CVE-2024-10924

CVE-2024-10924 Really Simple Security Free, Pro, and Pro Multisite 9.0.0 – 9.1.1.1 – Authentication Bypass Description The Really Simple Security Free, Pro, and Pro Multisite plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user...

CVE-2025-60188-Atarim-Plugin-Exploit

CVE-2025-60188-Atarim-Plugin-Exploit CVE-2025-60188: Atarim Plugin Authentication Bypass via HMAC Forgery Overview This repository contains a Proof of Concept PoC and technical analysis for CVE-2025-60188, a critical vulnerability discovered in the Atarim WordPress plugin. This flaw allows...

CVE-2026-17532-lab

CVE-2026-17532 Lab - Seraphinite Accelerator: unauth XSS → 1-click RCE A Docker lab for CVE-2026-17532 , an unauthenticated reflected XSS in the WordPress plugin Seraphinite Accelerator that chains into remote code execution the moment a logged-in administrator opens one crafted link. Full writeu...

WordPress_CVE-2020-8417

WordPressCVE-2020-8417 CSRF Code snippet vulnerability CVE-2020-8417 https://www.youtube.com/watch?v=47OBH4N70f0 Follow us Vulnmachines YouTube Twitter Facebook LinkedIn...

CVE-2025-10041

CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Unauthenticated Arbitrary File Upload 🚨 Flex QR Code Generator ≤ 1.2.5 - Unauthenticated Arbitrary File Upload 📝 Description The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation ...

CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary File Upload -purple 📌 Description The CSV Mass Importer plugin ≤ 1.2 for WordPress contains an Admin+ Arbitrary File Upload vulnerability. Due to improper validation of uploaded files, high-privilege users such as admin can upload...

CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector

CYBERDUDEBIVASH Modular DS CVE-2026-23550 Detector Overview This is an authorized CYBERDUDEBIVASH ECOSYSTEM tool for detecting CVE-2026-23550 in WordPress Modular DS plugin. It non-destructively checks for vulnerable versions = 2.5.1 by parsing the plugin's readme.txt. Ideal for cybersecurity...

CVE-2022-21661-Demo

This repository demonstrates a vulnerability in WordPress 5.8.2, in which missing sanitization in class-wp-tax-query.php can, in very specific situations, allow attackers to perform SQL injection. Note that successful exploitation requires developers to add vulnerable code to the WordPress...

CVE-2025-6934

CVE-2025-6934 – WordPress Opal Estate Pro Exploit 📖 Description This repository contains a Proof of Concept PoC exploit for CVE-2025-6934 , a critical vulnerability in WordPress Plugin: Opal Estate Pro = 1.7.5, allowing unauthenticated administrator account creation. ⚠️ Disclaimer : This tool is...

CVE-2025-30921

CVE-2025-30921 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Newsletters Vulnerable version = 4.9.9.7 Component slug newsletters-lite Component link https://wordpress.org/plugins/newsletters-lite/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection Vulnerability type...

wprecon

WPRecon A powerful, template-driven WordPress reconnaissance and vulnerability scanning tool Features • Installation • Usage • Architecture • Templates 📋 Overview WPRecon is a modern WordPress security reconnaissance tool built with Go that helps security engineers identify vulnerabilities,...

CVE-2024-1071-Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Go to the project : cd...

POC-CVE-2023-3244

proof of concept for CVE-2023-3244 Hello, this is a simple Proof of Concept PoC for the CVE-2023-3244 vulnerability found in the WordPress plugin "comments-like-dislike". The vulnerability affects plugin versions up to and including 1.2.0. To exploit this vulnerability, you can refer to the Pytho...

wordpress_cropimage

WordPress Crop-Image CVE-2019-8943 A python3 script for WordPress Crop-Image CVE-2019-8943 Authenticated Remote Code Execution RCE. It drops a malicious PHP backdoor. Getting Started Executing program RCE python3 wprce.py -t http://wordpress.rce/ -u admin -p password -m twentytwenty Help For help...

CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 2.2.1 . The flaw exists in the recursiveUnserializeReplace() routine within the migration search-and-replace functionality. An unauthenticated attacker can inject ...

EUVD-2026-109212

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

CVE-2026-115807

The User Profile Builder WordPress plugin is vulnerable to Limited Privilege Escalation in versions up to and including 4.0.3 . The vulnerability exists because the Gutenberg Register block passes an attacker-controlled Assigned Role attribute directly into the [wppb-register] shortcode without s...

CVE-2026-115807 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

CVE-2026-1208

CVE-2026-1208: Cross-Site Request Forgery in Friendly Functions for Welcart Keywords: CVE-2026-1208, Friendly Functions for Welcart vulnerability, CSRF, Cross-Site Request Forgery, WordPress security, WordPress plugin vulnerability, CWE-352, Welcart security, settings manipulation, WordPress CVE...

wphunter

WPHunter Tool ☣ WPHunter A Wordpress Vulnerability Scanner You can use this tool on your wordpress website to check the security of your website by finding the vulnerability in your website. Over 75 million websites run on WordPress. which is now powers 26% of the Web. Remarkably enough thousands...