WordPress Vulnerabilities
1000 vulnerabilities related to WordPress
- PoC2026-08-25CVE-2025-14998: Branda WordPress plugin - Privilege Escalation
- PoC2026-08-21CVE-2022-1281: Photo Gallery WordPress v1.6.3 - SQL Injection
- PoC2026-08-21CVE-2026-12394: WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation
- PoC2026-08-18simple-file-list-rce: WordPress Simple File List <=4.2.2 - Remote Code Execution
- PoC2026-08-16CVE-2026-13147: WordPress Kirki < 6.0.12 - Server-Side Request Forgery
- PoC2026-08-16CVE-2026-14894: WordPress Super Forms <= 6.3.313 - Arbitrary File Upload
- PoC2026-08-16CVE-2026-17505: WordPress TranslatePress < 3.2.6 - Cross-Site Scripting
- PoC2026-08-16CVE-2026-64638: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)
- 2026-08-14WordPress /wp-login.php 跨站脚本攻击漏洞（CVE-2026-64638）
- PoC2026-08-03CVE-2025-2505: WordPress Age Gate <= 3.5.3 - Unauthenticated Local File Inclusion
- PoC2026-08-03CVE-2025-6389: Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
- PoC2026-07-31CVE-2026-3296: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection
- PoC2026-07-31CVE-2026-63030: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
- PoC2026-07-31CVE-2026-8385: WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure
- 2026-07-24WordPress W3 Total Cache /?w3tc_minify 文件读取漏洞（CVE-2026-9282）
- 2026-07-20WordPress /batch/v1 权限绕过漏洞（CVE-2026-60137/CVE-2026-63030）
- 2026-07-20WordPress Pie Register / 权限绕过漏洞（CVE-2025-34077）
- PoC2026-07-09CVE-2026-10823: YMC Filter WordPress - Unauthenticated Post Disclosure
- 2026-07-03WordPress LearnPress /wp-json/learnpress/v1/users 信息泄露漏洞（CVE-2026-8383）
- 2026-07-03WordPress LearnPress /wp-json/lp/v1/load_content_via_ajax 信息泄露漏洞（CVE-2025-11368）
- 2026-06-25WordPress Opal Estate Pro /wp-admin/admin-ajax.php 权限绕过漏洞（CVE-2025-6934）
- 2026-06-25 WordPress MyStyle Custom Product Designer /designs/ SQL 注入漏洞（CVE-2025-48281）
- 2026-06-25WordPress Frontend Login and Registration Blocks /wp-admin/admin-ajax.php 权限绕过漏洞（CVE-2025-3605）
- 2026-06-18WordPress SureTriggers /wp-json/sure-triggers/v1 权限绕过漏洞（CVE-2025-27007）
- 2026-06-18WordPress Time Capsule /wp-tcapsule-bridge/upload/php/index.php 文件上传漏洞（CVE-2024-8856）
- 2026-06-18WordPress YARPP /includes/yarpp_pro_set_display_types.php 权限绕过漏洞 (CVE-2024-43919)
- 2026-06-18WordPress /jobs SQL 注入漏洞（CVE-2025-2010）
- 2026-06-18WordPress Realtyna Organic IDX /?wpl_format=f:property_listing:ajax SQL 注入漏洞 (CVE-2024-32128)
- 2026-06-18WordPress MapPress Maps 插件 /wp-json/mapp/v1/maps/1 未授权访问漏洞 （CVE-2026-8839）
- 2026-06-18WordPress ProfileGrid /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2024-30490）
- PoC2026-06-17CVE-2021-24916: WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
- PoC2026-06-17CVE-2025-12841: WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update
- PoC2026-06-17CVE-2025-13773: WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution
- PoC2026-06-17CVE-2026-3018: WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection
- PoC2026-06-17CVE-2026-49777: WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE
- PoC2026-06-17CVE-2026-5073: WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection
- PoC2026-06-17CVE-2026-7798: WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF
- PoC2026-06-17CVE-2026-8181: WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass
- PoC2026-06-17CVE-2026-8679: WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR
- 2026-06-12WordPress Course Booking System /wp-admin/admin-ajax.php cbs_action_booking_delete SQL 注入漏洞（CVE-2025-22785）
- 2026-06-12WordPress WP-Advanced-Search /autocompletion-PHP5.5.php SQL 注入漏洞（CVE-2024-9796）
- 2026-06-05WordPress UsersWP /users/ 接口 SQL 注入漏洞（CVE-2024-6265）
- 2026-06-05WordPress FlipperCode /wp-admin/admin-ajax.php fc_ajax_call SQL 注入漏洞（CVE-2026-6433）
- 2026-06-05WordPress WebStack主题 /wp-admin/admin-ajax.php 文件上传漏洞（CVE-2026-1555）
- 2026-06-05WordPress Ajax Load More 插件 /wp-admin/admin-ajax.php 信息泄露漏洞（CVE-2025-59582）
- 2026-06-05WordPress Easy Appointments插件 /eablocks/ea_appointments/ 信息泄露漏洞（CVE-2026-2262）
- 2026-05-29WordPress Burst Statistics /wp-json/wp/v2/users/me 权限绕过漏洞（CVE-2026-8181）
- 2026-05-22WordPress WooCommerce OrderConvo 插件 /wp-json/wooconvo/v1/download-file 文件读取漏洞（CVE-2025-10162）
- 2026-05-22WordPress Kali Forms 代码执行漏洞（CVE-2026-3584）
- 2026-05-22WordPress Stop User Enumeration插件 /wp/v2/users 权限绕过漏洞（CVE-2025-4302）
- PoC2026-05-19wp-livechat-stored-xss: WordPress LiveChat < 3.7.6 - Unauthenticated Stored XSS
- 2026-05-15WordPress WP Responsive Images /wp-responsive-images/image_handler.php 文件读取漏洞（CVE-2026-1557）
- 2026-05-15WordPress 3D FlipBook /wp-admin/admin-ajax.php 信息泄露漏洞（CVE-2026-1314）
- PoC2026-05-14CVE-2024-10763: WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion
- PoC2026-05-14CVE-2025-48157: WordPress Formality Plugin <= 1.5.9 - Local File Inclusion
- PoC2026-05-09CVE-2025-10162: WordPress OrderConvo < 14 - Path Traversal
- PoC2026-05-09CVE-2025-14726: WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
- PoC2026-05-09CVE-2025-4524: WordPress Madara Theme < 2.2.2.1 - Local File Inclusion
- PoC2026-05-09CVE-2025-58226: WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure
- PoC2026-05-09CVE-2025-59136: WordPress Gerencianet Oficial <= 3.1.3 - Unauthenticated Order Status Disclosure
- PoC2026-05-09CVE-2026-1314: WordPress 3D FlipBook <= 1.16.17 - Information Disclosure
- PoC2026-05-09CVE-2026-40308: My Calendar WordPress Plugin - Information Disclosure
- 2026-04-30WordPress Plugin Mayosis Core /wp-content/plugins/mayosis-core/library/wave-audio/peaks/remote_dl.php 文件读取漏洞 （CVE-2025-1565）
- 2026-04-24WordPress WooCommerce Designer Pro存在任意文件读取(CVE-2025-10897)
- 2026-04-17WordPress 3D FlipBook 存在敏感信息泄露(CVE-2026-1314)
- PoC2026-04-16CVE-2025-13652: WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection
- PoC2026-04-16CVE-2025-14124: Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection
- PoC2026-04-16CVE-2025-2221: WordPress WPCOM Member <= 1.7.6 - SQL Injection
- PoC2026-04-16CVE-2026-6203: User Registration & Membership WordPress plugin - Open Redirect
- 2026-04-10WordPress Elementor Page Builder 插件 / 文件读取漏洞
- PoC2026-04-09CVE-2023-6592: WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing
- PoC2026-04-09CVE-2023-6750: WordPress WP Clone <= 2.4.2 - Database Backup Exposure
- PoC2026-04-09CVE-2023-6825: WordPress File Manager <= 7.2.1 - Directory Traversal
- PoC2026-04-09CVE-2024-8252: WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusion
- PoC2026-04-09CVE-2025-14437: WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File
- PoC2026-04-09CVE-2025-2558: WordPress The Wound Theme <= 0.0.1 - Local File Inclusion
- PoC2026-04-09CVE-2025-62126: WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure
- PoC2026-04-09CVE-2025-68043: LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization
- PoC2026-04-09CVE-2026-34885: WordPress Media Library Assistant <= 3.34 - SQL Injection
- PoC2026-04-09CVE-2026-3584: WordPress Kali Forms <= 2.4.9 - Remote Code Execution
- PoC2026-04-09CVE-2026-4020: Gravity SMTP WordPress Plugin - Sensitive Information Exposure
- PoC2026-04-09CVE-2026-4257: WordPress Contact Form by Supsystic - Server-Side Template Injection
- 2026-04-01WordPress Contact-form-by-supsystic SSTI注入(CVE-2026-4257)
- 2026-03-27Wordpress wpForo Forum /community/recent/ SQL 注入漏洞（CVE-2026-1581）
- 2026-03-27WordPress LottieFiles /wp-json/lottiefiles/v1/settings/ 权限绕过漏洞（CVE-2025-68043）
- PoC2026-03-25CVE-2024-12025: WordPress Collapsing Categories <= 3.0.8 - SQL Injection
- PoC2026-03-25CVE-2026-1306: WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload
- PoC2026-03-25CVE-2026-1405: WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
- PoC2026-03-25CVE-2026-1492: WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation
- 2026-03-09WordPress PhastPress plugin /wp-content/plugins/phastpress/phast.php 文件读取漏洞（CVE-2025-14388）
- PoC2026-03-05CVE-2024-9765: EKC Tournament Manager WordPress plugin - Path Traversal
- 2026-02-28WordPress Hurrakify /wp-admin/admin-ajax.php hurraki_tooltip_proxy 服务器端请求伪造漏洞（CVE-2024-54330）
- 2026-02-28WordPress Auto Amazon Links /wp-json/wp/v2/aal_ajax_unit_loading 文件读取漏洞（CVE-2025-11451）
- PoC2026-02-27CVE-2023-3452: WordPress Canto Plugin <= 3.0.4 - File Inclusion
- PoC2026-02-24CVE-2018-16363: WordPress File Manager < 3.0 - Cross-Site Scripting
- PoC2026-02-24CVE-2022-29495: WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
- PoC2026-02-24CVE-2022-45836: WordPress Download Manager <= 3.2.59 - Reflected XSS
- PoC2026-02-24CVE-2023-24000: WordPress GamiPress <= 2.5.7 - SQL Injection
- PoC2026-02-24CVE-2023-3197: WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection
- PoC2026-02-24CVE-2023-44982: WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure
- PoC2026-02-24CVE-2023-5204: WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection
- PoC2026-02-24CVE-2024-12749: WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting
- PoC2026-02-24CVE-2024-12873: Custom Field Manager WordPress - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13098: WordPress Email Newsletter - Reflected XSS
- PoC2026-02-24CVE-2024-13099: Widget4Call WordPress - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13220: WordPress Google Map Professional - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13325: Glossy WordPress - Reflected XSS
- PoC2026-02-24CVE-2024-13327: Musicbox WordPress - Reflected XSS
- PoC2026-02-24CVE-2024-13328: Giga Messenger WordPress - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13330: JustRows WordPress - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13352: Legull WordPress - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13569: WordPress Front End Users - Reflected XSS
- PoC2026-02-24CVE-2024-13570: WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting
- PoC2026-02-24CVE-2024-13609: WordPress 1 Click Migration Plugin < 2.3 - Information Exposure
- PoC2026-02-24CVE-2024-13727: MemberSpace WordPress - Cross-Site Scripting
- PoC2026-02-24CVE-2024-32128: WordPress Realtyna Organic IDX Plugin <= 4.14.4 - SQL Injection
- PoC2026-02-24CVE-2024-43965: SendGrid for WordPress <= 1.4 - SQL Injection
- PoC2026-02-24CVE-2024-8625: WordPress TS Poll < 2.4.0 - SQL Injection
- PoC2026-02-24CVE-2025-32257: 1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure
- PoC2026-02-24CVE-2025-4652: Broadstreet WordPress plugin - Reflected XSS
- PoC2026-02-24CVE-2025-54726: WordPress JS Archive List <= 6.1.5 - SQL Injection
- PoC2026-02-24wordpress-events-manager-fpd: WordPress Events Manager - Full Path Disclosure
- PoC2026-02-24wpml-multilingual-cms-xss: WordPress WPML Multilingual CMS < 4.6.1 - Cross-Site Scripting
- PoC2026-02-07CVE-2024-13222: WordPress User Messages <= 1.2.4 - Reflected XSS
- PoC2026-02-07CVE-2024-12734: Advance Post Prefix WordPress plugin - Reflected XSS
- PoC2026-02-07CVE-2026-0594: WordPress List Site Contributors < 1.1.8 - Reflected XSS
- PoC2026-02-03CVE-2024-5333: WordPress Events Calendar 6.8.2.1 - Information Disclosure
- PoC2026-02-03wordpress-joinchat-fpd: WordPress Joinchat - Full Path Disclosure
- PoC2026-02-03wordpress-rocket-lazy-load-fpd: WordPress LazyLoad Plugin - Full Path Disclosure
- PoC2026-02-03wp-h5vp-fpd: WordPress H5VP Plugin - Full Path Disclosure
- PoC2026-01-27wordpress-simple-social-icons-fpd: WordPress Simple Social Icons - Full Path Disclosure
- PoC2026-01-24CVE-2022-0188: CMP WordPress < 4.0.19 - Broken Access Control
- PoC2026-01-24wordpress-wp-env-exposure: WordPress Configuration wp-env - Exposure
- PoC2026-01-24wp-wpstatistics-log: WordPress Plugin WP Statistics Error Log Disclosure
- PoC2026-01-24wp-a3-lazy-load-top-fpd: WordPress a3 Lazy Load - Full Path Disclosure
- PoC2026-01-24wp-breadcrumb-navxt-fpd: WordPress Breadcrumb NavXT - Full Path Disclosure
- PoC2026-01-24wp-cf7-data-source-fpd: WordPress Data Source for Contact Form 7 - Full Path Disclosure
- PoC2026-01-24wp-header-footer-elementor-fpd: WordPress Header Footer Elementor - Full Path Disclosure
- PoC2026-01-24wp-easy-wp-smtp-log-exposure: WordPress Easy WP SMTP - Log Exposure
- 2026-01-23WordPress Drag and Drop Multiple File Upload for WooCommerce dnd_codedropz_upload_wc 文件上传漏洞（CVE-2025-4403）
- 2026-01-23WordPress Broken Link Notifier /wp-admin/admin-ajax.php blnotifier_blinks 服务器端请求伪造漏洞（CVE-2025-6851）
- 2026-01-23WordPress Drag and Drop Multiple File Upload for WooCommerce dnd_codedropz_upload_wc 文件上传漏洞（CVE-2025-4403）
- 2026-01-23WordPress Broken Link Notifier /wp-admin/admin-ajax.php blnotifier_blinks 服务器端请求伪造漏洞（CVE-2025-6851）
- PoC2026-01-16CVE-2024-29137: WordPress Tourfic Plugin <= 2.11.7 - Cross-Site Scripting
- PoC2026-01-16wordpress-meta-box-fpd: WordPress Meta Box - Full Path Disclosure
- PoC2026-01-16wp-add-search-to-menu-fpd: WordPress Ivory Search - Full Path Disclosure
- PoC2026-01-16wp-advanced-iframe-fpd: WordPress Advanced iFrame - Full Path Disclosure
- PoC2026-01-16wp-advanced-responsive-video-embedder-fpd: WordPress Advanced Responsive Video Embedder - Full Path Disclosure
- PoC2026-01-16wp-ajax-load-more-anything-fpd: WordPress Load More Anything - Full Path Disclosure
- PoC2026-01-16wp-ajax-search-lite-fpd: WordPress Ajax Search Lite - Full Path Disclosure
- PoC2026-01-16wp-all-in-one-seo-pack-fpd: WordPress All in One SEO Pack - Full Path Disclosure
- PoC2026-01-16wp-astra-fpd: WordPress Astra - Full Path Disclosure
- PoC2026-01-16wp-better-wp-security-fpd: WordPress Plugin iThemes Security - Full Path Disclosure
- PoC2026-01-16wp-call-now-button-fpd: WordPress Call Now Button - Full Path Disclosure
- PoC2026-01-16wp-contact-form-7-fpd: WordPress Contact Form 7 - Full Path Disclosure
- PoC2026-01-16wp-contact-form-fpd: WordPress Contact Form - Full Path Disclosure
- PoC2026-01-16wp-custom-post-type-ui-fpd: WordPress Custom Post Type UI - Full Path Disclosure
- PoC2026-01-16wp-duplicate-page-fpd: WordPress Duplicate Page - Full Path Disclosure
- PoC2026-01-16wp-duracelltomi-google-tag-manager-fpd: WordPress Plugin Google Tag Manager - Full Path Disclosure
- PoC2026-01-16wp-elementor-pro-fpd: WordPress Elementor Pro - Full Path Disclosure
- PoC2026-01-16wp-hello-dolly-fpd: WordPress Plugin Hello Dolly - Full Path Disclosure
- PoC2026-01-16wp-hostinger-fpd: WordPress Hostinger Tools - Full Path Disclosure
- PoC2026-01-16wp-intuitive-custom-post-order-fpd: WordPress Plugin Intuitive Custom Post Order - Full Path Disclosure
- PoC2026-01-16wp-megamenu-fpd: WordPress Plugin Max Mega Menu (megamenu) - Full Path Disclosure
- PoC2026-01-16wp-newsletter-fpd: WordPress Plugin Newsletter - Full Path Disclosure
- PoC2026-01-16wp-pagenavi-fpd: WordPress WP-PageNavi - Full Path Disclosure
- PoC2026-01-16wp-really-simple-captcha-fpd: WordPress Plugin Really Simple CAPTCHA - Full Path Disclosure
- PoC2026-01-16wp-responsive-fpd: WordPress Coming Soon Page - Full Path Disclosure
- PoC2026-01-16wp-simple-custom-css-fpd: WordPress Simple Custom CSS Plugin - Full Path Disclosure
- PoC2026-01-16wp-ssl-insecure-content-fixer-fpd: WordPress Plugin SSL Insecure Content Fixer - Full Path Disclosure
- PoC2026-01-16wp-super-cache-fpd: WordPress WP Super Cache - Full Path Disclosure
- PoC2026-01-16wp-twenty-theme-fpd: WordPress Twenty Seventeen - Full Path Disclosure
- PoC2026-01-16wp-twentysixteen-fpd: WordPress Twenty Sixteen - Full Path Disclosure
- PoC2026-01-16wp-updraftplus-fpd: WordPress UpdraftPlus - Full Path Disclosure
- PoC2026-01-16wp-w3-total-cache-fpd: WordPress W3 Total Cache - Full Path Disclosure
- PoC2026-01-16wp-worker-fpd: WordPress ManageWP Worker - Full Path Disclosure
- PoC2026-01-16wp-wpforms-lite-fpd: WordPress WPForms - Full Path Disclosure
- PoC2026-01-16wp-wpfront-scroll-top-fpd: WordPress WPFront Scroll Top - Full Path Disclosure
- PoC2026-01-16wp-gravity-forms-log-disclosure: WordPress Gravity Forms - Log File Disclosure
- 2026-01-09WordPress Yoco Payments plugin /wp-json/yoco/logs 目录遍历漏洞（CVE-2025-13801）
- PoC2026-01-09CVE-2012-10018: WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload
- PoC2026-01-09CVE-2024-29138: WordPress Restrict User Access <= 2.5 - Cross-Site Scripting
- PoC2026-01-09wordpress-elementor-fpd: WordPress Elementor Page Builder - Full Path Disclosure
- PoC2026-01-09wordpress-menu-image-fpd: WordPress Menu Image - Full Path Disclosure
- PoC2026-01-09wp-jetpack-ssrf: Wordpress Jetpack plugin - Server Side Request Forgery
- 2026-01-09WordPress Yoco Payments plugin /wp-json/yoco/logs 目录遍历漏洞（CVE-2025-13801）
- PoC2026-01-08CVE-2015-8350: WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS
- PoC2026-01-08CVE-2017-18580: WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
- PoC2026-01-08CVE-2020-12832: WordPress Simple File List - Path Traversal
- PoC2026-01-08CVE-2021-24657: Limit Login Attempts WordPress - Stored Cross-site Scripting
- PoC2026-01-08CVE-2021-24681: Duplicate Page WordPress - Stored Cross-Site Scripting
- PoC2026-01-08CVE-2021-25082: WordPress Popup Builder < 4.0.7 - Remote Code Execution
- PoC2026-01-08CVE-2022-0765: WordPress Loco Translate < 2.6.1 - Cross-Site Scripting
- PoC2026-01-08CVE-2022-0873: WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting
- PoC2026-01-08CVE-2023-27624: WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS
- PoC2026-01-08CVE-2023-6266: WordPress Backup Migration <= 1.3.6 - Path Traversal
- PoC2026-01-08CVE-2023-7164: WordPress BackWPup < 4.0.4 - Backup File Disclosure
- PoC2026-01-08CVE-2024-35693: WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting
- PoC2026-01-08CVE-2024-35694: Wordpress WPMobile.App >= 11.42 - Cross-Site Scripting
- PoC2026-01-08CVE-2024-5057: WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection
- PoC2026-01-08wordpress-db-exposure: WordPress Database Backup File - Exposure
- PoC2026-01-08wp-w3-total-cache-exposure: WordPress W3 Total Cache - Cache Files Exposure
- PoC2026-01-08wp-enable-media-replace-log: WordPress Plugin Enable Media Replace - Log File Exposure
- PoC2026-01-08wp-flexible-shipping-log: WordPress Flexible Shipping - Log File Exposure
- PoC2026-01-08wp-newsletter-log-exposure: WordPress Newsletter - Log File Exposure
- PoC2026-01-08wp-pretty-link-log-disclosure: WordPress Pretty Link - Error Log Disclosure
- PoC2026-01-08wp-wps-hide-login-log: WordPress WPS Hide Login - Error Log Disclosure
- PoC2026-01-08nextgen-gallery-pro-error-log: WordPress NextGEN Gallery Pro - Error Log Disclosure
- PoC2026-01-08wordfence-config-disclosure: WordPress Wordfence - Configuration File Disclosure
- PoC2026-01-08wordfence-waf-logs-disclosure: WordPress Wordfence - WAF Logs and Data Disclosure
- PoC2026-01-08wordpress-amp-fpd: WordPress AMP - Full Path Disclosure
- PoC2026-01-08wordpress-cmb2-fpd: WordPress CMB2 - Full Path Disclosure
- PoC2026-01-08wordpress-imsanity-fpd: WordPress Plugin Imsanity - Full Path Disclosure
- PoC2026-01-08wordpress-storefront-fpd: WordPress Storefront Theme - Full Path Disclosure
- PoC2026-01-08wordpress-twentynineteen-fpd: WordPress Twenty Nineteen - Full Path Disclosure
- PoC2026-01-08wp-add-to-any-fpd: WordPress AddToAny Share Buttons Plugin - Full Path Disclosure
- PoC2026-01-08wp-astra-sites-fpd: WordPress Astra Sites - Full Path Disclosure
- PoC2026-01-08wp-iwp-client-fpd: WordPress Plugin InfiniteWP Client - Full Path Disclosure
- PoC2026-01-08wp-maintenance-mode-fpd: WordPress WP Maintenance Mode - Full Path Disclosure
- PoC2026-01-08wp-members-error-log-disclosure: WordPress Members / Membership & User Role Editor Plugin - Error Log Disclosure
- PoC2026-01-08wp-members-log-disclosure: WordPress Members Plugin - Debug/Error Log Disclosure
- PoC2026-01-08wp-migrate-db-fpd: WordPress WP Migrate DB - Full Path Disclosure
- PoC2026-01-08wp-nextgen-gallery-log: WordPress Gallery Plugin / NextGEN Gallery (nextgen-gallery) Error Log Disclosure
- PoC2026-01-08wp-oceanwp-fpd: WordPress OceanWP - Full Path Disclosure
- PoC2026-01-08wp-pretty-links-fpd: WordPress Pretty Links - Full Path Disclosure
- PoC2026-01-08wp-rank-math-seo-fpd: WordPress SEO Plugin Rank Math - Full Path Disclosure
- PoC2026-01-08wp-svg-support-fpd: WordPress SVG Support - Full Path Disclosure
- PoC2026-01-08wp-the-events-calendar-fpd: WordPress The Events Calendar - Full Path Disclosure
- PoC2026-01-08wp-toc-plus-fpd: WordPress Plugin Table of Contents Plus - Full Path Disclosure
- PoC2026-01-08wp-wp-mail-smtp-fpd: WordPress WP Mail SMTP - Full Path Disclosure
- PoC2026-01-08wp-yith-woocommerce-wishlist-fpd: WordPress YITH WooCommerce Wishlist - Full Path Disclosure
- PoC2026-01-08wp-yoast-seo-fpd: WordPress Yoast SEO - Full Path Disclosure
- PoC2026-01-08wordpress-meta-box-fpd: WordPress Meta Box - Full Path Disclosure
- PoC2026-01-08wp-all-in-one-seo-pack-fpd: WordPress All in One SEO Pack - Full Path Disclosure
- PoC2026-01-08wp-astra-fpd: WordPress Astra - Full Path Disclosure
- PoC2026-01-08wp-better-wp-security-fpd: WordPress Plugin iThemes Security - Full Path Disclosure
- PoC2026-01-08wp-better-wp-security-login-disclosure: WordPress Solid Security < 9.0.1 - Unauthenticated Login Page Disclosure
- PoC2026-01-08wp-contact-form-7-fpd: WordPress Contact Form 7 - Full Path Disclosure
- PoC2026-01-08wp-contact-form-fpd: WordPress Contact Form - Full Path Disclosure
- PoC2026-01-08wp-custom-post-type-ui-fpd: WordPress Custom Post Type UI - Full Path Disclosure
- PoC2026-01-08wp-duracelltomi-google-tag-manager-fpd: WordPress Plugin Google Tag Manager - Full Path Disclosure
- PoC2026-01-08wp-hello-dolly-fpd: WordPress Plugin Hello Dolly - Full Path Disclosure
- PoC2026-01-08wp-intuitive-custom-post-order-fpd: WordPress Plugin Intuitive Custom Post Order - Full Path Disclosure
- PoC2026-01-08wp-megamenu-fpd: WordPress Plugin Max Mega Menu (megamenu) - Full Path Disclosure
- PoC2026-01-08wp-newsletter-fpd: WordPress Plugin Newsletter - Full Path Disclosure
- PoC2026-01-08wp-pagenavi-fpd: WordPress WP-PageNavi - Full Path Disclosure
- PoC2026-01-08wp-responsive-fpd: WordPress Coming Soon Page - Full Path Disclosure
- PoC2026-01-08wp-simple-custom-css-fpd: WordPress Simple Custom CSS Plugin - Full Path Disclosure
- PoC2026-01-08wp-ssl-insecure-content-fixer-fpd: WordPress Plugin SSL Insecure Content Fixer - Full Path Disclosure
- PoC2026-01-08wp-super-cache-fpd: WordPress WP Super Cache - Full Path Disclosure
- PoC2026-01-08wp-worker-fpd: WordPress ManageWP Worker - Full Path Disclosure
- 2026-01-05WordPress Plugin Alone Theme /wp-admin/admin-ajax.php beplus_import_pack_install_plugin 文件上传漏洞（CVE-2025-5394）
- 2026-01-05WordPress Time Clock 插件 /wp-admin/admin-ajax.php 代码执行漏洞 （CVE-2024-9593）
- 2026-01-05WordPress Ditty /wp-json/dittyeditor/v1/displayItems 服务器端请求伪造漏洞
- 2026-01-05WordPress Plugin Alone Theme /wp-admin/admin-ajax.php beplus_import_pack_install_plugin 文件上传漏洞（CVE-2025-5394）
- 2026-01-05WordPress Time Clock 插件 /wp-admin/admin-ajax.php 代码执行漏洞 （CVE-2024-9593）
- 2026-01-05WordPress Ditty /wp-json/dittyeditor/v1/displayItems 服务器端请求伪造漏洞
- 2025-12-19WordPress AI Engine /wp-json/mcp/v1 信息泄露漏洞（CVE-2025-11749）
- 2025-12-19WordPress wp-event-solution 插件 /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2025-47445）
- 2025-12-19WordPress AI Engine /wp-json/mcp/v1 信息泄露漏洞（CVE-2025-11749）
- 2025-12-19WordPress wp-event-solution 插件 /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2025-47445）
- PoC2025-12-12CVE-2019-17671: WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts
- PoC2025-12-12CVE-2024-39646: WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS
- PoC2025-12-12CVE-2024-6220: WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload
- PoC2025-12-12CVE-2025-47445: WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download
- PoC2025-12-12wp-easy-google-fonts-log-disclosure: WordPress Easy Google Fonts - Error Log Disclosure
- PoC2025-12-12wp-importer-log-disclosure: WordPress Importer - Error Log Disclosure
- PoC2025-12-12wp-buddypress-open-redirect: WordPress BuddyPress < 2.9.2 - Authenticated Open Redirect
- PoC2025-12-02CVE-2019-25213: WordPress Advanced Access Manager - Path Traversal
- PoC2025-12-02CVE-2021-36888: WordPress Image Hover Ultimate - Unauthenticated Settings Update
- PoC2025-12-02CVE-2022-33198: WordPress Accordions - Unauthenticated Settings Update
- PoC2025-12-02CVE-2023-5815: News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion
- PoC2025-12-02wp-twenty-theme-fpd: WordPress Twenty Seventeen - Full Path Disclosure
- PoC2025-12-02wp-twentysixteen-fpd: WordPress Twenty Sixteen - Full Path Disclosure
- PoC2025-11-21CVE-2017-14725: WordPress < 4.8.2 - Authenticated Open Redirect
- PoC2025-11-21CVE-2017-17092: WordPress < 4.9.1 - Authenticated JavaScript File Upload
- PoC2025-11-21wp-security-hidden-login-exposure: WordPress All-in-One Security <=4.4.1 - Hidden Login Page Exposure
- 2025-11-18WordPress Kognetiks Chatbot for WordPress <= 2.0.0 任意文件上传漏洞
- 2025-11-18WordPress Verbalize WP 存在任意文件上传漏洞（CVE-2024-49668）
- PoC2025-11-14CVE-2021-4374: WordPress Automatic Plugin - Unauthenticated Options Change
- PoC2025-11-14CVE-2025-11749: WordPress AI Engine Plugin - Token Exposure
- 2025-11-14WordPress WooCommerce Designer Pro 插件 /wp-admin/admin-ajax.php wcdp_save_canvas_design_ajax 文件上传漏洞（CVE-2025-6440）
- 2025-11-14WordPress WooCommerce Designer Pro 插件 /wp-admin/admin-ajax.php wcdp_save_canvas_design_ajax 文件上传漏洞（CVE-2025-6440）
- PoC2025-11-11CVE-2025-4302: Stop User Enumeration WordPress plugin - Authentication Bypass
- 2025-11-07WordPress Google for WooCommerce /wp-content/plugins/google-listings-and-ads/vendor/googleads/google-ads-php/scripts/print_php_information.php 信息泄露漏洞（CVE-2024-10486）
- 2025-11-07WordPress Events Manager /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2025-6970）
- 2025-11-07WordPress Google for WooCommerce /wp-content/plugins/google-listings-and-ads/vendor/googleads/google-ads-php/scripts/print_php_information.php 信息泄露漏洞（CVE-2024-10486）
- 2025-11-07WordPress Events Manager /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2025-6970）
- 2025-10-17wordpress /wp-json/wp/v2/users 信息泄露漏洞
- 2025-10-17（CVE-2015-10139）WPLMS WordPress主题权限提升漏洞
- 2025-10-17wordpress /wp-json/wp/v2/users 信息泄露漏洞
- 2025-10-14WordPress plugin WP JobHunt 跨站脚本漏洞
- 2025-10-09（CVE-2025-8085）Ditty WordPress插件displayItems端点未授权访问漏洞
- 2025-09-26WordPress Featured Image from URL plugin信息泄露漏洞（CVE-2025-9985）
- 2025-09-19Wordpress Plugin Depicter /wp-admin/admin-ajax.php depicter-lead-list SQL 注入漏洞（CVE-2025-2011）
- 2025-09-19Wordpress Plugin Eventin /wp-admin/admin-ajax.php proxy_image 文件读取漏洞（CVE-2025-3419）
- 2025-09-19Wordpress Plugin Ultimate Auction Pro /wp-admin/admin-ajax.php uwa_see_more_bids_ajax SQL 注入漏洞 （CVE-2025-4204）
- 2025-09-19Wordpress WooCommerce Ultimate Gift Card /wp-admin/admin-ajax.php mwb_wgm_preview_mail 文件上传漏洞（CVE-2024-8425）
- 2025-09-19Wordpress Plugin Depicter /wp-admin/admin-ajax.php depicter-lead-list SQL 注入漏洞（CVE-2025-2011）
- 2025-09-19Wordpress Plugin Eventin /wp-admin/admin-ajax.php proxy_image 文件读取漏洞（CVE-2025-3419）
- 2025-09-19Wordpress Plugin Ultimate Auction Pro /wp-admin/admin-ajax.php uwa_see_more_bids_ajax SQL 注入漏洞 （CVE-2025-4204）
- 2025-09-19Wordpress WooCommerce Ultimate Gift Card /wp-admin/admin-ajax.php mwb_wgm_preview_mail 文件上传漏洞（CVE-2024-8425）
- 2025-09-11WordPress Ditty 存在 SSRF 漏洞（CVE-2025-8085）
- 2025-09-02WordPress plugin Events Addon for Elementor 跨站脚本漏洞
- 2025-09-02WordPress plugin Related Posts Lite 跨站请求伪造漏洞
- 2025-09-02WordPress plugin TablePress 跨站脚本漏洞
- 2025-09-02WordPress plugin Ocean Extra 跨站脚本漏洞
- 2025-09-01CVE-2019-19985: WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download
- 2025-09-01wordpress-ext-adaptive-images-lfi: Wordpress Ext Adaptive Images lfi
- 2025-09-01wordpress-ext-mailpress-rce: Wordpress Ext Mailpress RCE
- 2025-09-01wordpress-install: WordPress Exposed Installation
- 2025-09-01wordpress-wpconfig-inclosure: Wordpress wpconfig disclosure
- 2025-08-29WordPress plugin Xagio SEO 信息泄露漏洞
- 2025-08-25WordPress Ajar in5 Embed 插件 /wp-admin/admin-ajax.php in5 文件上传漏洞（CVE-2024-50473）
- 2025-08-25WordPress Ajar in5 Embed 插件 /wp-admin/admin-ajax.php in5 文件上传漏洞（CVE-2024-50473）
- 2025-08-22WordPress JS Help Desk /wp-admin/admin.php 代码执行漏洞（CVE-2024-7094）
- 2025-08-22WordPress InstaWP Connect 插件 / rest_route 文件上传漏洞（CVE-2024-2667）
- 2025-08-22WordPress JS Help Desk /wp-admin/admin.php 代码执行漏洞（CVE-2024-7094）
- 2025-08-22WordPress InstaWP Connect 插件 / rest_route 文件上传漏洞（CVE-2024-2667）
- 2025-08-21WordPress Business Directory 插件 /business-directory SQL 注入漏洞（CVE-2024-4443）
- 2025-08-21WordPress Automatic 插件 /wp-content/plugins/wp-automatic/inc/csv.php SQL 注入漏洞（CVE-2024-27956）
- 2025-08-21WordPress Plugin email-subscribers /wp-admin/admin-post.php advanced_filter SQL 注入漏洞（CVE-2024-2876）
- 2025-08-21WordPress Ninja Tables Plugin /wp-admin/admin-ajax.php url 文件读取漏洞
- 2025-08-21WordPress的Ninja Tables插件（版本<4.1.9）存在未经验证的任意文件下载漏洞
- 2025-08-21WordPress Events Manager <= 7.0.3 SQL注入漏洞(CVE-2025-6970)
- 2025-08-21WordPress Business Directory 插件 /business-directory SQL 注入漏洞（CVE-2024-4443）
- 2025-08-21WordPress Automatic 插件 /wp-content/plugins/wp-automatic/inc/csv.php SQL 注入漏洞（CVE-2024-27956）
- 2025-08-21WordPress Plugin email-subscribers /wp-admin/admin-post.php advanced_filter SQL 注入漏洞（CVE-2024-2876）
- 2025-08-21WordPress Ninja Tables Plugin /wp-admin/admin-ajax.php url 文件读取漏洞
- 2025-08-08WordPress CZ Loan Management <= 1.1 /wp-admin/admin-ajax.php SQL 注入漏洞 （CVE-2024-5975）
- 2025-08-08WordPress TrueBooker WordPress插件 /wp-content/plugins/truebooker-appointment-booking/main/truebooker-service-price.php SQL 注入漏洞 （CVE-2024-6924）
- 2025-08-08WordPress Web Directory Free < 1.7.0 /wp-admin/admin-ajax.php SQL 注入漏洞 （CVE-2024-3552）
- 2025-08-08WordPress Plugin NotificationX /wp-json/notificationx/v1/analytics SQL 注入漏洞 （CVE-2024-1698）
- 2025-08-08WordPress LayerSlider 插件 /wp-admin/admin-ajax.php id SQL 注入漏洞（CVE-2024-2879）
- 2025-08-08WordPress Verbalize 插件 /wp-admin/admin-ajax.php generate_code 文件上传漏洞（CVE-2024-49668）
- 2025-08-08WordPress CZ Loan Management <= 1.1 /wp-admin/admin-ajax.php SQL 注入漏洞 （CVE-2024-5975）
- 2025-08-08WordPress TrueBooker WordPress插件 /wp-content/plugins/truebooker-appointment-booking/main/truebooker-service-price.php SQL 注入漏洞 （CVE-2024-6924）
- 2025-08-08WordPress Web Directory Free < 1.7.0 /wp-admin/admin-ajax.php SQL 注入漏洞 （CVE-2024-3552）
- 2025-08-08WordPress Plugin NotificationX /wp-json/notificationx/v1/analytics SQL 注入漏洞 （CVE-2024-1698）
- 2025-08-08WordPress LayerSlider 插件 /wp-admin/admin-ajax.php id SQL 注入漏洞（CVE-2024-2879）
- 2025-08-08WordPress Verbalize 插件 /wp-admin/admin-ajax.php generate_code 文件上传漏洞（CVE-2024-49668）
- PoC2025-08-01CVE-2022-29455-headless: WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting
- PoC2025-08-01CVE-2008-1059: WordPress Sniplets 1.1.2 - Local File Inclusion
- PoC2025-08-01CVE-2008-1061: WordPress Sniplets <=1.2.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2011-5106: WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2011-5265: Featurific For WordPress 1.6.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2012-1835: WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2012-4242: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2012-4768: WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2012-5913: WordPress Integrator 1.32 - Cross-Site Scripting
- PoC2025-08-01CVE-2012-6499: WordPress Plugin Age Verification v0.4 - Open Redirect
- PoC2025-08-01CVE-2013-2287: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2013-3526: WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting
- PoC2025-08-01CVE-2013-4117: WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2013-4625: WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2013-6281: WordPress Spreadsheet - Cross-Site Scripting
- PoC2025-08-01CVE-2013-7240: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal
- PoC2025-08-01CVE-2014-4940: WordPress Plugin Tera Charts - Local File Inclusion
- PoC2025-08-01CVE-2014-4942: WordPress EasyCart <2.0.6 - Information Disclosure
- PoC2025-08-01CVE-2014-5368: WordPress Plugin WP Content Source Control - Directory Traversal
- PoC2025-08-01CVE-2014-8799: WordPress Plugin DukaPress 2.5.2 - Directory Traversal
- PoC2025-08-01CVE-2014-9094: WordPress DZS-VideoGallery Plugin Cross-Site Scripting
- PoC2025-08-01CVE-2014-9119: WordPress DB Backup <=4.5 - Local File Inclusion
- PoC2025-08-01CVE-2014-9735: WordPress RevSlider - Remote Code Execution via File Upload
- PoC2025-08-01CVE-2015-1000005: WordPress Candidate Application Form <= 1.3 - Local File Inclusion
- PoC2025-08-01CVE-2015-1000010: WordPress Simple Image Manipulator < 1.0 - Local File Inclusion
- PoC2025-08-01CVE-2015-1000012: WordPress MyPixs <=0.3 - Local File Inclusion
- PoC2025-08-01CVE-2015-1579: WordPress Slider Revolution - Local File Disclosure
- PoC2025-08-01CVE-2015-2196: WordPress Spider Calendar <=1.4.9 - SQL Injection
- PoC2025-08-01CVE-2015-2755: WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting
- PoC2025-08-01CVE-2015-4062: WordPress NewStatPress 0.9.8 - SQL Injection
- PoC2025-08-01CVE-2015-4127: WordPress Church Admin <0.810 - Cross-Site Scripting
- PoC2025-08-01CVE-2015-4414: WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal
- PoC2025-08-01CVE-2015-4455: WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload
- PoC2025-08-01CVE-2015-4694: WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval
- PoC2025-08-01CVE-2015-5461: WordPress StageShow <5.0.9 - Open Redirect
- PoC2025-08-01CVE-2015-5469: WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion
- PoC2025-08-01CVE-2015-6920: WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2015-7377: WordPress Pie-Register <2.0.19 - Cross-Site Scripting
- PoC2025-08-01CVE-2015-9414: WordPress Symposium <=15.8.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2015-9480: WordPress RobotCPA 5 - Directory Traversal
- PoC2025-08-01CVE-2015-9499: WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE
- PoC2025-08-01CVE-2016-1000126: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000127: WordPress AJAX Random Post <=2.00 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000128: WordPress anti-plagiarism <=3.60 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000129: WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000130: WordPress e-search <=1.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000131: WordPress e-search <=1.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000132: WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000133: WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000134: WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000135: WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000136: WordPress heat-trackr 1.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000137: WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000138: WordPress Admin Font Editor <=1.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000139: WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000140: WordPress New Year Firework <=1.1.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000141: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000142: WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000143: WordPress Photoxhibit 2.1.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000146: WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000148: WordPress S3 Video <=0.983 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000149: WordPress Simpel Reserveren <=3.5.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000152: WordPress Tidio-form <=1.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000153: WordPress Tidio Gallery <=1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000154: WordPress WHIZZ <=1.0.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-1000155: WordPress WPSOLR <=8.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-10033: WordPress PHPMailer < 5.2.18 - Remote Code Execution
- PoC2025-08-01CVE-2016-10924: Wordpress Zedna eBook download <1.2 - Local File Inclusion
- PoC2025-08-01CVE-2016-10940: WordPress zm-gallery plugin 1.0 SQL Injection
- PoC2025-08-01CVE-2016-10956: WordPress Mail Masta 1.0 - Local File Inclusion
- PoC2025-08-01CVE-2016-10960: WordPress wSecure Lite < 2.4 - Remote Code Execution
- PoC2025-08-01CVE-2016-10973: Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2016-15042: WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload
- PoC2025-08-01CVE-2017-1000170: WordPress Delightful Downloads Jquery File Tree 2.1.5 - Local File Inclusion
- PoC2025-08-01CVE-2017-14622: WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2017-17043: WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2017-17059: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2017-17451: WordPress Mailster <=1.5.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2017-18536: WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2017-18598: WordPress Qards - Cross-Site Scripting
- PoC2025-08-01CVE-2017-9288: WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-11709: WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-16159: WordPress Gift Voucher <4.1.8 - Blind SQL Injection
- PoC2025-08-01CVE-2018-16283: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
- PoC2025-08-01CVE-2018-16299: WordPress Localize My Post 1.0 - Local File Inclusion
- PoC2025-08-01CVE-2018-18069: WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-19287: WordPress Ninja Forms <3.3.18 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-20462: WordPress JSmol2WP <=1.07 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-20463: WordPress JSmol2WP <=1.07 - Local File Inclusion
- PoC2025-08-01CVE-2018-20985: WordPress Payeezy Pay <=2.97 - Local File Inclusion
- PoC2025-08-01CVE-2018-3810: Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass
- PoC2025-08-01CVE-2018-5316: WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2018-7422: WordPress Site Editor <=1.1.1 - Local File Inclusion
- PoC2025-08-01CVE-2018-8719: WordPress WP Security Audit Log 3.1.1 - Information Disclosure
- PoC2025-08-01CVE-2018-9118: WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion
- PoC2025-08-01CVE-2019-10692: WordPress Google Maps <7.11.18 - SQL Injection
- PoC2025-08-01CVE-2019-11869: WordPress Yuzo <5.12.94 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-14205: WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion
- PoC2025-08-01CVE-2019-14470: WordPress UserPro 4.9.32 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-15713: WordPress My Calendar <= 3.1.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-15858: WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution
- PoC2025-08-01CVE-2019-15889: WordPress Download Manager <2.9.94 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-16332: WordPress API Bearer Auth <20190907 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-16525: WordPress Checklist <1.1.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-16931: WordPress Visualizer <3.3.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-19134: WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-19985: WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval
- PoC2025-08-01CVE-2019-20141: WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-20210: WordPress CTHthemes - Cross-Site Scripting
- PoC2025-08-01CVE-2019-6112: WordPress Sell Media 2.4.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2019-8943: WordPress Core 5.0.0 - Crop-image Shell Upload
- PoC2025-08-01CVE-2019-9618: WordPress GraceMedia Media Player 1.0 - Local File Inclusion
- PoC2025-08-01CVE-2019-9978: WordPress Social Warfare <3.5.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-11530: WordPress Chop Slider 3 - Blind SQL Injection
- PoC2025-08-01CVE-2020-11738: WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion
- PoC2025-08-01CVE-2020-11930: WordPress GTranslate <2.8.52 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-12054: WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-12800: WordPress Contact Form 7 <1.3.3.3 - Remote Code Execution
- PoC2025-08-01CVE-2020-13700: WordPress acf-to-rest-api <=3.1.0 - Insecure Direct Object Reference
- PoC2025-08-01CVE-2020-14092: WordPress PayPal Pro <1.1.65 - SQL Injection
- PoC2025-08-01CVE-2020-24186: WordPress wpDiscuz <=7.0.4 - Remote Code Execution
- PoC2025-08-01CVE-2020-24312: WordPress Plugin File Manager (wp-file-manager) Backup Disclosure
- PoC2025-08-01CVE-2020-25213: WordPress File Manager Plugin - Remote Code Execution
- PoC2025-08-01CVE-2020-26876: WordPress WP Courses Plugin Information Disclosure
- PoC2025-08-01CVE-2020-28976: WordPress Canto 1.3.0 - Blind Server-Side Request Forgery
- PoC2025-08-01CVE-2020-29395: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-35749: WordPress Simple Job Board <2.9.4 - Local File Inclusion
- PoC2025-08-01CVE-2020-35951: Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion
- PoC2025-08-01CVE-2020-36510: WordPress 15Zine <3.3.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-36708: WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution
- PoC2025-08-01CVE-2020-36728: WordPress Plugin Adning Advertising < 1.5.6 - Arbitrary File Upload
- PoC2025-08-01CVE-2020-36836: WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion
- PoC2025-08-01CVE-2020-7107: WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting
- PoC2025-08-01CVE-2020-8615: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery
- PoC2025-08-01CVE-2020-8771: WordPress Time Capsule < 1.21.16 - Authentication Bypass
- PoC2025-08-01CVE-2020-8772: WordPress InfiniteWP <1.9.4.5 - Authorization Bypass
- PoC2025-08-01CVE-2020-9043: WordPress wpCentral <1.5.1 - Information Disclosure
- PoC2025-08-01CVE-2021-20792: WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24145: WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload
- PoC2025-08-01CVE-2021-24146: WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure
- PoC2025-08-01CVE-2021-24150: WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery
- PoC2025-08-01CVE-2021-24155: WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload
- PoC2025-08-01CVE-2021-24165: WordPress Ninja Forms <3.4.34 - Open Redirect
- PoC2025-08-01CVE-2021-24169: WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2021-24176: WordPress JH 404 Logger <=1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24210: WordPress PhastPress <1.111 - Open Redirect
- PoC2025-08-01CVE-2021-24214: WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24215: Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation
- PoC2025-08-01CVE-2021-24227: Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion
- PoC2025-08-01CVE-2021-24235: WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24236: WordPress Imagements <=1.2.5 - Arbitrary File Upload
- PoC2025-08-01CVE-2021-24237: WordPress Realteo <=1.2.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24239: WordPress Pie Register <3.7.0.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24245: WordPress Stop Spammers <2021.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24274: WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24276: WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24278: WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation
- PoC2025-08-01CVE-2021-24284: WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload
- PoC2025-08-01CVE-2021-24285: WordPress Car Seller - Auto Classifieds Script - SQL Injection
- PoC2025-08-01CVE-2021-24286: WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24287: WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24288: WordPress AcyMailing <7.5.0 - Open Redirect
- PoC2025-08-01CVE-2021-24291: WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24298: WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24300: WordPress WooCommerce <1.13.22 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24316: WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24320: WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24335: WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24340: WordPress Statistics <13.0.8 - Blind SQL Injection
- PoC2025-08-01CVE-2021-24342: WordPress JNews Theme <8.0.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24347: WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload
- PoC2025-08-01CVE-2021-24351: WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24364: WordPress Jannah Theme <5.4.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24370: WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload
- PoC2025-08-01CVE-2021-24387: WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24389: WordPress FoodBakery <2.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24406: WordPress wpForo Forum < 1.9.7 - Open Redirect
- PoC2025-08-01CVE-2021-24407: WordPress Jannah Theme <5.4.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24435: WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24436: WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24442: Wordpress Polls Widget < 1.5.3 - SQL Injection
- PoC2025-08-01CVE-2021-24452: WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24488: WordPress Post Grid <2.1.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24495: Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24498: WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24499: WordPress Workreap - Remote Code Execution
- PoC2025-08-01CVE-2021-24510: WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24554: WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection
- PoC2025-08-01CVE-2021-24666: WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection
- PoC2025-08-01CVE-2021-24746: WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24750: WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection
- PoC2025-08-01CVE-2021-24762: WordPress Perfect Survey <1.5.2 - SQL Injection
- PoC2025-08-01CVE-2021-24827: WordPress Asgaros Forum <1.15.13 - SQL Injection
- PoC2025-08-01CVE-2021-24838: WordPress AnyComment <0.3.5 - Open Redirect
- PoC2025-08-01CVE-2021-24862: WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection
- PoC2025-08-01CVE-2021-24875: WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24891: WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24910: WordPress Transposh Translation <1.0.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24917: WordPress WPS Hide Login <1.9.1 - Information Disclosure
- PoC2025-08-01CVE-2021-24926: WordPress Domain Check <1.0.17 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24931: WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
- PoC2025-08-01CVE-2021-24940: WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24946: WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
- PoC2025-08-01CVE-2021-24947: WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read
- PoC2025-08-01CVE-2021-24970: WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion
- PoC2025-08-01CVE-2021-24987: WordPress Super Socializer <7.13.30 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24991: WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-24997: WordPress Guppy <=1.1 - Information Disclosure
- PoC2025-08-01CVE-2021-25003: WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution
- PoC2025-08-01CVE-2021-25008: The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25028: WordPress Event Tickets < 5.2.2 - Open Redirect
- PoC2025-08-01CVE-2021-25052: WordPress Button Generator <2.3.3 - Remote File Inclusion
- PoC2025-08-01CVE-2021-25055: WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2021-25063: WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25074: WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect
- PoC2025-08-01CVE-2021-25075: WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25085: WOOF WordPress plugin - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25094: Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution
- PoC2025-08-01CVE-2021-25099: WordPress GiveWP <2.17.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25104: WordPress Ocean Extra <1.9.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25111: WordPress English Admin <1.5.2 - Open Redirect
- PoC2025-08-01CVE-2021-25112: WordPress WHMCS Bridge <6.4b - Cross-Site Scripting
- PoC2025-08-01CVE-2021-25114: WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection
- PoC2025-08-01CVE-2021-33851: WordPress Customize Login Image <3.5.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-34621: WordPress ProfilePress 3.0.0-3.1.3 - Admin User Creation Weakness
- PoC2025-08-01CVE-2021-34640: WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-34643: WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-36873: WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-38314: WordPress Redux Framework <=4.2.11 - Information Disclosure
- PoC2025-08-01CVE-2021-39312: WordPress True Ranker <2.2.4 - Local File Inclusion
- PoC2025-08-01CVE-2021-39316: WordPress DZS Zoomsounds <=6.50 - Local File Inclusion
- PoC2025-08-01CVE-2021-39320: WordPress Under Construction <1.19 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-39322: WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2021-39327: WordPress BulletProof Security 5.1 Information Disclosure
- PoC2025-08-01CVE-2021-39350: FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2022-0140: WordPress Visual Form Builder <3.0.8 - Information Disclosure
- PoC2025-08-01CVE-2022-0147: WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0148: WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0149: WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0150: WordPress Accessibility Helper <0.6.0.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0165: WordPress Page Builder KingComposer <=2.9.6 - Open Redirect
- PoC2025-08-01CVE-2022-0189: WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2022-0201: WordPress Permalink Manager <2.2.15 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0206: WordPress NewStatPress <1.3.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0208: WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0212: WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0220: WordPress GDPR & CCPA <1.9.27 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0234: WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0288: WordPress Ad Inserter <2.7.10 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0346: WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution
- PoC2025-08-01CVE-2022-0349: WordPress NotificationX <2.3.9 - SQL Injection
- PoC2025-08-01CVE-2022-0381: WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0412: WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection
- PoC2025-08-01CVE-2022-0422: WordPress White Label CMS <2.2.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0434: WordPress Page Views Count <2.4.15 - SQL Injection
- PoC2025-08-01CVE-2022-0535: WordPress E2Pdf <1.16.45 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0594: WordPress Shareaholic <9.7.6 - Information Disclosure
- PoC2025-08-01CVE-2022-0595: WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
- PoC2025-08-01CVE-2022-0599: WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-0651: WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
- PoC2025-08-01CVE-2022-0653: Wordpress Profile Builder Plugin Cross-Site Scripting
- PoC2025-08-01CVE-2022-0679: WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion
- PoC2025-08-01CVE-2022-0693: WordPress Master Elements <=8.0 - SQL Injection
- PoC2025-08-01CVE-2022-0760: WordPress Simple Link Directory <7.7.2 - SQL injection
- PoC2025-08-01CVE-2022-0781: WordPress Nirweb Support <2.8.2 - SQL Injection
- PoC2025-08-01CVE-2022-0784: WordPress Title Experiments Free <9.0.1 - SQL Injection
- PoC2025-08-01CVE-2022-0785: WordPress Daily Prayer Time <2022.03.01 - SQL Injection
- PoC2025-08-01CVE-2022-0786: WordPress KiviCare <2.3.9 - SQL Injection
- PoC2025-08-01CVE-2022-0788: WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection
- PoC2025-08-01CVE-2022-0817: WordPress BadgeOS <=3.7.0 - SQL Injection
- PoC2025-08-01CVE-2022-0826: WordPress WP Video Gallery <=1.7.1 - SQL Injection
- PoC2025-08-01CVE-2022-0827: WordPress Best Books <=2.6.3 - SQL Injection
- PoC2025-08-01CVE-2022-0867: WordPress ARPrice <3.6.1 - SQL Injection
- PoC2025-08-01CVE-2022-0948: WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
- PoC2025-08-01CVE-2022-0949: WordPress Stop Bad Bots <6.930 - SQL Injection
- PoC2025-08-01CVE-2022-0952: WordPress Sitemap by click5 <1.0.36 - Missing Authorization
- PoC2025-08-01CVE-2022-1007: WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1013: WordPress Personal Dictionary <1.3.4 - Blind SQL Injection
- PoC2025-08-01CVE-2022-1020: WordPress WooCommerce <3.1.2 - Arbitrary Function Call
- PoC2025-08-01CVE-2022-1054: WordPress RSVP and Event Management <2.7.8 - Missing Authorization
- PoC2025-08-01CVE-2022-1119: WordPress Simple File List <3.2.8 - Local File Inclusion
- PoC2025-08-01CVE-2022-1168: WordPress WP JobSearch <1.5.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1221: WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1386: WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery
- PoC2025-08-01CVE-2022-1390: WordPress Admin Word Count Column 2.2 - Local File Inclusion
- PoC2025-08-01CVE-2022-1391: WordPress Cab fare calculator < 1.0.4 - Local File Inclusion
- PoC2025-08-01CVE-2022-1392: WordPress Videos sync PDF <=1.7.4 - Local File Inclusion
- PoC2025-08-01CVE-2022-1442: WordPress Metform <=2.1.3 - Information Disclosure
- PoC2025-08-01CVE-2022-1574: WordPress HTML2WP <=1.0.0 - Arbitrary File Upload
- PoC2025-08-01CVE-2022-1595: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
- PoC2025-08-01CVE-2022-1597: WordPress WPQA <5.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1598: WordPress WPQA <5.5 - Improper Access Control
- PoC2025-08-01CVE-2022-1724: WordPress Simple Membership <4.1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1768: WordPress RSVPMaker <=9.3.2 - SQL Injection
- PoC2025-08-01CVE-2022-1904: WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1906: WordPress Copyright Proof <=4.16 - Cross-Site-Scripting
- PoC2025-08-01CVE-2022-1910: WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1916: WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1933: WordPress CDI <5.1.9 - Cross Site Scripting
- PoC2025-08-01CVE-2022-1937: WordPress Awin Data Feed <=1.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1946: WordPress Gallery <2.0.0 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-1952: WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload
- PoC2025-08-01CVE-2022-2034: WordPress Sensei LMS <4.5.0 - Information Disclosure
- PoC2025-08-01CVE-2022-21661: WordPress <5.8.3 - SQL Injection
- PoC2025-08-01CVE-2022-2168: WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2022-2187: WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-2314: WordPress VR Calendar <=2.3.2 - Remote Code Execution
- PoC2025-08-01CVE-2022-2373: WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure
- PoC2025-08-01CVE-2022-2376: WordPress Directorist <7.3.1 - Information Disclosure
- PoC2025-08-01CVE-2022-2379: WordPress Easy Student Results <=2.2.8 - Improper Authorization
- PoC2025-08-01CVE-2022-2383: WordPress Feed Them Social <3.0.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-2462: WordPress Transposh <=1.0.8.1 - Information Disclosure
- PoC2025-08-01CVE-2022-25148: WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
- PoC2025-08-01CVE-2022-2544: WordPress Ninja Job Board < 1.3.3 - Direct Request
- PoC2025-08-01CVE-2022-2546: WordPress All-in-One WP Migration <=7.62 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-2551: WordPress Duplicator <1.4.7 - Authentication Bypass
- PoC2025-08-01CVE-2022-2599: WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-2627: WordPress Newspaper < 12 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-27849: WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability
- PoC2025-08-01CVE-2022-28290: WordPress Country Selector <1.6.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-2863: WordPress WPvivid Backup <0.9.76 - Local File Inclusion
- PoC2025-08-01CVE-2022-29455: WordPress Elementor Website Builder <= 3.5.5 - DOM Cross-Site Scripting
- PoC2025-08-01CVE-2022-33901: WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read
- PoC2025-08-01CVE-2022-33965: WordPress Visitor Statistics <=5.7 - SQL Injection
- PoC2025-08-01CVE-2022-3484: WordPress WPB Show Core - Cross-Site Scripting
- PoC2025-08-01CVE-2022-3506: WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting
- PoC2025-08-01CVE-2022-3578: WordPress ProfileGrid <5.1.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-3768: WordPress WPSmartContracts <1.3.12 - SQL Injection
- PoC2025-08-01CVE-2022-3908: WordPress Helloprint <1.4.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-3933: WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting
- PoC2025-08-01CVE-2022-3934: WordPress FlatPM <3.0.13 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-3982: WordPress Booking Calendar <3.2.2 - Arbitrary File Upload
- PoC2025-08-01CVE-2022-4050: WordPress JoomSport <5.2.8 - SQL Injection
- PoC2025-08-01CVE-2022-4060: WordPress User Post Gallery <=2.19 - Remote Code Execution
- PoC2025-08-01CVE-2022-4063: WordPress InPost Gallery <2.1.4.1 - Local File Inclusion
- PoC2025-08-01CVE-2022-4117: WordPress IWS Geo Form Fields <=1.0 - SQL Injection
- PoC2025-08-01CVE-2022-4140: WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access
- PoC2025-08-01CVE-2022-4260: WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting
- PoC2025-08-01CVE-2022-4301: WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-4306: WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-4320: WordPress Events Calendar <1.4.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-4321: PDF Generator for WordPress < 1.1.2 - Cross Site Scripting
- PoC2025-08-01CVE-2022-4325: WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2022-4447: WordPress Fontsy <=1.8.6 - SQL Injection
- PoC2025-08-01CVE-2022-45362: WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery
- PoC2025-08-01CVE-2022-45805: WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection
- PoC2025-08-01CVE-2022-45835: WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
- PoC2025-08-01CVE-2022-4897: WordPress BackupBuddy <8.8.3 - Cross Site Scripting
- PoC2025-08-01CVE-2023-0236: WordPress Tutor LMS <2.0.10 - Cross Site Scripting
- PoC2025-08-01CVE-2023-0261: WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection
- PoC2025-08-01CVE-2023-0552: WordPress Pie Register <3.8.2.3 - Open Redirect
- PoC2025-08-01CVE-2023-0942: WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-0948: WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-0968: WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-1080: WordPress GN Publisher <1.5.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-1119: WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-2256: WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-23488: WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection
- PoC2025-08-01CVE-2023-23489: WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection
- PoC2025-08-01CVE-2023-2518: WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-2624: KiviCare WordPress Plugin - Cross-Site Scripting
- PoC2025-08-01CVE-2023-2745: WordPress Core <=6.2 - Directory Traversal
- PoC2025-08-01CVE-2023-2813: Wordpress Multiple Themes - Reflected Cross-Site Scripting
- PoC2025-08-01CVE-2023-28662: Wordpress Gift Cards <= 4.3.1 - SQL Injection
- PoC2025-08-01CVE-2023-32243: WordPress Elementor Lite 5.7.1 - Arbitrary Password Reset
- PoC2025-08-01CVE-2023-4151: Store Locator WordPress < 1.4.13 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-4284: WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting
- PoC2025-08-01CVE-2023-4490: WordPress Job Portal < 2.0.6 - SQL Injection
- PoC2025-08-01CVE-2023-4596: WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload
- PoC2025-08-01CVE-2023-48777: WordPress Elementor 3.18.1 - File Upload/Remote Code Execution
- PoC2025-08-01CVE-2023-5360: WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload
- PoC2025-08-01CVE-2023-5561: WordPress Core - Post Author Email Disclosure
- PoC2025-08-01CVE-2023-5974: WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery
- PoC2025-08-01CVE-2023-6360: WordPress My Calendar <3.4.22 - SQL Injection
- PoC2025-08-01CVE-2023-6389: WordPress Toolbar <= 2.2.6 - Open Redirect
- PoC2025-08-01CVE-2023-6421: WordPress Download Manager - File Password Exposure
- PoC2025-08-01CVE-2023-6875: WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass
- PoC2025-08-01CVE-2024-1061: WordPress HTML5 Video Player - SQL Injection
- PoC2025-08-01CVE-2024-1071: WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection
- PoC2025-08-01CVE-2024-10783: WordPress Plugin MainWP Child - Authentication Bypass
- PoC2025-08-01CVE-2024-12824: Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
- PoC2025-08-01CVE-2024-13126: WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure
- PoC2025-08-01CVE-2024-13624: WordPress WPMovieLibrary Plugin <= 2.1.4.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2024-13853: WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting
- PoC2025-08-01CVE-2024-1512: MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection
- PoC2025-08-01CVE-2024-27954: WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF
- PoC2025-08-01CVE-2024-27956: WordPress Automatic Plugin <= 3.92.0 - SQL Injection
- PoC2025-08-01CVE-2024-2876: Wordpress Email Subscribers by Icegram Express - SQL Injection
- PoC2025-08-01CVE-2024-2879: WordPress Plugin LayerSlider 7.9.11-7.10.0 - SQL Injection
- PoC2025-08-01CVE-2024-3032: WordPress Themify Builder < 7.5.8 - Open Redirect
- PoC2025-08-01CVE-2024-3495: Wordpress Country State City Dropdown <=2.7.2 - SQL Injection
- PoC2025-08-01CVE-2024-43917: WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 - SQL Injection
- PoC2025-08-01CVE-2024-4399: WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery
- PoC2025-08-01CVE-2024-4434: LearnPress WordPress LMS Plugin <= 4.2.6.5 - SQL Injection
- PoC2025-08-01CVE-2024-4439: WordPress Core <6.5.2 - Cross-Site Scripting
- PoC2025-08-01CVE-2024-50477: WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass
- PoC2025-08-01CVE-2024-5522: WordPress HTML5 Video Player < 2.5.27 - SQL Injection
- PoC2025-08-01CVE-2024-6460: WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion
- PoC2025-08-01CVE-2024-6651: WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting
- PoC2025-08-01CVE-2024-9047: WordPress File Upload <= 4.24.11 - Arbitrary File Read
- PoC2025-08-01CVE-2024-9796: WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection
- PoC2025-08-01CVE-2025-2010: WordPress JobWP Plugin <= 2.3.9 - SQL Injection
- PoC2025-08-01CVE-2025-30567: WordPress WP01 - Path Traversal
- PoC2025-08-01CVE-2025-34077: WordPress Pie Register <= 3.7.1.4 - Authentication Bypass
- PoC2025-08-01CVE-2025-34085: WordPress Simple File List <=4.2.2 - Remote Code Execution
- PoC2025-08-01CVE-2025-3605: WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
- PoC2025-08-01CVE-2025-49029: WordPress Custom Login And Signup Widget Plugin <= 1.0 - Arbitrary Code Execution
- PoC2025-08-01CVE-2025-5961: WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
- PoC2025-08-01CVE-2025-6851: WordPress Broken Link Notifier < 1.3.1 - Unauthenticated SSRF
- PoC2025-08-01CVE-2025-6970: WordPress Events Manager <= 7.0.3 - SQL Injection
- 2025-08-01CVE-2018-17207: WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution
- PoC2025-08-01CVE-2014-8739: WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload
- PoC2025-08-01CVE-2020-27615: WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter
- PoC2025-08-01CVE-2022-2461: Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change
- PoC2025-08-01CVE-2023-0037: WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection
- PoC2025-08-01CVE-2023-0876: WordPress Meta SEO <= 4.5.2 - Open Redirect
- PoC2025-08-01CVE-2023-6000: WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS
- PoC2025-08-01CVE-2024-2782: WordPress FluentForms <= 5.1.16 - Broken Access Control
- PoC2025-08-01CVE-2024-4898: WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation
- PoC2025-08-01CVE-2021-34624: WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload
- PoC2025-08-01CVE-2023-47873: WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload
- PoC2025-08-01CVE-2019-17230: WordPress OneTone theme <= 3.0.6 – Unauthenticated Options Changes
- PoC2025-08-01CVE-2019-17231: WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS
- PoC2025-08-01CVE-2019-17233: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection
- PoC2025-08-01CVE-2022-3590: WordPress <= 6.2 - Server Side Request Forgery
- PoC2025-08-01CVE-2024-9772: WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution
- PoC2025-08-01CVE-2017-5487: Wordpress<4.7.1 Exist Username Enumeration
- PoC2025-08-01CVE-2020-11738: WordPress Duplicator plugin Directory Traversal
- PoC2025-08-01CVE-2022-0434: WordPress Page Views Count <2.4.15 - SQL Injection
- PoC2025-08-01CVE-2022-1020: WordPress WooCommerce <3.1.2 - Arbitrary Function Call
- PoC2025-08-01CVE-2022-1119: WordPress Simple File List <3.2.8 - Local File Inclusion
- PoC2025-08-01CVE-2022-1390: WordPress Admin Word Count Column 2.2 - Local File Inclusion
- PoC2025-08-01CVE-2022-1950: Wordpress Youzify sql injection
- PoC2025-08-01CVE-2022-21661: WordPress Core 5.8.2 - 'WP_Query' SQL注入信息泄露漏洞
- PoC2025-08-01CVE-2022-3982: WordPress Booking Calendar <3.2.2 - Arbitrary File Upload
- PoC2025-08-01CVE-2024-1061: WordPress HTML5 Video Player SQL注入
- PoC2025-08-01CVE-2024-25600: WordPress的Bricks主题存在远程命令执行
- PoC2025-08-01wordpress-api-csp-bypass: Content-Security-Policy Bypass - WordPress API
- PoC2025-08-01wordpress-csp-bypass: Content-Security-Policy Bypass - WordPress
- PoC2025-08-01wordpress-public-api-csp-bypass: Content-Security-Policy Bypass - WordPress Public API
- PoC2025-08-01CVE-2018-17207: WordPress Duplicator Plugin < 1.2.42 - Arbitrary Code Execution
- PoC2025-08-01CVE-2019-17232: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export
- PoC2025-08-01CVE-2019-6703: Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update
- PoC2025-08-01CVE-2021-34622: WordPress ProfilePress <= 3.1.3 - Privilege Escalation
- PoC2025-08-01CVE-2022-3477: WordPress tagDiv Composer < 3.5 - Authentication Bypass
- PoC2025-08-01CVE-2024-0593: WordPress Simple Job Board - Unauthorized Data Access
- PoC2025-08-01CVE-2024-28000: WordPress LiteSpeed Cache - Unauthenticated Privilege Escalation to Admin
- PoC2025-08-01wordpress-weak-credentials: WordPress - Weak Credentials
- PoC2025-08-01wp-install: WordPress Exposed Installation
- PoC2025-08-01wordpress-takeover: WordPress takeover detection
- PoC2025-08-01avada-xss: WordPress Avada Website Builder <7.4.2 - Cross-Site Scripting
- PoC2025-08-01404-to-301-xss: WordPress 404 to 301 Log Manager <3.1.2 - Cross-Site Scripting
- PoC2025-08-01ad-widget-lfi: WordPress Ad Widget 2.11.0 - Local File Inclusion
- PoC2025-08-01advanced-access-manager-lfi: WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion
- PoC2025-08-01age-gate-open-redirect: WordPress Age Gate <2.13.5 - Open Redirect
- PoC2025-08-01age-gate-xss: WordPress Age Gate <2.20.4 - Cross-Site Scripting
- PoC2025-08-01ait-csv-import-export-rce: WordPress AIT CSV Import Export - Unauthenticated Remote Code Execution
- PoC2025-08-01alfacgiapi-wordpress: alfacgiapi
- PoC2025-08-01amministrazione-aperta-lfi: WordPress Amministrazione Aperta 3.7.3 - Local File Inclusion
- PoC2025-08-01application-pass-xss: WordPress Core 5.6 and 6.3.1 - Cross-Site Scripting
- PoC2025-08-01aspose-ie-file-download: WordPress Aspose Importer & Exporter 1.0 - Local File Inclusion
- PoC2025-08-01aspose-pdf-file-download: WordPress Aspose PDF Exporter - Local File Inclusion
- PoC2025-08-01aspose-words-file-download: WordPress Aspose Words Exporter <2.0 - Local File Inclusion
- PoC2025-08-01attitude-theme-open-redirect: WordPress Attitude 1.1.1 - Open Redirect
- PoC2025-08-01avchat-video-chat-xss: WordPress AVChat Video Chat 1.4.1 - Cross-Site Scripting
- PoC2025-08-01brandfolder-lfi: Wordpress Brandfolder - Remote/Local File Inclusion
- PoC2025-08-01brandfolder-open-redirect: WordPress Brandfolder - Open Redirect (RFI & LFI)
- PoC2025-08-01calameo-publications-xss: WordPress Manage Calameo Publications 1.1.0 - Cross-Site Scripting
- PoC2025-08-01checkout-fields-manager-xss: WordPress Checkout Fields Manager for WooCommerce <5.5.7 - Cross-Site Scripting
- PoC2025-08-01cherry-lfi: WordPress Cherry < 1.2.7 - Unauthenticated Arbitrary File Upload and Download
- PoC2025-08-01church-admin-lfi: WordPress Church Admin 0.33.2.1 - Local File Inclusion
- PoC2025-08-01churchope-lfi: WordPress ChurcHope Theme <= 2.1 - Local File Inclusion
- PoC2025-08-01clearfy-cache-xss: WordPress Clearfy Cache <2.0.5 - Cross-Site Scripting
- PoC2025-08-01contus-video-gallery-sqli: WordPress Video Gallery <= 2.8 - SQL Injection
- PoC2025-08-01curcy-xss: WordPress CURCY - Multi Currency for WooCommerce <2.1.18 - Cross-Site Scripting
- PoC2025-08-01diarise-theme-lfi: WordPress Diarise 1.5.9 - Arbitrary File Retrieval
- PoC2025-08-01eatery-restaurant-open-redirect: WordPress Eatery 2.2 - Open Redirect
- PoC2025-08-01hb-audio-lfi: Wordpress HB Audio Gallery Lite - Local File Inclusion
- PoC2025-08-01health-check-lfi: WordPress Health Check & Troubleshooting <1.24 - Local File Inclusion
- PoC2025-08-01hide-security-enhancer-lfi: WordPress Hide Security Enhancer 1.3.9.2 Local File Inclusion
- PoC2025-08-01members-list-xss: WordPress Members List <4.3.7 - Cross-Site Scripting
- PoC2025-08-01modula-image-gallery-xss: WordPress Modula Image Gallery <2.6.7 - Cross-Site Scripting
- PoC2025-08-01music-store-open-redirect: WordPress eCommerce Music Store <=1.0.14 - Open Redirect
- PoC2025-08-01my-chatbot-xss: WordPress My Chatbot <= 1.1 - Cross-Site Scripting
- PoC2025-08-01nativechurch-wp-theme-lfd: WordPress NativeChurch Theme - Local File Inclusion
- PoC2025-08-01new-user-approve-xss: WordPress New User Approve <2.4.1 - Cross-Site Scripting
- PoC2025-08-01newsletter-open-redirect: WordPress Newsletter Manager < 1.5 - Unauthenticated Open Redirect
- PoC2025-08-01pieregister-open-redirect: WordPress Pie Register < 3.7.2.4 - Open Redirect
- PoC2025-08-01seatreg-redirect: WordPress Plugin ‘SeatReg’ - Open Redirect
- PoC2025-08-01seo-redirection-xss: WordPress SEO Redirection <7.4 - Cross-Site Scripting
- PoC2025-08-01shortcode-lfi: WordPress Download Shortcode 0.2.3 - Local File Inclusion
- PoC2025-08-01ultimatemember-open-redirect: WordPress Ultimate Member <2.1.7 - Open Redirect
- PoC2025-08-01unauthenticated-duplicator-disclosure: WordPress Duplicator Plugin - Information disclosure
- PoC2025-08-01w3c-total-cache-ssrf: Wordpress W3C Total Cache <= 0.9.4 - Server Side Request Forgery (SSRF)
- PoC2025-08-01weekender-newspaper-open-redirect: WordPress Weekender Newspaper 9.0 - Open Redirect
- PoC2025-08-01woocommerce-pdf-invoices-xss: WordPress WooCommerce PDF Invoices & Packing Slips <2.15.0 - Cross-Site Scripting
- PoC2025-08-01wordpress-accessible-wpconfig: WordPress wp-config Detection
- PoC2025-08-01wordpress-affiliatewp-log: WordPress Plugin "AffiliateWP -- Allowed Products" Log Disclosure
- PoC2025-08-01wordpress-db-backup-listing: WordPress DB Backup
- PoC2025-08-01wordpress-db-backup: WordPress DB Backup
- PoC2025-08-01wordpress-debug-log: WordPress Debug Log - Exposure
- PoC2025-08-01wordpress-social-metrics-tracker: Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export
- PoC2025-08-01wordpress-ssrf-oembed: Wordpress Oembed Proxy - Server-side request forgery
- PoC2025-08-01wordpress-total-upkeep-backup-download: WordPress Total Upkeep Database and Files Backup Download
- PoC2025-08-01wordpress-wordfence-lfi: WordPress Wordfence 7.4.5 - Local File Inclusion
- PoC2025-08-01wordpress-wordfence-waf-bypass-xss: Wordpress Wordfence - Cross-Site Scripting
- PoC2025-08-01wordpress-wordfence-xss: WordPress Wordfence 7.4.6 - Cross0Site Scripting
- PoC2025-08-01wordpress-zebra-form-xss: Zebra_Form PHP Library <= 2.9.8 - Cross-Site Scripting
- PoC2025-08-01wp-adaptive-xss: WordPress Adaptive Images < 0.6.69 - Cross-Site Scripting
- PoC2025-08-01wp-adivaha-sqli: WordPress adivaha Travel Plugin 2.3 - SQL Injection
- PoC2025-08-01wp-adivaha-xss: WordPress Adivaha Travel Plugin 2.3 - Cross-Site Scripting
- PoC2025-08-01wp-all-export-xss: WordPress All Export <1.3.6 - Cross-Site Scripting
- PoC2025-08-01wp-ambience-xss: WordPress Ambience Theme <=1.0 - Cross-Site Scripting
- PoC2025-08-01wp-blogroll-fun-xss: WordPress Blogroll Fun-Show Last Post and Last Update Time 0.8.4 - Cross-Site Scripting
- PoC2025-08-01wp-code-snippets-xss: WordPress Code Snippets - Cross-Site Scripting
- PoC2025-08-01wp-config-setup: WordPress Setup Configuration
- PoC2025-08-01wp-custom-tables-xss: WordPress Custom Tables 3.4.4 - Cross-Site Scripting
- PoC2025-08-01wp-email-subscribers-listing: WordPress Plugin Email Subscribers Listing
- PoC2025-08-01wp-flagem-xss: WordPress FlagEm - Cross-Site Scripting
- PoC2025-08-01wp-footnote-xss: WordPress 6.3-6.3.1 Footnotes Block - Cross-Site Scripting
- PoC2025-08-01wp-gallery-file-upload: WordPress Plugin Gallery 3.06 - Arbitrary File Upload
- PoC2025-08-01wp-googlemp3-lfi: WordPress Plugin CodeArt Google MP3 Player - File Disclosure Download
- PoC2025-08-01wp-grimag-open-redirect: WordPress Grimag <1.1.1 - Open Redirection
- PoC2025-08-01wp-haberadam-idor: WordPress Themes Haberadam JSON API - IDOR and Path Disclosure
- PoC2025-08-01wp-javospot-lfi: WordPress Javo Spot Premium Theme - Local File Inclusion
- PoC2025-08-01wp-kadence-blocks-rce: WordPress Gutenberg Blocks Plugin <= 3.1.10 - Arbitrary File Upload
- PoC2025-08-01wp-knews-xss: WordPress Knews Multilingual Newsletters 1.1.0 - Cross-Site Scripting
- PoC2025-08-01wp-mailchimp-log-exposure: WordPress MC4WP - Debug Log Exposure
- PoC2025-08-01wp-memphis-documents-library-lfi: WordPress Memphis Document Library 3.1.5 - Local File Inclusion
- PoC2025-08-01wp-nextgen-xss: WordPress NextGEN Gallery 1.9.10 - Cross-Site Scripting
- PoC2025-08-01wp-oxygen-theme-lfi: WordPress Oxygen-Theme - Local File Inclusion
- PoC2025-08-01wp-phpfreechat-xss: WordPress PHPFreeChat 0.2.8 - Cross-Site Scripting
- PoC2025-08-01wp-portrait-archiv-xss: WordPress Portrait-Archiv.com Photostore 5.0.4 - Reflected Cross Site Scripting
- PoC2025-08-01wp-prostore-open-redirect: WordPress ProStore <1.1.3 - Open Redirect
- PoC2025-08-01wp-real-estate-xss: WordPress Real Estate 7 Theme <= 3.3.4 - Cross-Site Scripting
- PoC2025-08-01wp-related-post-xss: WordPress Related Posts <= 2.1.1 - Cross Site Scripting
- PoC2025-08-01wp-securimage-xss: WordPress Securimage-WP 3.2.4 - Cross-Site Scripting
- PoC2025-08-01wp-security-open-redirect: WordPress All-in-One Security <=4.4.1 - Open Redirect
- PoC2025-08-01wp-simple-fields-lfi: WordPress Simple Fields 0.2 - 0.3.5 LFI/RFI/RCE
- PoC2025-08-01wp-slideshow-xss: WordPress Slideshow - Cross-Site Scripting
- PoC2025-08-01wp-socialfit-xss: WordPress SocialFit - Cross-Site Scripting
- PoC2025-08-01wp-spot-premium-lfi: WordPress Javo Spot Premium Theme - Unauthenticated Directory Traversal
- PoC2025-08-01wp-statistics-sqli: WordPress WP Statistics Plugin 13.0.7 - SQL Injection
- PoC2025-08-01wordpress-super-forms: WordPress super-forms Plugin Directory Listing
- PoC2025-08-01wp-sym404: Wordpress sym404 directory
- PoC2025-08-01wp-touch-redirect: WordPress WPtouch 3.7.5 - Open Redirect
- PoC2025-08-01wp-tutor-lfi: WordPress tutor 1.5.3 - Local File Inclusion
- PoC2025-08-01wordpress-upload-data: wordpress-upload-data
- PoC2025-08-01wp-upward-theme-redirect: WordPress Upward Themes <1.5 - Open Redirect
- PoC2025-08-01wp-user-enum: WordPress REST API User Enumeration
- PoC2025-08-01wp-vault-local-file-inclusion: WordPress Vault 0.8.6.6 - Local File Inclusion
- PoC2025-08-01wordpress-xmlrpc-brute-force: Wordpress XMLRPC.php username and password Bruteforcer
- PoC2025-08-01wpify-woo-czech-xss: WordPress WPify Woo Czech <3.5.7 - Cross-Site Scripting
- PoC2025-08-01wpml-xss: WordPress Plugin WPML Version < 4.6.1 Cross-Site Scripting
- PoC2025-08-01wptouch-xss: WordPress WPtouch <4.3.44 - Cross-Site Scripting
- PoC2025-08-01zero-spam-sql-injection: WordPress Zero Spam <= 2.1.1 - Blind SQL Injection
- PoC2025-08-01CVE-2025-6174: WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)
- PoC2025-08-01wordpress-login: WordPress login
- 2025-07-28WordPress WPBookit <= 1.0.4 /wp-admin/admin-ajax.php 文件上传漏洞 （CVE-2025-6058）
- 2025-07-28WordPress WPBookit <= 1.0.4 /wp-admin/admin-ajax.php 文件上传漏洞 （CVE-2025-6058）
- 2025-07-24（CVE-2025-4608）WordPress Structured Content插件存储型跨站脚本漏洞
- 2025-07-23（CVE-2025-6174）Qwizcards WordPress插件3.9.4及之前版本反射型跨站脚本漏洞
- 2025-07-22WordPress WP_HTML_Token反序列化代码执行漏洞
- 2025-07-22（CVE-2025-6082）WordPress Birth Chart Compatibility插件完整路径泄露漏洞
- 2025-07-15WordPress Ads-pro /wp-admin/admin-ajax.php 文件包含漏洞 （CVE-2025-4380）
- 2025-07-15WordPress Simple File List 插件 /wp-content/plugins/simple-file-list/ee-upload-engine.php 文件上传漏洞 （CVE-2025-34085）
- 2025-07-15(CVE-2025-5394) Alone WordPress主题任意文件上传漏洞
- 2025-07-15WordPress Ads-pro /wp-admin/admin-ajax.php 文件包含漏洞 （CVE-2025-4380）
- 2025-07-15WordPress Simple File List 插件 /wp-content/plugins/simple-file-list/ee-upload-engine.php 文件上传漏洞 （CVE-2025-34085）
- 2025-07-13WordPress plugin Events Manager SQL注入漏洞
- 2025-07-10WordPress-ads-pro 存在本地文件包含漏洞（CVE-2025-4380）
- 2025-07-10WordPress Kognetiks Chatbot for WordPress 插件 <= 2.0.0 /wp-admin/admin-ajax.php 文件上传漏洞 （CVE-2024-32700）
- 2025-07-10WordPress Kognetiks Chatbot for WordPress 插件 <= 2.0.0 /wp-admin/admin-ajax.php 文件上传漏洞 （CVE-2024-32700）
- 2025-07-04WordPress Relevanssi /wp-admin/admin-ajax.php 未授权访问漏洞（CVE-2024-1380）
- 2025-07-04WordPress Relevanssi /wp-admin/admin-ajax.php 未授权访问漏洞（CVE-2024-1380）
- 2025-06-20WordPress 插件 Hotel Booking Lite / 文件读取漏洞（CVE-2023-5991）
- 2025-06-20Wordpress Plugins Kiwiz /wp-content/plugins/woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz/entrypoint/concat-pdf.php 文件读取漏洞（CVE-2023-2180）
- 2025-06-20WordPress 插件 Hotel Booking Lite / 文件读取漏洞（CVE-2023-5991）
- 2025-06-20Wordpress Plugins Kiwiz /wp-content/plugins/woocommerce-gateway-certification-de-facture-et-gestion-de-pdf-kiwiz/entrypoint/concat-pdf.php 文件读取漏洞（CVE-2023-2180）
- 2025-06-18（CVE-2025-4413）WordPress插件Pixabay Images任意文件上传漏洞
- 2025-06-13（CVE-2025-5815）WordPress Traffic Monitor插件未授权数据修改漏洞
- 2025-06-10(CVE-2025-4601) RH房地产WordPress主题权限提升漏洞
- 2025-06-06WordPress plugin Comments Import & Export 跨站脚本漏洞
- 2025-06-06（CVE-2025-5239）WordPress插件Domain For Sale存储型跨站脚本漏洞
- 2025-06-04（CVE-2025-4578）File Provider WordPress插件SQL注入漏洞
- 2025-05-31(CVE-2025-4607) WordPress PSW前端登录与注册插件特权提升漏洞
- 2025-05-31(CVE-2025-4631) WordPress Profitori插件权限提升漏洞
- 2025-05-30WordPress Madara /wp-admin/admin-ajax.php 文件包含漏洞 （CVE-2025-4524）
- 2025-05-30（CVE-2025-5235）WordPress OpenSheetMusicDisplay插件存储型跨站脚本漏洞
- 2025-05-30WordPress Madara /wp-admin/admin-ajax.php 文件包含漏洞 （CVE-2025-4524）
- 2025-05-28WordPress suretriggers 存在权限绕过漏洞（CVE-2025-3102）
- 2025-05-27（CVE-2025-4682）WordPress插件The Essential Blocks存储型XSS漏洞
- 2025-05-23Wordpress 插件 File Away /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2025-2539）
- 2025-05-23WordPress 插件 Royal Elementor Addons /wp-admin/admin-ajax.php 文件上传漏洞 （CVE-2023-5360）
- 2025-05-23Wordpress 插件 Essential Blocks /index.php 文件读取漏洞（CVE-2023-6623）
- 2025-05-23Wordpress 插件 File Away /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2025-2539）
- 2025-05-23WordPress 插件 Royal Elementor Addons /wp-admin/admin-ajax.php 文件上传漏洞 （CVE-2023-5360）
- 2025-05-23Wordpress 插件 Essential Blocks /index.php 文件读取漏洞（CVE-2023-6623）
- 2025-05-21WordPress_Madara 本地文件包含漏洞 CVE-2025-4524
- 2025-05-21（CVE-2025-4094）DIGITS插件OTP验证速率限制不足漏洞
- 2025-05-16WordPress WP01 插件 /wp-admin/admin-ajax.php?action=wp01_generate_zip_archive 文件读取漏洞（CVE-2025-30567）
- 2025-05-16WordPress WP01 插件 /wp-admin/admin-ajax.php?action=wp01_generate_zip_archive 文件读取漏洞（CVE-2025-30567）
- 2025-05-15WordPress_depicter Sql注入 （CVE-2025-2011）
- 2025-05-15WordPress_Relevanssi存在Sql注入漏洞（CVE-2025-4396）
- 2025-05-09WordPress Kubio 插件 / 文件包含漏洞（CVE-2025-2294）
- 2025-05-09WordPress Kubio 插件 / 文件包含漏洞（CVE-2025-2294）
- 2025-05-06WordPress_AdsProPlugin Sql注入漏洞（CVE-2024-13322）
- 2025-05-05WordPress plugin VerticalResponse Newsletter Widget 跨站脚本漏洞
- 2025-05-05WordPress plugin SurveyJS 跨站脚本漏洞
- 2025-05-05WordPress plugin Xavins Review Ratings 跨站脚本漏洞
- 2025-05-05WordPress plugin Database Toolset 信息泄露漏洞
- 2025-04-30WordPress Plugin Suretriggers /wp-json/sure-triggers/v1/automation/action 未授权访问漏洞（CVE-2025-3102）
- 2025-04-30WordPress Plugin Suretriggers /wp-json/sure-triggers/v1/automation/action 未授权访问漏洞（CVE-2025-3102）
- 2025-04-28WordPress plugin eForm 跨站脚本漏洞
- 2025-04-28WordPress plugin Breeze Display 跨站脚本漏洞
- 2025-04-27WordPress plugin WPVN 跨站请求伪造漏洞
- 2025-04-20WordPress plugin Sponsered Link 跨站脚本漏洞
- 2025-04-13WordPress plugin azurecurve Shortcodes in Comments 代码注入漏洞
- 2025-04-13WordPress plugin Accredible Certificates & Open Badges SQL注入漏洞
- 2025-04-13WordPress plugin Payment Forms for Paystack 跨站脚本漏洞
- 2025-04-13WordPress plugin ORDER POST 代码注入漏洞
- 2025-04-03WordPress Plugin RepairBuddy /wp-admin/admin-ajax.php 文件上传漏洞（CVE-2024-51793）
- 2025-04-03WordPress Plugin RepairBuddy /wp-admin/admin-ajax.php 文件上传漏洞（CVE-2024-51793）
- 2025-04-01WordPress Plugin R+L Carrier Edition /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2024-13481）
- 2025-04-01WordPress Plugin R+L Carrier Edition /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2024-13481）
- 2025-03-31WordPress Kubio plugin kubio-site-edit-iframe-preview 任意文件读取漏洞
- 2025-03-31Wordpress Kubio AI Page Builder 本地文件包含漏洞（CVE-2025-2294）
- 2025-03-20WordPress CF7插件cities存在SQL注入漏洞
- 2025-03-20wordPress WooCommerce 本地文件包含漏洞（CVE-2025-1661）
- 2025-03-14WordPress W3 Total Cache pub/sns.php 文件读取漏洞（CVE-2019-6715）
- 2025-03-14WordPress W3 Total Cache pub/sns.php 文件读取漏洞（CVE-2019-6715）
- 2025-02-28WordPress Yawave插件前台SQL注入漏洞(CVE-2025-1648)
- 2025-02-24WordPress LTL Freight Quotes 多个插件存在 sql注入漏洞（CVE-2024-13481、CVE-2024-13478、CVE-2024-13485）
- 2025-02-24WordPress Web Directory Free /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2024-3673）
- 2025-02-24WordPress Web Directory Free /wp-admin/admin-ajax.php 文件读取漏洞（CVE-2024-3673）
- 2025-02-21WordPress ltl-freight-quotes-estes-edition sql注入漏洞（CVE-2024-13479）
- 2025-02-19WordPress plugin Easy Elementor Addons 跨站脚本漏洞
- 2025-02-19WordPress plugin Leyka 跨站脚本漏洞
- 2025-02-19WordPress plugin WP Airbnb Review Slider SQL注入漏洞
- 2025-02-19WordPress plugin Content Snippet Manager 跨站请求伪造漏洞
- 2025-02-19WordPress plugin Botnet Attack Blocker 跨站脚本漏洞
- 2025-02-19WordPress plugin Keep Backup Daily 路径遍历漏洞
- 2025-02-19WordPress plugin LTL Freight Quotes – Unishippers Edition 跨站脚本漏洞
- 2025-02-19WordPress plugin Forex Calculators 跨站脚本漏洞
- 2025-02-14WordPress plugin WP Foodbakery 跨站脚本漏洞
- 2025-02-09WordPress plugin WP ALL Export Pro 代码注入漏洞
- 2025-02-09WordPress plugin WP ALL Export Pro 代码注入漏洞
- 2025-02-08WordPress Fancy Product Designer 插件 /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2024-51818）
- 2025-02-08WordPress Fancy Product Designer 插件 /wp-admin/admin-ajax.php SQL 注入漏洞（CVE-2024-51818）
- 2025-01-28WordPress plugin WC Affiliate 跨站脚本漏洞
- 2025-01-27WordPress plugin Divi Carousel Maker 跨站脚本漏洞
- 2025-01-27WordPress plugin Import WP – Export and Import CSV and XML files to WordPress 信息泄露漏洞
- 2025-01-27WordPress plugin ABC Notation 跨站脚本漏洞
- 2025-01-27WordPress plugin Ask Me Anything 跨站脚本漏洞
- 2025-01-27WordPress plugin Etsy Importer 跨站脚本漏洞
- 2025-01-27WordPress plugin Power Ups for Elementor 跨站脚本漏洞
- 2025-01-27WordPress plugin WordPress SEO Friendly Accordion FAQ with AI assisted content generation 跨站脚本漏洞
- 2025-01-27WordPress plugin Event post 跨站脚本漏洞
- 2025-01-27WordPress plugin WC Marketplace 跨站脚本漏洞