Tools

typedefabcd1234ntd/cve-2026-2002-poc

CVE-2026-2002 writeup and Proof-of-concept

d0n601/cve-2024-9162

All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection

hunthubspace/cve-2024-3105-poc

A PoC Exploit for CVE-2024-3105 - The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress Remote Code Execution (RCE)

ptrstr/cve-2025-4524

CVE-2025-4524 - Unauthenticated madara-core Wordpress theme LFI

ananay/wp2shell-lab

Validation target: minimal WordPress core slice reproducing the wp2shell (CVE-2026-63030 + CVE-2026-60137) REST-to-SQLi chain

quetuan03/cve-2025-57926

WordPress Passster Plugin <= 4.2.18 is vulnerable to Cross Site Scripting (XSS)

d0n601/cve-2025-47550

Instantio - Wordpress Plugin <= 3.3.16 - Authenticated (Admin+) Arbitrary File Upload via ins_options_save

randomrobbiebf/cve-2024-56059

Partners <= 0.2.0 - Unauthenticated PHP Object Injection

randomrobbiebf/cve-2024-56058

VRPConnector <= 2.0.1 - Unauthenticated PHP Object Injection

randomrobbiebf/cve-2024-50507

DS.DownloadList <= 1.3 - Unauthenticated PHP Object Injection

polaris64/web_exploit_detector

The Web Exploit Detector is a Node.js application used to detect possible infections, malicious code and suspicious files in web hosting environments

nth347/cve-2020-28032_poc

PoC for CVE-2020-28032 (It's just a POP chain in WordPress < 5.5.2 for exploiting PHP Object Injection)

sudo-wp/sudowp-hooks-visualizer

A security-hardened fork of "Simply Show Hooks". Replaces the compromised original (CVE-2024-6297) and patches unlisted Cross-Site Scripting (XSS)…

sudo-wp/sudowp-clickfunnels-zurich

A security-patched fork of the legacy ClickFunnels Classic WordPress plugin. Fixes critical Stored XSS vulnerabilities (CVE-2022-4782) while…

mrmtwoj/fix-cve-2026-60137-cve-2026-63030-in-wordpress

CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)

randomrobbiebf/cve-2024-0679

ColorMag <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

sudo-wp/sudowp-dropzone-elementor

Secure fork of Startklar Elementor Addons. Patched CVE-2024-5153 & File Upload vulnerabilities.

whattheslime/cve-2026-0740

Ninja Forms File Uploads <= 3.3.26 - Unauthenticated Arbitrary File Upload to RCE (CVE-2026-0740)