CVE-2024-6132

CVE-2024-6132 Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload Usage usage: CVE-2024-6132.py -h -u URL -un USERNAME -p PASSWORD -shellurl SHELLURL Pexels: Free Stock Photos = 1.2.2 - Authenticated Contributor+ Arbitrary File Upload | BY NXPLOIT - KHALED ALENAZI...

CVE-2024-13479

CVE-2024-13479 LTL Freight Quotes – SEFL Edition = 3.2.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.2.4 due to...

CVE-2024-13800

CVE-2024-13800 Popup Plugin For WordPress - ConvertPlus = 3.5.30 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing...

WP-CVE-2026-87902

WP CVE-2026-87902 Checker Русская версия A single-file, read-only diagnostic checker for WordPress CVE-2026-87902 and several useful compromise indicators. The script does not modify or delete anything. It checks: the installed WordPress branch and the corresponding patched release official...

CVE-2024-13481

CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition = 3.3.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3...

CVE-2024-52430

CVE-2024-52430 Lis Video Gallery = 0.2.1 - Unauthenticated PHP Object Injection Description The Lis Video Gallery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.1 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2023-47668

CVE-2023-47668 Restrict Content = 3.2.7 - Information Exposure via legacy log file Description: The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.7 via the legacy log file. This makes it possible...

file-away-exploit

File-Away Exploit CVE-2025-2539 & CVE-2025-2512 📌 Purpose This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management. This plugin contains two vulnerabilities that can lead to remote code execution Tested on File-Away...

CVE-2024-54292

CVE-2024-54292 Appsplate = 2.1.3 - Unauthenticated SQL Injection Description The Appsplate plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2024-43919

CVE-2024-43919 YARPP = 5.30.10 - Missing Authorization Description The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the /includes/yarppprosetdisplaytypes.php file in all versions up to, and including,...

Poleposph

Poleposph Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution RCE...

CVE-2022-0739

CVE-2022-0739 BookingPress 1.0.11 - Unauthenticated SQL Injection The plugin fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an...

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.3.7 due to...

CVE-2024-31351_wordpress_exploit

Wordpress - Copymatic – AI Content Writer & Generator = 1.6 - Unauthenticated Arbitrary File Upload CVE-2024-31351 Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: fro...

CVE-2024-25600

MODIFIED CVE-2024-25600 original - https://github.com/K3ysTr0K3R/CVE-2024-25600-EXPLOIT WordPress Bricks Builder RCE Exploit A Python exploit for CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution vulnerability. Description This tool exploits a critical vulnerability in WordPress...

CVE-2023-46197

CVE-2023-46197 Popup by Supsystic = 1.10.19 - Missing Authorization to Sensitive Information Exposure Description "The Popup by Supsystic plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.19 via the getWpCsvList action. This makes it...

poc-cve-xss-inventory-press-plugin

Update - 6-23-2023 The CVE-2023-2579 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/3cfcb8cc-9c4f-409c-934f-9f3f043de6fe Details Title: Authenticated Reflected Cross-Site Scripting in InventoryPress Plugin for WordPress CMS Date: 2023-04-21 Autho...

CVE-2021-32789

CVE-2021-32789 Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions = 2.5.0 Install git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Exploit python3 exploit.py Enter URL: Example: http://exploit.cve/ Enter number:...

CVE-2026-94676

The Tainacan Community Tainacan WordPress plugin is vulnerable to PHP Object Injection due to the deserialization of untrusted data . This vulnerability affects versions from n/a through 1.3.0 . An attacker could potentially exploit this to perform unauthorized actions. No specific exploit links ...