WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Booktics versions = 1.0.28...

Wordpress-CVE-2020-35749

Wordpress Plugin Simple Job Board 2.9.3 LFI Vulnerability CVE-2020-35749 Exploit Summary WordPress Plugin Simple Job Board is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive...

CVE-2026-14894

CVE-2026-14894 Arbitrary File Upload Nxploited Mass Exploiter — Super Forms & Elementor Pro 🩸 Join our Telegram for the latest exclusive 0-days & weaponized CVEs 📡 Channel: https://t.me/KNxploited 👤 Nxploited | @Kxploit A high-speed, multi-threaded mass exploiter that chains two unauthenticated...

CVE-2024-22145

CVE-2024-22145 InstaWP Connect = 0.1.0.8 - Missing Authorization to Arbitrary Options Update Subscriber+ Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

-CVE-2022-1609

CVE-2022-1609 Bash poc for CVE-2022-1609 WordPress Weblizar Backdoor How to install ? wget https://raw.githubusercontent.com/0xSojalSec/CVE-2022-1609/main/exploit.sh chmod +x exploit.sh ./exploit.sh How to use it ? GH0ST3exP10it$ ./exploit.sh http://127.0.0.1:8080 + Targeting http://127.0.0.1:808...

CVE-2025-5394

🚨 CVE-2025-5394 - Unauthenticated Arbitrary Plugin Upload in Alone Theme 📌 Affected Product: Alone – Charity Multipurpose Non-profit WordPress Theme Versions: 🚀 Example Usage: python3 CVE-2025-5394.py -help usage: CVE-2025-5394.py...

CVE-2026-32488

CVE-2026-32488 CVE-2026-32488 Nonce değerini değişkene al $NONCE = "c82a4f80ba" curl.exe -s -X POST "http://localhost/wp-admin/admin-ajax.php" -d "action=userregistrationuserformsubmit" -d "urfrontendformnonce=$NONCE" -d "formid=6" -d...

tvsz

CVE-2018-6389 PoC node js multisite with proxy This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time. !!! IMPORTANT BEFORE YOU CONTINUE !!!...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

CVE-2026-2631

CVE-2026-2631 Datalogics Ecommerce Delivery – Datalogics PoC / Exploit Script: CVE-2026-2631.py Author: Khaled Alenazi Nxploited – Nxploited ZeroDay Hub Contact: Telegram: @Kxploit 🧬 Vulnerability Overview Plugin: Datalogics Ecommerce Delivery – Datalogics WordPress Affected Versions: 2.6.60...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2024-10924

CVE-2024-10924 Really Simple Security Free, Pro, and Pro Multisite 9.0.0 – 9.1.1.1 – Authentication Bypass Description The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user...

CVE-2024-10924

POC for CVE-2024-10924 An error handling flaw in the REST API of the Really Simple Plugins WordPress plugin versions between 9.0.0 and 9.1.1.1 included allows an attacker, when Two-Factor Authentication is enabled, to bypass authentication and take control of an existing user or administrator...

CVE-2024-49699

CVE-2024-49699 ARPrice = 4.0.3 - Authenticated Subscriber+ PHP Object Injection Description The ARPrice plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.0.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, wi...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Unauthenticated Remote Code Execution in Backup Migration WordPress Plugin. Run $ python exploit.py The following PHP script is executed. out.txt; ? References Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugin...

CVE-2025-2294

Kubio Page Builder LFI Exploit CVE-2025-2294 Local File Inclusion LFI exploit for Kubio Page Builder WordPress plugin versions ≤ 2.5.1. 📌 Description This tool exploits an unauthenticated LFI vulnerability in Kubio Page Builder plugin CVE-2025-2294, allowing attackers to read sensitive files on...

CVE-2024-9047-Exploit

CVE-2024-9047: Exploit for WordPress File Upload Plugin Description The WordPress File Upload plugin for WordPress is vulnerable to a Path Traversal vulnerability in all versions up to, and including, 4.24.11 via the wfufiledownloader.php file. This vulnerability allows unauthenticated attackers ...

test-task-CVE-2024-25600

test-task-CVE-2024-25600 Repository for internship test-task. Step 0: Clone this git repo git clone https://github.com/Sibul-Dan-Glokta/test-task-CVE-2024-25600 Step 1: Create docker containers Start Docker daemon sudo systemctl start docker.service Start Docker Containers To start the docker...

CVE-2024-9796

CVE-2024-9796 WP-Advanced-Search 3.3.9.2 - Unauthenticated SQL Injection Description The PoC SQL injection will dump WordPress users and hashes. Disclaimer: This script is for educational use only. Do not use it for illegal purposes. If you do, it’s entirely your responsibility; I am not liable f...