wordpress-CVE-2024-10924--exploit

🚀 WordPress Really Simple Security Plugin Vulnerability CVE-2024-10924 📌 Overview WordPress is one of the most popular open-source Content Management Systems CMS, powering millions of websites worldwide—from personal blogs to full-fledged e-commerce platforms. However, in November 2024 , a critic...

wp2shell-poc

wp2shell PoC Der erste Proof-of-Concept der Pre-Auth-Timing-basierten SQL-Injection-PoC für die WordPress-REST-API-Batch-Route-Konfusionskette CVE-2026-63030 + CVE-2026-60137 Erreichte Befehlsausführung, ohne auch nur zu versuchen, das Admin-Passwort zu knacken. Betroffen: WordPress 6.9.0–6.9.4...

CVE-2024-50488

CVE-2024-50488 Token Login history.pushState'', '', '/'; document.forms0.submit;...

CVE-2025-8422

CVE-2025-8422 Propovoice targetfile Examples: python3 cve-2025-8422-exploit.py https://example.com [email protected] python3 cve-2025-8422-exploit.py https://example.com [email protected] /../../../wp-config.php...

CVE-2026-8732

CVE-2026-8732 - WordPress WP Google Map Pro Mass Scanner & Auto Admin Creator 📌 Description This tool exploits CVE-2026-8732 , a vulnerability in the WP Google Map Pro plugin for WordPress. The vulnerability allows an unauthenticated attacker to obtain a valid wpmptoken via an AJAX endpoint...

Trinity-Audio-CVE-Report

Trinity-Audio-CVE-Report Disclosure for CVE-2025-9196 CVE-2025-9196 - Vulnerability in Trinity Audio This repository discloses a vulnerability discovered in Trinity Audio = 5.20.1,WordPress plugin developed by sergiotrinity. 🛠 Affected Version Product : Trinity Audio Version : v5.20.1 URL :...

SNORDIAN-s-H5PxAPIkatchu-CVE-Report

SNORDIAN's-H5PxAPIkatchu-CVE-Report Disclosure for CVE-2025-12904 CVE-2025-12904 - Vulnerability in SNORDIAN's H5PxAPIkatchu This repository discloses a vulnerability discovered in SNORDIAN's H5PxAPIkatchu " ' ※If the id within the object does not exist, it will fail. Impact : Stored scripts may ...

CVE-2025-4796

CVE-2025-4796 Eventin Once the email is changed to an attacker-controlled address, the standard WordPress password reset flow can be used to take over the account. 🧰 Script PoC Filename: CVE-2025-4796.py This script automates the steps: 1. Log in to the target WordPress site using supplied...

CVE-2024-49653

📜 WordPress Portfolleo Plugin Exploit CVE-2024-49653 🚨 Vulnerability Details Title: WordPress Portfolleo plugin = 1.2 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in James Eggers Portfolleo portfolleo allows uploading a web shell...

CVE-2026-27344

Broken Access Control in Inseri Core WordPress Plugin Plugin: Inseri Core Affected Component: /includes/restapi.php Vulnerability Type: Broken Access Control Missing Authorization Status: Reported in August 2026– Closed as Duplicate. Summary Whilst testing this summer I came across a Broken Acces...

CVE-2024-3806

CVE-2024-3806 Porto = 7.1.0 - Unauthenticated Local File Inclusion via portoajaxposts Description The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers...

CVE-2026-48907

CVE-2026-48907 Description This file CVE-2025-9209.py is a mass exploitation tool targeting vulnerability CVE-2025-9209. Core functionalities: Scans a list of sites by calling /wp-json/wp/v2/users Analyzes the response to look for sensitive user data such as public and private keys, tokens, and...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

PagSeguro-Connect-Para-WooCommerce-CVE-Report

PagSeguro-Connect-Para-WooCommerce-CVE-Report Disclosure for CVE-2025-10142 CVE-2025-10142 - Vulnerability in PagSeguro-Connect-para-WooCommerce This repository discloses a vulnerability discovered in PagSeguro-Connect-para-WooCommerce = 4.44.3,WordPress plugin developed by Ricardo Martins. 🛠...

CVE-2023-5360-exploit-with-native-libraries

Royal Elementor Addons ≤ 1.3.78 – Unauthenticated Arbitrary File Upload RCE 📌 Overview This repository contains a modified proof-of-concept exploit for the WordPress plugin Royal Elementor Addons and Templates versions ≤ 1.3.78. The vulnerability allows unauthenticated arbitrary file upload , whi...

CVE-2026-4791

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

CVE-2026-107657

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104722

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

cve-2025-22294

CVE-2025-2294 – Local File Inclusion LFI in WordPress Plugin Kubio AI Page Builder Link to detailed write-up Link to deployment Link to exploit Links to files for mass scanning: Template for active scan Template for passive scan Exploit for mass scanning in Python Exploit for mass scanning in...