-2024-31351_wordpress_exploit

Wordpress - Copymatic – AI Content Writer & Generator = 1.6 - Unauthenticated Arbitrary File Upload CVE-2024-31351 Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: fro...

CVE-2024-25600

MODIFIED CVE-2024-25600 original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT WordPress Bricks Builder RCE Exploit A Python exploit for CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution vulnerability. Description This tool exploits a critical vulnerability in WordPress...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

poc-cve-xss-inventory-press-plugin

Update - 6-23-2023 The CVE-2023-2579 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Details Title: Authenticated Reflected Cross-Site Scripting in InventoryPress Plugin for WordPress CMS Date: 2023-04-21 Autho...

CVE-2021-32789

CVE-2021-32789 Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions = 2.5.0 Install git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Exploit python3 exploit.py Enter URL: Example: http://exploit.cve/ Enter number:...

CVE-2026-94676 WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0...

CVE-2026-94676

The Tainacan Community Tainacan WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data . This vulnerability affects versions from n/a through 1.3.0 . An attacker could potentially exploit this to perform unauthorized actions. No specific exploit links ...

CVE-2024-52382

CVE-2024-52382 Matix Popup Builder = 1.0.0 - Unauthenticated Arbitrary Options Update Description The Matix Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a function in all versions u...

EXPLOITING-CVE-2024-27956

Python script that exploits CVE-2024-27956, a vulnerability in Wordpress that allows SQL Injection leading to Remote Code Execution...

CVE-2024-54262

CVE-2024-54262 Import Export For WooCommerce = 1.5 - Authenticated Subscriber+ Arbitrary File Upload Description The Import Export For WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.5. This makes...

CVE-2024-50507

CVE-2024-50507 DS.DownloadList = 1.3 - Unauthenticated PHP Object Injection Description The DS.DownloadList plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-50477

CVE-2024-50477 Stacks Mobile App Builder = 5.2.3 - Authentication Bypass via Account Takeover Description: The Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,...

CVE-2024-10124

CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce = 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Description The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized...