Publicly Disclosed
PoC Exploits

FUEL CMS version 1.4.1 is susceptible to a significant vulnerability that allows for PHP code execution. By manipulating the 'pages/select/' filter parameter or the 'preview/' data parameter, an attacker can execute arbitrary PHP code remotely without authentication. This flaw poses a severe risk...

An authentication bypass vulnerability exists in Microsoft Exchange Server, allowing authorized attackers to perform capture-replay attacks that can lead to elevated privileges on a network. This security issue highlights the importance of securing authentication mechanisms to prevent unauthorize...

An out-of-bounds write vulnerability has been identified in Apple's operating systems, potentially allowing attackers to execute arbitrary code through specially crafted files. Affected systems include earlier versions of iOS, iPadOS, and specific macOS versions. Apple has implemented improved bo...

Dokploy, a self-hostable Platform as a Service (PaaS), is affected by a vulnerability that stems from an incomplete fix related to input validation in its version management. Specifically, in versions 0.29.3 to 0.29.12, the application fails to properly validate branch fields during requests to c...

The Click n Chat plugin for WordPress, prior to version 1.1.3, lacks proper authorization checks on a lead-export handler. This oversight permits unauthenticated users to access and download sensitive information such as contact names, email addresses, and phone numbers. As a result, this vulnera...

The Cart Abandonment Recovery for WooCommerce plugin prior to version 2.2.0 lacks proper verification of its cart-recovery token, allowing unauthenticated attackers with knowledge of a victim's cart session identifier to modify abandoned-cart records. This includes actions such as unsubscribing u...

The Click n Chat (Chat Widget Integration) plugin for WordPress prior to version 1.1.3 contains a significant vulnerability that allows unauthenticated attackers to execute SQL injection attacks. This occurs due to insufficient validation of a parameter used as a column identifier in SQL queries....

The Wava Payment Plugin for WordPress versions prior to 0.3.10 is susceptible to an authorization bypass due to inadequate security measures on its public REST endpoints. This vulnerability enables unauthenticated attackers to overwrite the merchant account credentials, which could lead to unauth...

The Translate WordPress with Weglot plugin version 2.0 and prior is susceptible to a Cross-Site Scripting (XSS) vulnerability due to the improper handling of URLs during the translation process. This flaw allows unauthorized users to inject malicious scripts into translated pages, which are then ...

The Click n Chat plugin for WordPress, specifically versions prior to 1.1.3, is susceptible to SQL injection due to a failure to sanitize sort parameters before their use in an SQL ORDER BY clause. This vulnerability enables unauthenticated attackers to manipulate the SQL queries executed by the ...

The Wava Payment Plugin for WordPress prior to version 0.3.10 fails to authenticate notifications received from payment providers, allowing unauthorized individuals to manipulate WooCommerce order statuses. This includes the potential to mark an unpaid order as paid or to cancel existing customer...

The Download Manager plugin for WordPress lacks sufficient CSRF protection in key areas, allowing attackers to manipulate logged-in administrators' privacy and storage settings through a specially crafted link. This vulnerability includes access to the credentials needed to exploit an unauthentic...

The Advanced File Manager plugin for WordPress prior to version 6.0.0 contains a critical security flaw due to improper validation of stored file types, specifically SVG files. This vulnerability allows users with file-manager access to upload files that may contain malicious scripts, which can e...

The Elementor Website Builder plugin for WordPress prior to version 4.3.5 has a security flaw that allows users with the Contributor role and higher to embed malicious SVG files. These files are improperly sanitized, making it possible for the payload to execute when rendered inline within a page...

The Formidable Forms plugin for WordPress prior to version 7.0 is susceptible to an authentication bypass that compromises payment gateway verification. This vulnerability allows unauthenticated users to manipulate the timestamp for rate limiting, thereby exhausting the allotted attempts for legi...

The Elementor Website Builder plugin for WordPress versions prior to 4.3.5 contains a security flaw that permits users with Author role and higher to upload SVG files without proper sanitation checks. This vulnerability can be exploited to upload malicious JavaScript within the SVG, which execute...

The SUMIT Payment Gateway for WooCommerce plugin prior to version 4.0.0 allows unauthenticated users to incorrectly mark pending orders as paid. This occurs because the plugin does not associate confirmed payments with their respective orders, nor does it validate the payment amount against the t...

The WholesaleX WordPress plugin, prior to version 3.0.9, exposes user-import files at a publicly accessible location with a predictable name. This vulnerability allows unauthenticated users to download recently imported user data, which can include sensitive information such as account passwords,...

The TI WooCommerce Wishlist plugin for WordPress prior to version 2.13.0 contains a vulnerability where it fails to enforce owner-only access control on its REST API. This oversight allows unauthenticated users to access metadata and contents of private wishlists, potentially exposing sensitive u...

The WholesaleX WordPress plugin prior to version 3.0.9 exhibits a flaw wherein it fails to validate that a stored account confirmation code exists before performing a match with the supplied code. This vulnerability permits unauthorized users to activate pending accounts, effectively circumventin...

The User Profile Builder plugin for WordPress, prior to version 4.0.1, is susceptible to a reflected cross-site scripting vulnerability. This arises when the plugin fails to properly escape the current page URL, allowing attackers to inject malicious scripts into the admin pages. This exploit par...

The Kliken: Ads + Pixel for Meta WordPress plugin versions prior to 1.2.3 lacks proper access control on the order confirmation page. This oversight allows unauthenticated users to view sensitive information such as billing locations and product details of other users' orders by manipulating orde...

The AI Engine plugin for WordPress, prior to version 3.8.6, contains a vulnerability that fails to validate the permissions of the user before permitting changes to the title and excerpt of various objects. This oversight allows users with an Editor role or higher to alter content that they typic...

The miniOrange 2FA WordPress plugin prior to version 6.3.1 allows an attacker to exploit a flaw in the pending passkey login mechanism. This vulnerability enables an attacker with knowledge of the user's password to register an additional authenticator for accounts that already have a passkey con...

The Pricing Table WordPress Plugin prior to version 4.1.3 lacks essential authorization checks during the duplication of legacy pricing tables. This oversight allows users with contributor roles or higher to clone and publish posts or pages, which includes accessing private or draft content belon...

The Redirection for Contact Form 7 WordPress plugin prior to version 3.2.12 fails to properly sanitize or escape submitted form data stored as lead entries. This oversight enables unauthenticated attackers to inject a malicious script into the stored data, which could be executed when a logged-in...

The SureCart WordPress plugin prior to version 4.9.5 suffers from a data exposure issue that allows anonymous users to access sensitive information through its REST API. This vulnerability enables unauthenticated visitors to retrieve confidential merchant catalog data, including pricing, commissi...

The WPZOOM Portfolio Lite plugin for WordPress has a critical oversight in its permission management. Prior to version 1.4.34, the plugin fails to verify if a user has the appropriate permissions to edit a post before allowing changes to its type and order. This flaw enables users with contributo...

The WP User Manager plugin for WordPress prior to version 2.9.26 allows unauthenticated users to bypass payment restrictions intended for paid registrations. When the payment gateway is disconnected, existing configurations permit unauthorized access, enabling users to register and immediately ga...

The Productive Commerce WordPress plugin prior to version 1.1.49 is affected by a vulnerability that allows unauthorized access to certain administrative functions. This occurs because the plugin fails to adequately verify user capabilities during specific AJAX actions, exposing a nonce associate...

The WP Booking System plugin for WordPress, prior to version 2.1.0.3, exposes a reflected cross-site scripting vulnerability. This occurs when the plugin fails to properly validate and escape a parameter, allowing attackers to inject malicious scripts that may be executed in the context of high-p...

The Swift Performance Lite WordPress plugin, specifically versions prior to 2.3.7.4, lacks proper sanitization and escaping of values in SQL statements. This flaw can enable users with the author role or higher to execute SQL injection attacks, potentially compromising the integrity of the databa...

The Simple Banner plugin for WordPress, prior to version 3.3.3, allows improper capability management for user roles designated by administrators. This flaw enables users with lower privileges to inherit full administrative capabilities, leading to potential full site compromise. Administrators s...

The HireZoot WordPress plugin prior to version 4.1.1 suffers from a vulnerability where it fails to properly sanitize and escape stored data before displaying it in the admin dashboard. This oversight, combined with the reversal of HTML-entity encoding, permits users with Author permissions to la...

The SmartyParcel plugin for WordPress allows unauthenticated users to access sensitive shipping label downloads without proper authorization checks. This vulnerability can lead to unauthorized disclosure of customer information, such as names, addresses, and phone numbers, from arbitrary orders. ...

The SmartyParcel plugin for WordPress is vulnerable due to inadequate authorization checks, allowing any authenticated user, including subscribers, to delete shipping label and tracking records across all orders. This flaw poses a significant risk, as it grants unauthorized access to sensitive or...

The Moloni WordPress plugin prior to version 5.0.14 exhibits a critical security flaw where it fails to perform necessary capability or nonce validations on several authenticated AJAX actions. This oversight permits any authenticated user, including those with lower privileges such as Subscribers...

The Uncanny Toolkit for LearnDash WordPress plugin prior to version 3.8.2 is vulnerable due to a lack of user permission verification. This oversight allows a subsite administrator on a multisite network to manipulate the verification state of users from other sites, potentially locking them out ...

The Backup and Staging by WP Time Capsule plugin prior to version 1.22.28 lacks proper capability and nonce verification on the handler tasked with deploying staging sites to live sites. This flaw allows any authenticated user with a Subscriber role on a staging site to overwrite the database and...

The Booking Package plugin for WordPress versions prior to 1.7.31 lacks proper authorization checks when returning calendar-account configuration data. This oversight permits unauthenticated users to access and disclose sensitive information, including the email addresses of administrators respon...

The Uncanny Toolkit for LearnDash, a WordPress plugin, has a vulnerability that allows unauthenticated attackers to manipulate password-reset requests. This flaw enables attackers to change a user's password without authorization, thereby gaining complete control over the affected account. The is...

The Falang Multilanguage Plugin for WordPress prior to version 1.4.6 lacks proper capability verification during the process of saving term translations. This oversight allows any logged-in user, including those with Subscriber-level permissions, to store data that can be rendered without suitabl...

The Booking Package WordPress plugin prior to version 1.7.31 is susceptible to an authorization bypass vulnerability. This flaw allows unauthenticated attackers to reset the premium subscription state without performing any necessary validity checks. As a result, attackers can disable the plugin'...

The Ettrick Escape Room Booking plugin for WordPress prior to version 1.3.1 is susceptible to a vulnerability that allows attackers to manipulate booking statuses. This flaw arises from the plugin's failure to authenticate payment confirmations with the payment provider, enabling unauthenticated ...

The Appointment Booking Plugin for WordPress, prior to version 5.7.5, lacks proper validation concerning authenticated agent-level users. This oversight permits an agent to access and retrieve personal data from any customer's records, including those managed by different agents. Such a flaw can ...

The Booking Package WordPress plugin, prior to version 1.7.31, is vulnerable due to its inadequate token generation methodology. This plugin fails to create booking cancellation tokens from a secure source of randomness, instead relying on publicly exposed values. As a result, an unauthenticated ...

The Payment Gateway for Idram WordPress plugin prior to version 2.1.6 lacks proper verification of incoming payment notifications. Due to default empty merchant credentials, this vulnerability allows attackers to forge valid payment confirmations. As a result, they can illegitimately mark any ord...

The Modern Events Calendar Lite and Pro plugins by Webnus prior to version 7.37.0 contain a vulnerability that allows authenticated users with Subscriber-level access and higher to manipulate SQL queries. This occurs due to inadequate sanitization and escaping of a parameter, enabling attackers t...

The Synchrony Financing WordPress plugin prior to version 1.1.2 has a significant security flaw that allows unauthenticated users to exploit its REST routes. This vulnerability enables attackers to modify WooCommerce orders by reassigning them to accounts they control. Additionally, attackers can...

The Metasploit Framework contains a vulnerability that allows attackers to exploit a relative path traversal issue in its iOS image gathering module. By taking advantage of unvalidated file names from a Meterpreter directory listing, an attacker can manipulate the local destination path, enabling...