CVE-2026-32575

The SUMO Affiliates Pro plugin for WordPress, version

CVE-2026-32574 WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Forms = 2.6.104 versions...

CVE-2026-32575 WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SUMO Affiliates Pro = 11.7.0 versions...

CVE-2026-32574

The WordPress Smart Forms plugin versions

CVE-2026-32571 WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Ohio Extra = 3.6.8 versions...

CVE-2024-44000-LiteSpeed-Cache

CVE-2024-44000-LiteSpeed-Cache CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. Preview How to use ? git clone...

wp-allowed-hosts

WP Allowed Hosts This plugin has been created after the vulnerability known as CVE-2017-8295 has been disclosed, this plugin will protect you from that attack with no hassle, just add simple line to your wp-config.php . Installation Just download the plugin from here and upload it to your site...

exploit_cve-2023-26326_using_cve-2024-2961

Exploit BuddyForms CVE-2023-26326 using Iconv CVE-2024-2961 This work was done by me, Omar Elshopky, and Nour El Dien Bassiouny. This repository contains an exploit for the WordPress BuddyForms Plugin CVE-2023-26326, initially reported in the advisory by Joshua Martinelle. The exploit leverages a...

wp2shell-detect

wp2shell-detect Blackbox, non-intrusive detector for wp2shell — the pre-authentication RCE chain in WordPress core disclosed on 2026-07-17: CVE-2026-63030 — route confusion in the REST batch endpoint /wp-json/batch/v1: a sub-request whose path fails wpparseurl lands in the validation array but no...

wpbf

wpbf! wpbf is a bruteforce tool to remotely test password strength, username enumeration and plugin detection on a WordPress site. Description ^^^^^^^^^^^ The script will try to login into the WordPress dashboard through the login form using a mixture of enumerated usernames, a wordlist and...

wpbf

wpbf! wpbf 是一个暴力破解工具，用于远程测试 WordPress 站点的密码强度、用户名枚举和插件检测。 描述 ^^^^^^^^^^^ 该脚本将尝试通过登录表单，使用枚举出的用户名、字典以及博客内容中的相关关键词组合登录 WordPress 管理后台。 如果指定了单个用户名，脚本将不再搜索其他用户名。 当用户名/密码匹配时，登录信息会被记录并显示在标准输出中。 为了更快获得结果，你可以生成多个线程，但请小心不要使网站过载或导致 DoS。默认 设置可以在 "config.py" 和 "logging.conf" 文件中更改。...

WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.2...

WordPress-Exploit-CVE-2024-1071

WordPress CVE 2024-1071 SQL Exploit This exploit, which runs on WordPress versions 2.1.3 to 2.8.2, allows unauthenticated attackers to add additional SQL queries to existing queries that can be used to pull sensitive information from the database. Dork: body="/wp-content/plugins/ultimate-member" ...

CVE-2024-8353

This post is a research article published by EQSTLab. Thanks tocuokon, who discovered this vulnerability. Introduction Further Analysis CVE-2024-5932 EQST Insight R&TPDF file. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353 Arbitrary...

CMSsc4n

CMSsc4n Herramienta para identificar si un dominio tiene un CMS y determinar su versión. Por el momento, los CMS compatibles con CMSsc4n son WordPress, Moodle, Joomla, Drupal y Prestashop. Instalación Puedes descargar la última versión de CMSsc4n clonando el repositorio de GitHub: git clone...

CVE-2025-3102

CVE-2025-3102 The SureTriggers WordPress plugin contains a critical authentication bypass vulnerability CVE-2025-3102 that affects all versions up to and including 1.0.78...

CVE-2021-24145

CVE-2021-24145 WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 Installation and Execution Steps 1. WordPress Installation When proceeding with installation, please perform port forwarding in the...

WHOREPRESS

Comprobador de inicio de sesión de WordPress Instalar npm install --global whorepress Uso asegúrate de tener una lista con el formato url:username:pass whorepress list.txt Lista de argumentos Argumentos| Descripción ---|--- --admin-only| verificar solo privilegios de administrador --debug| salida...

CVE-2018-20555

CVE-2018-20555 The Wordpress Plugin called Social Network Tabs, made by the company Design Chemical, is leaking twice the Twitter accesstoken, accesstokensecret, consumerkey and consumersecret of their user which is leading to a takeover of their Twitter account. This is caused by the following...

CVE-2026-5229

CVE-2026-5229 CVE-2026-5229: Form Notify Auth Bypass via LINE OAuth Callback CVSS 9.8 Form Notify — LINE OAuth Authentication Bypass Scanner Plugin: Form Notify form-notify Vulnerability Type: Unauthenticated LINE OAuth Authentication Bypass → Account Takeover CVSS Score: 9.8 Critical CVSS Vector...