323107 matches found
wpbf
WPBF - a multithreaded WP brute forcer WPBF usage: python wpbf.py siteslist passwordlist outputfile By default, other settings are: user = 'admin' numthreads = 50 timeout = 3 verbose = True debug = False You can change them by editing the script...
CVE-2026-119325
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...
CVE-2026-13001
CVE-2026-13001 Podlove Podcast Publisher CVSS 9.8 Critical | Unauthenticated Arbitrary File Upload leading to Remote Code Execution Overview Critical vulnerability in the Podlove Podcast Publisher WordPress plugin versions up to and including 4.5.1 that allows unauthenticated attackers to upload...
CVE-2026-13157
CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...
WordPress Gravity Forms plugin <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 3.1.1...
CVE-2026-1056-POC
CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitrary File Deletion PoC This repository contains a Proof of Concept PoC for a critical vulnerability in the Snow Monkey Forms WordPress plugin versions send; // Direct execution flow to send // CSRF check is only performed for other method...
CVE-2026-119325 Bricks Theme Broken Access Control via load_popup_content
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...
EUVD-2026-113376
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the loadpopupcontent REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks...
CVE-2026-119325
Bricks Theme version 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. The flaw allows anonymous attackers to read draft and unpublished page content because the popupId parameter is processed without status or ca...
CVE-2026-0740
CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...
CVE-2025-8625
CVE-2025-8625 — PoC Overview This repository contains the source files for an article on Xakep.ru. The repository contains demonstration materials intended exclusively for security research, education, and testing in isolated laboratory environments. The repository is not intended for use against...
CVE-2026-5465
CVE-2026-5465: Privilege Escalation in Amelia WordPress Plugin ⚠️ Executive Summary Critical Insecure Direct Object Reference IDOR vulnerability in the Amelia plugin that allows an authenticated user with the Employee Provider role to escalate privileges up to full Account Takeover of the WordPres...
CVE-2025-8359
CVE-2025-8359 AdForest Repo: Nxploited/CVE-2025-8359 Exploit Script: CVE-2025-8359.py 📋 Description CVE: CVE-2025-8359 Vulnerability Type: Authentication Bypass Affected Product: AdForest - Classified Ads WordPress Theme Affected Versions: Up to and including 6.0.9 CVSS Score: 9.8 Critical The...
WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Gravity Forms versions = 3.1.2...
WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Tin Pham TF1T, Hao Ngo, Trong Pham in WordPress Plugin Gravity Forms versions = 3.1.2...
CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector
CYBERDUDEBIVASH Modular DS CVE-2026-23550 Detector Overview This is an authorized CYBERDUDEBIVASH ECOSYSTEM tool for detecting CVE-2026-23550 in WordPress Modular DS plugin. It non-destructively checks for vulnerable versions = 2.5.1 by parsing the plugin's readme.txt. Ideal for cybersecurity...
CVE-2026-63030
CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi Overview CVE-2026-63030 CVSS 9.8 and CVE-2026-60137 CVSS 9.1 form a critical pre-authentication remote code execution chain in WordPress Core. The vulnerabilities affect all default...
CVE-2026-7567-POC
Description This repository contains a Proof of Concept PoC for CVE-2026-7567. The vulnerability affects Wordpress Temporary Login Plugin = 1.0.0 and allows an attacker to authentication bypass to account takeover. I only developed the exploit/PoC for educational and research purposes. How to use...
Wordfence Bug Bounty Program Monthly Report – July 2026
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...