WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by mroccon in WordPress Plugin Kali Forms versions = 2.4.27...

WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Harry Nguyen in WordPress Plugin Video Gallery Block versions = 1.6.0...

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Kali Forms versions = 2.4.27...

WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Cozy Blocks versions = 2.2.27...

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Site Reviews versions = 8.3.5...

CVE-2026-118094 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-118094

The Ad Inserter WordPress plugin (versions up to and including 2.8.18 ) is vulnerable to Stored Cross-Site Scripting (XSS) . This issue stems from the Improper Neutralization of Input During Web Page Generation , allowing an attacker to inject malicious scripts that are subsequently stored and ex...

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Ad Inserter versions = 2.8.18...

CVE-2026-118093

The WordPress Product Feed Manager plugin (best-woocommerce-feed) is affected by a Missing Authorization vulnerability in versions up to 7.14.1 . This flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels , resulting in broken access control. The documents do n...

WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ayukiab in WordPress Plugin JetEngine versions = 3.9.0.1...

WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin Product Feed Manager versions = 7.14.1...

Mass-Scanner-CVE-2026-2631

⚡ CVE-2026-2631 Async Mass Checker Private async mass-checker for internal WordPress validation 🚨 Warning This tool performs a destructive validation. It sends a POST request to the target endpoint and may changeshopsecret on vulnerable targets. Use it only on systems you own or are explicitly...

CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

CVE-2024-55976

CVE-2024-55976 Critical Site Intel = 1.0 - Unauthenticated SQL Injection Description The Critical Site Intel plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module Description The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions ...

CVE-2024-54363-Exploit

CVE-2024-54363-Exploit Incorrect Privilege Assignment vulnerability in nssTheme Wp NssUser Register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through 1.0.0. Description The nssTheme Wp NssUser Register plugin for WordPress is vulnerable to an Incorrect Privilege...

CVE-2021-29447

CVE-2021-29447 WordPress 5.6-5.7 - Authenticated Author+ XXE https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/ usage: -l LHOST example: 127.0.0.1 -n NAME example: payload.wav -dn DTDNAME example: evil.dtd -r READ example: ../wp-config.php evil-wav-dtd-xxe.py: error: the...

Exploit-CVE-2026-1357

Install dependencies pip3 install pycryptodome requests Basic exploit python3 wpvivi.py http://target.com Custom webshell python3 wpvivi.py http://target.com --shell backdoor.php python3 wpvivi.py http://target.com --code "" Technical explanation: Null Byte Key: When RSA decryption fails, it...

CVE-2020-24186

CVE-2020-24186 This script exploits the CVE-2020-24186 vulnerability in WordPress to upload a camouflaged PHP payload and obtain a shell on the target system. There are three modes of operation: 1. Interactive Shell: Uploads the basic webshell and enters an interactive mode, allowing you to send...

CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...