Skip to content

Archives: Exploits

Litespeed Cache WordPress Plugin 6.3.0.1 – Privilege Escalation

WordPress Digits Plugin 8.4.6.1 – Authentication Bypass via OTP Bruteforcing

WordPress User Registration & Membership Plugin 4.1.2 – Authentication Bypass

WordPress Frontend Login and Registration Blocks Plugin 1.0.7 – Privilege Escalation

WordPress Depicter Plugin 3.6.1 – SQL Injection

WordPress Core 6.2 – Directory Traversal

Drupal 11.x-dev – Full Path Disclosure

LearnPress WordPress LMS Plugin 4.2.7 – SQL Injection

WordPress User Registration & Membership Plugin 4.1.1 – Unauthenticated Privilege Escalation

WordPress Theme XStore 9.3.8 – SQLi

WordPress Plugin Background Image Cropper v1.2 – Remote Code Execution

WordPress Plugin Playlist for Youtube 1.32 – Stored Cross-Site Scripting (XSS)

WordPress Plugin WP Video Playlist 1.1.1 – Stored Cross-Site Scripting (XSS)

WordPress Theme Travelscape v1.0.3 – Arbitrary File Upload

WordPress Plugin Alemha Watermarker 1.3.1 – Stored Cross-Site Scripting (XSS)

WordPress Plugin – Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated)

OpenCart Core 4.0.2.3 – ‘search’ SQLi

WordPress File Upload Plugin < 4.23.3 - Stored XSS

WordPress Plugin Duplicator < 1.5.7.1 - Unauthenticated Sensitive Data Exposure to Account Takeover

Neontext WordPress Plugin – Stored XSS

WordPress Plugin Admin Bar & Dashboard Access Control Version: 1.2.8 – _Dashboard Redirect_ field Stored Cross-Site Scripting (XSS)

WordPress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)

WordPress Seotheme – Remote Code Execution Unauthenticated

WordPress Augmented-Reality – Remote Code Execution Unauthenticated

WordPress Sonaar Music Plugin 4.7 – Stored XSS

WordPress Plugin Masterstudy LMS – 3.0.17 – Unauthenticated Instructor Account Creation

Media Library Assistant WordPress Plugin – RCE and LFI

Drupal 10.1.2 – web-cache-poisoning-External-service-interaction

WordPress Plugin Elementor 3.5.5 – Iframe Injection

WordPress adivaha Travel Plugin 2.3 – SQL Injection

WordPress adivaha Travel Plugin 2.3 – Reflected XSS

WordPress Plugin EventON Calendar 4.4 – Unauthenticated Event Access

WordPress Plugin EventON Calendar 4.4 – Unauthenticated Post Access via IDOR

WordPress Plugin Forminator 1.24.6 – Unauthenticated Remote Command Execution

WordPress Plugin Ninja Forms 3.6.25 – Reflected XSS

Joomla JLex Review 6.0.1 – Reflected XSS

Joomla Solidres 2.13.3 – Reflected XSS

Joomla iProperty Real Estate 4.1.1 – Reflected XSS

Joomla VirtueMart Shopping Cart 4.0.12 – Reflected XSS

WordPress Plugin AN_Gradebook 5.0.1 – SQLi

Joomla HikaShop 4.7.4 – Reflected XSS

Joomla! com_booking component 2.4.9 – Information Leak (Account enumeration)

Prestashop 8.0.4 – Cross-Site Scripting (XSS)

PrestaShop Winbiz Payment module – Improper Limitation of a Pathname to a Restricted Directory

WordPress Theme Medic v1.0.0 – Weak Password Recovery Mechanism for Forgotten Password

WordPress Theme Workreap 2.2.2 – Unauthenticated Upload Leading to Remote Code Execution

WordPress Plugin Backup Migration 1.2.8 – Unauthenticated Database Backup

Prestashop 8.0.4 – CSV injection

Joomla! v4.2.8 – Unauthenticated information disclosure

Paid Memberships Pro v2.9.8 (WordPress Plugin) – Unauthenticated SQL Injection