322820 matches found
CVE-2024-3495-POC
CVE-2024-3495-POC The Country State City Dropdown CF7 WordPress plugin versions up to 2.7.2 is vulnerable to SQL Injection via 'cnt' and 'sid' parameters. Insufficient escaping and lack of preparation in the SQL query allow unauthenticated attackers to append queries, potentially extracting...
CVE-2024-9290
CVE-2024-9290 Exploit Tool | Super Backup & Clone Vulnerability The tool targets WordPress websites that use the Super Backup & Clone plugin and are vulnerable to arbitrary file upload. It attempts to upload a malicious shell into the /wp-content/uploads/isnapshots/ directory. Once uploaded, the...
cve-2026-15748
CVE-2026-15748 — Forminator Security Scanner A Python-based security research and vulnerability assessment scanner for identifying WordPress installations that use the Forminator plugin and assessing version-related exposure. For Educational & Authorized Testing Only Run this project only against...
CVE-2026-1306
CVE-2026-1306 — midi-Synth WordPress A Python-based, multi-target executable PoC / list runner for CVE-2026-1306 in the WordPress midi-Synth plugin. What does it do? Collects the midiSynthnonce value via HTTP from pages where the midiSynth shortcode is loaded on target sites. Sends an action=expo...
CVE-2025-25163
CVE-2025-25163 Plugin A/B Image Optimizer = 3.3 - Authenticated Subscriber+ Arbitrary File Download Description The Plugin A/B Image Optimizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3. This makes it possible for authenticated attackers,...
CVE-2024-32444
CVE-2024-32444 As of 24/01/25 this vulnerabiltiy does not have a patch hence this is simply a product detection template as all products associated with the RealHome wordpress theme are vulnerable. The theme allows users to register new accounts via the inspiryajaxregister function, however, it...
CVE-2019-9978
CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'cat /etc/passwd' ✅ Step 2 – Start a Python HTTP Server Use Python to serve your payload: python3 -m http.server 8000 This will make your payload.txt accessible at: http://:8000/payload.txt ✅ Step 3 – Run the Exploit python3 CVE-2019-9978....
WordPress-Long-Password-Denial-of-Service
WordPress Denial of Service CVE-2014-9016 Disclaimer The contents of this script are intended to only be used only in an ethical manner. Do not use this script if you do not have written permission from the owner of the equipment. If you perform illegal actions, you are likely to be arrested and...
CVE-2026-13736
CVE-2026-13736: NewPath WildApricotPress Add-on – Member Directory = 1.0.0 — Unauthenticated Member PII Disclosure via REST API 📖 Advisory Overview CVE-2026-13736 is an unauthenticated Member Personally Identifiable Information PII disclosure vulnerability affecting the NewPath WildApricotPress...
CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0
CVE-2026-1560 – Authenticated Remote Code Execution in Custom Block Builder – Lazy Blocks ≤ 4.2.0 Researcher : ZeYrOXxx Plugin : Custom Block Builder – Lazy Blocks Affected Versions : ≤ 4.2.0 Severity : High CVSS : 8.8 Vulnerability Type : Authenticated Remote Code Execution RCE Attack Vector :...
CVE-2024-10629
CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...
CVE-2021-32789
CVE-2021-32789 Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions = 2.5.0 Install git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Exploit python3 exploit.py Enter URL: Example: http://exploit.cve/ Enter number:...
Exploit_CVE-2021-24762
exploitcve-2021-24762 This repo shows an exploit to CVE-2021-24762. This is an Blind SQLi exploit that, on default config, greps the admin password. While doing a lab, based on Wordpress with PerfectSurvey plugin, I stucked on a sql vulnerability. The only available PoC I found were based on sqlm...
WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Import and export users and customers versions = 2.5.9...
CVE-2026-48195 WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1...
WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by mroccon in WordPress Plugin PDF Poster versions = 2.6.1...
WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by mroccon in WordPress Plugin Simple Cloudflare Turnstile versions = 1.44.0...
WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by mroccon in WordPress Plugin Kali Forms versions = 2.4.27...
WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Harry Nguyen in WordPress Plugin Video Gallery Block versions = 1.6.0...