317933 matches found
cve-2021-38314
CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...
CVE-2023-4278
CVE-2023-4278 Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Software Link: https://stylemixthemes.com Version...
CVE-2026-13152
CVE-2026-13152: Unauthenticated Privilege Escalation in Custom Fields Account Registration For WooCommerce 1.4 -blue.svg 📖 Advisory Overview CVE-2026-13152 is an unauthenticated privilege escalation vulnerability affecting the Custom Fields Account Registration For WooCommerce WordPress plugin...
CVE-2015-4133
CVE-2015-4133 CVE 2015-4133 - Reflex Gallery 3.1.3 Arbitrary File Upload to RCE Description Reflex Gallery is a Wordpress plugins which has a vulnerability on its 3.1.3 version which can be exploited easily by attackers to upload arbitrary files, for example PHP code to achieve Remote Command...
CVE-2024-27956
Wordpress SQLI-2-RCE Exploit This Python script exploits CVE-2024-27956, a vulnerability in Wordpress that allows for SQL Injection leading to Remote Code Execution RCE. Features Multi-threaded Exploitation: Utilizes concurrent threads to exploit multiple Wordpress instances simultaneously. Dynam...
CVE-2024-10958-WPPA-Exploit
WordPress WP Photo Album Plus Arbitrary Shortcode Execution CVE-2024-10958 PoC code for unauthenticated arbitrary shortcode execution vulnerability in WordPress WP Photo Album Plus plugin. Details Affected Versions: = 8.8.08.007 CVSS Score: 7.3 High Vulnerability Type: Arbitrary Shortcode Executi...
WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetEngine versions = 3.8.16...
CVE-2025-4094
CVE-2025-4094 – WordPress Digits Plugin This method is useful for vi...
CVE-2022-32119
CVE-2022-32119 - Arox-Unrestricted-File-Upload There are multiple unrestricted file uploads that result in the arbitrary execution of PHP code. Authenticated Vulnerable Pages: localhost/officeadmin/?pid=54&action=add -----------------------------181967832439954202373233921976 Content-Disposition:...
CVE-2025-28915
CVE-2025-28915 Vulnerability Description: WordPress is a blog platform developed using PHP, supporting the setup of personal blog websites on servers running PHP and MySQL. WordPress ThemeEgg ToolKit versions 1.2.9 and earlier have a code issue vulnerability, which stems from allowing the upload ...
CVE-2024-6366-PoC
CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthenticated Media Upload Description The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. Usage: usage:...
MpOperationLogs
CVE-2023-5538 wordpress plugin MpOperationLogs = 1.0.1 - Unauthenticated Stored Cross-Site Scripting...
wordpress-CVE-2022-21661
wordpress-CVE-2022-21661 version5.8.3 path：http://your target/wp-admin/admin-ajax.php The injection type is out-of-band, you need to specify dnslog yourself and replace ceye.io POST- DATA："taxquery":"field":"termtaxonomyid","terms":"1 and ifselect loadfileconcat'\',select...
Wordpress-cve-CVE-2022-21661
Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...
CVE-2025-10897
CVE-2025-10897 WooCommerce is an open-source e-commerce plugin for WordPress that turns websites into online stores. WooCommerce Designer Pro is a WordPress plugin developed by JMA Plugins that enables customers to design and customize products directly on WooCommerce stores. IMPORTANT :...
CVE-2026-14483
CVE-2026-14483 — WPL Real Estate RCE Unauthenticated remote code execution against the Realtyna WPL Real Estate Listing WordPress plugin. Field| Detail ---|--- CVE| CVE-2026-14483 Affected version| By default the script only exploits targets running WPL 5.2.0. Use --force to override. IMAGE...
WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Push Notification for Post and BuddyPress versions = 3.23...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 This repository contains a Proof of Concept PoC script for exploiting a privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin. The vulnerability, identified as CVE-2024-28000 , allows unauthenticated users to gain...
CVE-2026-5718-Lab
CVE-2026-5718 Local Docker Lab Local-only vulnerable vs patched Docker lab for CVE-2026-5718 , affecting the WordPress plugin Drag and Drop Multiple File Upload for Contact Form 7. This lab demonstrates the difference between the vulnerable version 1.3.9.6 and the patched version 1.3.9.7 using a...