CVE-2024-44000-LiteSpeed-Cache

Poc LiteSpeed Cache CVE-2024-44000 Exploit CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data. The script works in the...

wordpress-snapcreek

wordpress-snapcreek snapcreekduplicator file read vulnerability https://www.cvedetails.com/cve/CVE-2020-11738/ Step1: Open MSFconsole: and use wordpressscanner to find all plugins used by target machine. STEP2: Attack using python script: Install/ upgrade pip3 on attacker machine Sudo apt install...

CVE-2025-5394

🚨 CVE-2025-5394 - Unauthenticated Arbitrary Plugin Upload in Alone Theme 📌 Affected Product: Alone – Charity Multipurpose Non-profit WordPress Theme Versions: 🚀 Example Usage: python3 CVE-2025-5394.py -help usage: CVE-2025-5394.py...

Trinity-Audio-CVE-Report

Trinity-Audio-CVE-Report Disclosure for CVE-2025-9196 CVE-2025-9196 - Vulnerability in Trinity Audio This repository discloses a vulnerability discovered in Trinity Audio = 5.20.1,WordPress plugin developed by sergiotrinity. 🛠 Affected Version Product : Trinity Audio Version : v5.20.1 URL :...

cve-2017-5487

What is CVE-2017-5487? : A vulnerability in the REST API implementation in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in WordPress versions prior to 4.7.1 that does not restrict the list of authors, allowing remote attackers to obtain sensitive information via a...

CVE-2019-8943

CVE-2019-8943 WordPress 5.0.0 - Image Remote Code Execution Exploit of CVE-2019-8942 and CVE-2019-8943 using python : ExploitDB : https://www.exploit-db.com/exploits/49512 The original exploit for metasploit : WordPress Core 5.0.0 - Crop-image Shell Upload Metasploit :...

CVE-2024-27954

CVE-2024-27954 📝 CVE-2024-27954 - Path Traversal & SSRF Vulnerability in WP Automatic Plugin Description An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in the WP Automatic plugin, allowing Path Traversal and Server-Side Request Forgery SSRF...

CVE-2024-3673

CVE-2024-3673 CVE-2024-3673 Exploit: Local File Inclusion in Web Directory Free WordPress Plugin before 1.7.3 Overview CVE-2024-3673 describes a critical vulnerability in the Web Directory Free WordPress plugin versions prior to 1.7.3. The plugin fails to validate a parameter before using it in a...

what-wordpress

what-wordpress Tool to extract all themes and plugins that are shown on the front page of a wordpress site...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

CVE-2022-4539

Usage Considerations: Adaptability: You can easily modify the payloads, IP generation logic, and proxies to match different scenarios or environments. Ethical Use: Ensure you have explicit permission before testing any system with this code. Scalability: This code is designed to be scalable and...

PagSeguro-Connect-Para-WooCommerce-CVE-Report

PagSeguro-Connect-Para-WooCommerce-CVE-Report Disclosure for CVE-2025-10142 CVE-2025-10142 - Vulnerability in PagSeguro-Connect-para-WooCommerce This repository discloses a vulnerability discovered in PagSeguro-Connect-para-WooCommerce = 4.44.3,WordPress plugin developed by Ricardo Martins. 🛠...

CVE-2026-32475-PoC

CVE-2026-32475 — Elementor Pro Unauthenticated Arbitrary File Upload → RCE Proof-of-concept for CVE-2026-32475 CVSS 9.0: an unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin ≤ 4.2.1 that leads to remote code execution. | ---|--- CVE| CVE-2026-32475 CVSS| 9....

Wordpress-Vulnerability-Identification-Scripts

Wordpress-Vulnerability-Identification-Scripts Identifies domains which run WordPress and tests against vulnerabilities CVE-2023-32243 / VU76395 / etc... wpidentifier.py === Input: File containing list of domains / sub-domains Output: List of domains hosting WordPress application CVE-2023-32243 =...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPress User Enumeration via REST Setup git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Usage .\Enumerate-WordPressOrgMembersREST.ps1 Alternate Route 1 for WAF Bypass...

CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticated Privilege Escalation Python 3 PoC for CVE-2026-14281 in the WordPress plugin Automation Web Platform automation-web-platform — WAWP / Notifications & OTP for WooCommerce. PoCbit Listed on PoCbit — community catalog:...

WP2Shell-CVE-2026-63030-POC

WP2Shell Detector and Validation PoC CVE coverage: CVE-2026-63030 and CVE-2026-60137 Intended use: Authorized security testing, defensive validation, and disposable localhost labs only WP2Shell is a WordPress Core vulnerability chain combining a pre-authentication REST API batch-route confusion b...

CVE-2026-15981

CVE-2026-15981 SAML Single Sign On = 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 SAML Single Sign On ≤ 5.4.4 — Unauthenticated Authentication Bypass Proof-of-Concept Exploit Malformed Signature → opensslverify returns -1 → PHP loose cast to true →...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPress + Tutor LMS...

CVE-2021-29447

WAV iXML XXE Exploit Generator Generates malicious WAV files that exploit XXE vulnerabilities in WordPress plugins parsing iXML metadata chunks e.g., BookingPress │ Target │ └──────────┘ └──────────┘ ▲ │ │ │ 2. Parse XML │ │ │ 3. GET /xxe.dtd │ │─────────────────────────────┘ │ │ 4. GET...