CVE-2026-7567-POC

Description This repository contains a Proof of Concept PoC for CVE-2026-7567. The vulnerability affects Wordpress Temporary Login Plugin = 1.0.0 and allows an attacker to authentication bypass to account takeover. I only developed the exploit/PoC for educational and research purposes. How to use...

wordpress_cve-2018-6389

wordpresscve-2018-6389 Tries to exploit a WordPress vulnerability CVE-2018-6389 which can be used to cause a Denial of Service. WARNING: This software does not perform DoS on vulnerable targets; it executes one HTTP GET call only to check if the vulnerability is present. This software is written ...

dump

Dump This repository contains dead/unfinished projects, small scripts or stuff that doesn't deserve a repository of its own. Contents git-gat : post-exploitation script for finding private git repos Infinity dead : find phone number of any Facebook user. json2paths : converts JSON keys to paths f...

CVE-2026-63030

CVE-2026-63030: wp2shell WordPress Batch API Desynchronization SQL Injection Exploit Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 wp2shell vulnerability. Vulnerability Information CVE : CVE-2026-63030 wp2shell Companion CVE : CVE-2026-60137 Type : Pre-Auth...

wordpress-cve-2018-6389

WordPress-CVE-2018-6389 WordPress Core - 'load-scripts.php' Denial of Service -t PoC cve-2018-6389...

CVE-2023-5360-exploit-with-native-libraries

Royal Elementor Addons ≤ 1.3.78 – Unauthenticated Arbitrary File Upload RCE 📌 Overview This repository contains a modified proof-of-concept exploit for the WordPress plugin Royal Elementor Addons and Templates versions ≤ 1.3.78. The vulnerability allows unauthenticated arbitrary file upload , whi...

wordpress-CVE-2024-27956

This repository does not have a README...

Trinity-Audio-CVE-Report

Trinity-Audio-CVE-Report Disclosure for CVE-2025-9196 CVE-2025-9196 - Vulnerability in Trinity Audio This repository discloses a vulnerability discovered in Trinity Audio = 5.20.1,WordPress plugin developed by sergiotrinity. 🛠 Affected Version Product : Trinity Audio Version : v5.20.1 URL :...

CVE-2023-2982-POC

CVE-2023-2982 WordPress Social Login and Register Discord, Google, Twitter, LinkedIn = 7.6.4 - Authentication Bypass WordPress社交登录和注册（Discord，Google，Twitter，LinkedIn）=7.6.4-绕过身份验证 Info The WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to...

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2023-28121

CVE-2023-28121 Research notes and helper material for studying CVE-2023-28121 in a controlled WordPress/WooCommerce Payments lab. Safety Notice Use this material only in systems you own or have explicit authorization to test. Keep vulnerable WordPress and plugin versions inside an isolated local...

CVE-2024-4439

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-4439...

CVE-2026-1357-Lab

CVE-2026-1357 — WPvivid Backup & Migration Vuln vs Patched Docker Lab Local-only Docker lab for comparing WPvivid Backup & Migration: Vulnerable: 0.9.123 Patched: 0.9.124 Built for learning practice lab setup, verification, logs, notes. Anything PoC-related is intended to run only inside this lab...

CVE-2024-54378

CVE-2024-54378 Quietly Insights = 1.2.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Quietly Insights plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on...

CVE-2026-49085

CVE-2026-49085 CVE-2026-49085 WP Insightly PHP Object Injection Exploit...

CVE-2022-0739

CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 Usage Supply the URL to where the Booking Press plugin is in use on the application. bash exploit.sh '' e.g. Hashes are redacted in this demo ┌──user@user-/ └─$ bash sqliexploit.sh 'http://localhost/calendar/' / / / / \ / / /...

CVE-2024-28000

CVE-2024-28000 PoC This repository contains tools for exploiting the CVE-2024-28000 vulnerability affecting WordPress sites using the LiteSpeed Cache plugin. The included scripts automate the detection of exposed debug.log files and the exploitation of a privilege escalation vulnerability that...

wp2shell_scanner

wp2shellscanner Non-intrusive detection scanner for recent WordPress core vulnerabilities — including the wp2shell pre-authentication RCE chain. wp2shellscanner.py fingerprints a WordPress site's core version and reads its publicly advertised REST API surface, then classifies each tracked core CV...

wp_CVE-2020-35489_checker

wpCVE-2020-35489checker CVE-2020-35489 - Introduction The wpCVE-2020-35489checker is a Python command-line tool designed to check if a WordPress website is vulnerable to CVE-2020-35489. This particular vulnerability stems from a security flaw in the WordPress Contact Form 7 plugin versions before...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...