CVE-2025-1562

CVE-2025-1562 POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124 Safari/537.36...

WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal plugin < 2.191 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Karthik in WordPress Plugin Security & Malware scan by CleanTalk versions 2.191...

CVE-2024-6244

🚀 pz-frontend-manager = 1.0.5 - CSRF Profile Picture Exploit 🛠️ Description This script exploits a CSRF vulnerability in the WordPress plugin pz-frontend-manager versions = 1.0.5 to change the profile picture of a logged-in user without their consent. 🔴 CVE-2024-6244 The plugin lacks proper CSRF...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by ssophiz in WordPress Plugin HUSKY versions = 1.4.6...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...

WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by leon figueira in WordPress Plugin MultiVendorX versions = 5.0.20...

WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by methsploit in WordPress Plugin VikRentCar versions = 1.4.9...

WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Pablo Alaniz in WordPress Plugin GiveWP versions = 4.19.0.1...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ...

WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by pnn219 in WordPress Plugin eCommerce Product Catalog versions = 3.6.5...

CVE-2025-5961

🚨 Migration, Backup, Staging – WPvivid Backup & Migration 📈 This vulnerability affects a plugin with over700,000+ installs 📝 CVE Details CVE: CVE-2025-5961 CVSS: 7.2 High Published: July 3, 2025 🔍 Description The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is...

WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Alpaslan Fatih Sözer in WordPress Plugin Fast Velocity Minify versions = 3.5.7...

WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Siyang Wu in WordPress Plugin MasterStudy LMS versions = 3.7.55...

WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Filip Kowalski in WordPress Plugin User Registration versions = 5.3.0...

CVE-2024-12542-PoC

CVE-2024-12542-PoC Missing Authorization to Unauthenticated Sensitive Information Exposure Vulnerability Description The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the phpinfo function in all versions up to, and...

-CVE-2015-10137-WordPress-N-Media-Website-Contact-Form-with-File-Upload-1.3.4

WordPress N-Media Website Contact Form with File Uploader File Upload Vulnerability Analysis 1. Vulnerability Point Code Analysis Plugin file: classes/plugin.class.php, method: uploadfile function uploadfile // ... if ! empty $FILES $tempFile = $FILES 'Filedata' 'tmpname'; $targetPath = $dirPath;...

CVE-2018-7422

CVE-2018-7422 Exploit for CVE-2018-7422: Local File Inclusion in WordPress Plugin Site Editor 1.1.1 T1574.008 Syntax ruby Lab Environment OffSec Proving Grounds - Readys Usage...

CVE-2026-97645

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2026-89435

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...