CVE-2025-49029

🚨 WordPress Custom Login And Signup Widget Plugin 🔥 Base Score: 9.1 CRITICAL CWE ID: CWE-94 – Improper Control of Generation of Code 'Code Injection' 🧠 Description The plugin allows administrators to modify the contents of sn.php via the Sender’s Name field in the settings page. User-supplied inp...

CVE-2026-93485

⚡ CVE-2026-93485 - Comment2Shell 🧬 Overview CVE-2026-93485 is a high-severity cross-site scripting vulnerability affecting the WordPress core. The vulnerability is described as improper neutralization of user-controlled input during web-page generation, resulting in DOM-based XSS / stored XSS...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...

Mass-Scanner-CVE-2026-2631

⚡ CVE-2026-2631 Async Mass Checker Private async mass-checker for internal WordPress validation 🚨 Warning This tool performs a destructive validation. It sends a POST request to the target endpoint and may changeshopsecret on vulnerable targets. Use it only on systems you own or are explicitly...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security Free, Pro, and Pro Multisite 9.0.0 - 9.1.1.1 - Authentication Bypass 📖 Description This script exploits a vulnerability in the Really Simple Security plugin versions 9.0.0 - 9.1.1.1 for WordPress.The flaw allows authentication bypass due to improper...

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Bus Ticket Booking with Seat Reservation versions = 5.9.7...

WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin Booktics versions = 1.0.30...

WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin Rootblox versions = 1.0.7...

CVE-2026-112840 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112840

The WordPress SureCart plugin (versions through 4.9.5 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation . This flaw allows an attacker to inject malicious scripts into the application. No specifi...

WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin SureCart versions = 4.9.5...

WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ayukiab in WordPress Plugin VikRentCar versions = 1.4.8...

EUVD-2026-105131

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

CVE-2026-109700 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

CVE-2026-109700 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2...

CVE-2026-109700

The Meta Box – WordPress Custom Fields Framework plugin (versions up to and including 5.15.2 ) is vulnerable to a Broken Access Control issue. The root cause is Missing Authorization , which allows for the exploitation of incorrectly configured access control security levels. This vulnerability m...

WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Deva Parekh in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions = 5.15.2...

CVE-2023-29384

CVE-2023-29384 CVE-2023-29384 Auto Exploiter on WordPress Job Board and Recruitment Plugin Vulnerability type: Arbitrary File Upload...

WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Seriously Simple Podcasting versions = 3.17.0...

WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Deva Parekh in WordPress Plugin Seriously Simple Podcasting versions = 3.17.0...