EUVD-2012-6613

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

CVE-2012-20005

The SocialFit plugin for WordPress (version 1.2.2 and earlier) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the unsanitized msg parameter within the popup.php file. Unauthenticated attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php using...

EUVD-2012-6611

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

EUVD-2012-6612

K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...

CVE-2012-20004

The K-news plugin for WordPress (versions before 1.1.1 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the failure to sanitize input provided through the 'ff' parameter in the /wp-content/plugins/knews/wysiwyg/fontpicker/index.php file. Unauthenticated attackers ...

CVE-2012-20003

The Custom Tables plugin for WordPress (versions before 3.4.6 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the lack of sanitization for the 'key' parameter within the iframe.php component. Unauthenticated attackers can craft GET requests to /wp-content/plugins...

EUVD-2012-6610

TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like...

CVE-2012-20002

The TinyMCE Thumbnail Gallery plugin for WordPress (versions before 1.1.0 ) is vulnerable to a path traversal vulnerability in the /php/download-image.php component. Unauthenticated attackers can use traversal sequences in the href parameter to read arbitrary files, such as wp-config.php, potenti...

wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit This is a Python3 program that exploits Really Simple Security 9.1.2 authentication bypass vulnerability CVE-2024-10924. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool...

NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

NPM: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress Npm vite versions = 6.4.3...

NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

NPM: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress Npm launch-editor versions = 2.14.1...

NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

NPM: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress Npm vite-plus versions = 1.0.0...

CVE-2026-6960

CVE-2026-6960 — BookingPress Pro ≤ 5.6 | Unauthenticated Arbitrary File Upload Research by: Atomic Edge Severity: Critical | CVSS: 9.8 | Auth Required: None ⚠️ v2 — Technical corrections applied based on community feedback. See Changelog for details. Overview A critical unauthenticated arbitrary...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

CVE-2022-21661

🛡️ CVE-2022-21661 A Proof-of-Concept PoC exploit written in Python for CVE-2022-21661, which is a critical vulnerability in WordPress that allows an unauthenticated attacker to perform an object injection attack , which under certain conditions can lead to Remote Code Execution RCE. This...

CVE-2015-1635

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2015-1635 Run bellow command to check CVE-2015-1635 -h Configurations 2. We integrated with the Telegram API to receive...

wordpot

Wordpot Wordpot is a Wordpress honeypot which detects probes for plugins, themes, timthumb and other common files used to fingerprint a wordpress installation. $ python wordpot.py --help Usage: wordpot.py options Options: -h, --help show this help message and exit --host=HOST Host address...

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and...

Vuln_Remediation_MegaQuagga

VulnRemediationMegaQuagga Remediation report for MegaQuagga Publishing validating the mitigation of CVE-2019-9978 through progressive defensive layering. Documents reverse proxy insertion, ModSecurity WAF deployment, Graylog SIEM integration, and SSL/TLS enforcement using multi-stage Wireshark PC...