learning-management-system

learning-management-system Masteriyo - LMS for WordPress = 1.6.7 - Sensitive Information Exposure Plugin Info Software Type Plugin Software Slug learning-management-system view on wordpress.org Patched? Yes Remediation Update to version 1.6.8, or a newer patched version Affected Version 1.6.8...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

CVE-2024-25600

Bricks Builder RCE Exploit CVE-2024-25600 This project contains a Python-based exploit script targeting the Bricks Builder WordPress plugin Remote Code Execution RCE vulnerability identified as CVE-2024-25600. The exploit allows unauthorized remote command execution by injecting PHP code via a...

CVE-2025-54352

CVE-2025-54352 PoC Usage Steps to install and test the WordPress PoC: 1. Install a fresh version of WordPress using Docker: 1.1 Start the MySQL database container: docker run --name wp-db -e MYSQLDATABASE=wp-db -e MYSQLUSER=wpuser -e MYSQLPASSWORD=password -e MYSQLROOTPASSWORD=rootpass -d...

CVE-2026-5461

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...

CVE-2026-104368

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the...

CVE-2025-8422

CVE-2025-8422 Propovoice targetfile Examples: python3 cve-2025-8422-exploit.py https://example.com [email protected] python3 cve-2025-8422-exploit.py https://example.com [email protected] /../../../wp-config.php...

CVE-2022-1329

CVE-2022-1329 🦠 Project developed by Agustín Sánchez Martín and Enrique Sánchez-Migallón Ochoa for the subject of Security in Computer Systems taught by Sebastián Reyes Ávila at the Higher School of Computer Science of Ciudad Real. This project contains the documentation and steps necessary to...

CVE-2025-6220

Ultimate Addons for Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

CVE-2021-29447

CVE-2021-29447 Impact Arbitrary File Disclosure: the content of any file on the host’s file system could be retrieved, e.g. wp-config.php which contains sensitive data such as database credentials. Server-Side Request Forgery SSRF: HTTP requests could be made on behalf of the WordPress...

CVE-2022-1203

CVE-2022-1203 Content Mask 1.8.4 - Subscriber+ Arbitrary Options Update Description The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a...

CVE-2025-4578

CVE-2025-4578 File Provider = 1.2.3 - Unauthenticated SQL Injection Description The File Provider plugin for WordPress is vulnerable to SQL Injection via the 'fileId' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-113708

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...

EUVD-2026-113707

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the...

CVE-2026-5461 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...

CVE-2026-104368 Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the...

CVE-2026-5461

The Forminator Forms plugin for WordPress (versions up to and including 1.55.0.2 ) is vulnerable to Limited File Deletion . The root cause is the lack of proper validation for upload field metadata received via POST requests during draft submissions. An unauthenticated attacker can submit a poiso...

CVE-2026-104368

The Export and Import Users and Customers plugin for WordPress (versions $≤$ 2.7.5 ) is vulnerable to Privilege Escalation via a CSV escape-character mismatch during the export and re-import workflow. The issue occurs because class-csvwriter.php uses PHP's default backslash (\) as an escape chara...

CVE-2024-9698

CVE-2024-9698 Crafthemes Demo Import = 3.3 - Arbitrary File Upload Exploit 📌 Overview This exploit targets a critical vulnerability CVE-2024-9698 in the Crafthemes Demo Import plugin for WordPress. The vulnerability allows authenticated administrators to upload arbitrary files to the affected...

CVE-2024-27954

CVE-2024-27954 📝 CVE-2024-27954 - Path Traversal & SSRF Vulnerability in WP Automatic Plugin Description An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in the WP Automatic plugin, allowing Path Traversal and Server-Side Request Forgery SSRF...