VulnCheck KEV: CVE-2025-13673

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'couponcode' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

VulnCheck KEV: CVE-2024-5544

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

VulnCheck KEV: CVE-2024-8275

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ -----------------------------124662954...

CVE-2026-81780-Hash-Form

CVE-2026-81780-Hash-Form CVE-2026-81780 — Hash Form RCE The Vulnerability Unauthenticated file upload in WordPress Hash Form plugin ≤ 1.4.2. The plugin allows arbitrary file uploads without proper authentication or file type validation, leading to Remote Code Execution RCE. Exploit Chain Step...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

WordPress--CVE-2022-21661

CVE-2022-21661 POC Video | WordPress Core 5.8.2 - 'WPQuery' SQL Injection CVE-2022-21661 EDB : https://www.exploit-db.com/exploits/50663...

CVE-2026-11961

CVE-2026-11961 Mass Exploit tool for CVE-2026-11961 affecting the WordPress User Registration & Membership plugin. Features Plugin version detection Single target support Batch target processing Multi-thread support Random or custom credentials HTTP/HTTPS proxy support Request timeout configurati...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...

CVE-2023-4281

CVE ID: CVE-2023-4281 Vulnerability Type: IP Address Spoofing Description: The Activity Log plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic. Steps to reproduce: Run the...

CVE-2025-4389

CVE-2025-4389 Exploit Details Published : May 16, 2025 Updated : May 17, 2025 Severity : Critical CVSS Score: 9.8 CWE : CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type Affected Versions : All versions from n/a through 2.6.8.1 Researcher :...

CVE-2019-17234b-Exploit

Wordpress IgniteUp plugin vulnerability Wordpress IgniteUp plugin v3.4 and below allows remote unauthenticated users to potentially arbitrarily delete any file on target webserver possibly causing a Denial of Service attack. CVE-2019-17234 timeline The vulnerability was reported to wordpress.org...

WP_CROP_RCE

WordPress Image CROP RCE Analysis Report POC & Dockerfile : https://github.com/synod2/WPCROPRCE This document covers CVE-2019-8942 and CVE-2019-8943, known as WordPress Image CROP RCE, which are vulnerabilities found in WordPress versions prior to 4.9.9 and 5.0.1. CVE Number| Disclosure Date|...

CVE-2023-4549

CVE ID : CVE-2023-4549 Vulnerability Type : Cross-Site Scripting Description : The DoLogin Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping...

CVE-2024-5326-Poc

CVE-2024-5326 CVE-2024-5326 Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX = 4.1.2 - Missing Authorization to Arbitrary Options Update Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data...

CVE-2026-5118

🔥 CVE-2026-5118 Divi Form Builder One hidden field. One changed value. Full access to the entire website. 🧨 What an Attacker Can Do? Capability| Impact ---|--- 🔑 Create admin account without login| Full Site Takeover 📦 Access WooCommerce customer data| Data Breach 💉 Edit plugin/theme files PHP|...

CVE-2026-93528

📌 CVE-2026-93528: Unauthenticated Order Data Disclosure in NP Quote Request for WooCommerce • Vulnerability Type: Sensitive Data Disclosure CWE-200 • Affected Software: woo-rfq-for-woocommerce 2.4.16 • Original Researcher: Murad Islamzada • Vendor: Neah Plugins Cyrus 1. Overview & Root Cause The...