CVE-2026-5118

CVE-2026-5118 CVE-2026-5118-expwordpressDivi Form Builder...

CVE-2026-8181

CVE-2026-8181 Burst Statistics | Authentication Bypass to Admin Account Takeover Description : Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover The Burst Statistics – Privacy-Friendly WordPress Analytics Google Analytics Alternative plugin for WordPress is...

CVE-2024-1208-and-CVE-2024-1210

CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API in LearnDash. Unauthenticated visitors can browse the quizzes and quiz questions without being enrolled in a connected course. Vulnerability: CVE-2024-1208 and CVE-2024-1210 Sensitive Information Exposure via API CVSS: 5.3...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injection — automated exploit chain. CVE-2026-63030 / CVE-2026-60137 | ---|--- Affected| WordPress 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1 Fixed| WordPress 6.9.5 / 7.0.2 Sink| authornotin SQL via desync'd authorexclude parameter Auth required| None...

CVE-2026-14894

CVE-2026-14894 — Super Forms Unauthenticated File Upload RCE Nonce Leak → datauristring Upload → Code Execution Overview CVE-2026-14894 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin by WebRehab...

poc-cve-xss-uploading-svg

Details Title: Authenticated Reflected Cross-Site Scripting in "Uploading SVG, WEBP and ICO files" Plugin for WordPress CMS Date: 2023-08-10 Author: Danilo Albuquerque Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/download Version: WordPress 6.3 Plugin's Name and...

CVE-2026-8206-Lab

CVE-2026-8206 - Kirki Account Takeover Lab Local Docker lab for demonstrating CVE-2026-8206 in the Kirki WordPress plugin. This repository compares the real Kirki plugin releases: vuln: Kirki 6.0.6 patched: Kirki 6.0.7 The lab is local-only and binds WordPress services to 127.0.0.1. The PoC is...

CVE-2024-50493

CVE-2024-50493 Automatic Translation = 1.0.4 - Unauthenticated Arbitrary File Upload Description: The Automatic Translation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for...

CVE-2025-49071

CVE-2025-49071 Flozen 1.5.1 - Unauthenticated Arbitrary File Upload Description : Flozen Theme 1.5.1 - Unauthenticated Arbitrary File Upload Description The Flozen Theme for WordPress versions up to and including 1.5.1 is vulnerable to unauthenticated arbitrary file upload, due to missing...

CVE-2023-6972-Exploit-Arbitrary-File-Deletion

CVE-2023-6972 Proof of Concept PoC Description This repository contains a Proof of Concept PoC exploit for CVE-2023-6972. The vulnerability allows for Unauthenticated Arbitrary File Deletion AFD in Wordpress Backup Migration Plugin Note: A comprehensive technical breakdown, full case study, and...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentraladminlogin2faverify Function 🚨 CVE-2025-7955 | RingCentral Communications WordPress Exploit 📝 Vulnerability Overview CVE: CVE-2025-7955 Affected Plugin: RingCentral...

CVE-2026-8713

CVE-2026-8713 — Avada Fusion Builder WordPress Exploit Pre-Auth Path Traversal → Arbitrary File Delete → Force Reinstall → RCE Overview CVE-2026-8713 is a CVSS 9.1 critical vulnerability in the Avada Fusion Builder plugin/theme for WordPress. The maybedeletefiles function in the FusionFormDBEntri...

CVE-2026-7465-Lab

CVE-2026-7465 - Spectra Gutenberg Blocks Local Lab Local Docker lab for analyzing and reproducing CVE-2026-7465 in the WordPress plugin Spectra Gutenberg Blocks ultimate-addons-for-gutenberg. This lab compares: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 The proof is intentionally least-harm. ...

CVE-2026-63030-POC

CVE-2026-63030: WordPress Pre-Auth RCE Explained 📖 Read the full technical analysis first: CVE-2026-63030: WordPress Pre-Auth RCE Explained This repository contains the proof-of-concept exploit referenced in that article. Start with the blog to understand the vulnerability, limitations, and...

By-Poloss..-..CVE-2026-9067

POC & Xploit - Proof of Concept Directory Dokumentasi dan exploit untuk vulnerability yang ditemukan di environment WordPress security testing. Daftar Vulnerability CVE ID| Plugin| Severity| Type| Status ---|---|---|---|--- CVE-2026-9067| Schema & Structured Data for WP & AMP| High 8.1|...

CVE-2025-47646

CVE-2025-47646 PoC Unauthenticated Privilege Escalation exploit for WordPress PSW Front-end Login Registration Plugin ≤ 1.12 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-47646 , targeting a vulnerability in the WordPress PSW Front-end Login Registration Plugin ≤...

CVE-2024-10245

CVE-2024-10245 Relais 2FA = 1.0 - Authentication Bypass Description The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rldoajax' function. This makes it possible...

CVE-2024-2879

CVE-2024-2879 Description LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2023-2437

CVE-2023-2437 Hello, ALL , i m RxR I Coded Tool For Exploit vulnerability UserPro = 5.1.1 – Authentication Bypass to Administrator The Exploit get the user of the admin , then login with his access , to create new admin The Best way for exploit this vulnerability is create new admin for Run TooL...

CVE-2026-14483

CVE-2026-14483 — WPL Real Estate RCE Unauthenticated remote code execution against the Realtyna WPL Real Estate Listing WordPress plugin. Field| Detail ---|--- CVE| CVE-2026-14483 Affected version| By default the script only exploits targets running WPL 5.2.0. Use --force to override. IMAGE...