Tools

bahartanir/wp2shell-scanner

CVE-2026-63030 / CVE-2026-60137 - WordPress pre-auth RCE scanner

tc4dy/cve-2026-64638-poc-exploit

🛡️ CVE-2026-64638 - WordPress Security Assessment Suite (CVSS 8.9) | WordPress 4.7.0-7.0.2 pentest toolkit. Includes vulnerability assessment &…

shawnng078-ops/cve-2024-28000-exploit-lab

Hands-on reproduction of CVE-2024-28000 in LiteSpeed Cache using an isolated WordPress lab. Includes reconnaissance, vulnerable hash recovery,…

sangsenimanwartefak/cve-2026-80467

Python detection tool that fingerprints ACF Extended forms on WordPress and checks for publicly exposed role fields indicating CVE-2026-80467…

nxploited/cve-2025-39459

Real Estate 7 <= 3.5.2 - Unauthenticated Privilege Escalation

nxploited/cve-2025-12539

TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

fazaroot/cve-2025-2539---file-away-wordpress-plugin-arbitrary-file-read

Authenticated arbitrary file read exploit for the File Away WordPress plugin (CVE-2025-2539). Includes PoC, attack flow, detection signatures, and…

abraxas/cve-2026-81294

Proof-of-concept and lab reproduction for CVE-2026-81294, an unauthenticated privilege escalation in the WordPress Authorizer plugin via unverified…

i3it/cve-2026-18322

Root-cause analysis, passive version checker, and lab PoC for CVE-2026-18322, an unauthenticated privilege escalation in the Smart Popup by Supsystic…

dev0558/cve-2023-32243-detection-and-mitigation-in-wordpress

Educational lab demonstrating detection and mitigation of CVE-2023-32243 privilege escalation in WordPress Essential Addons for Elementor, using…

sangsenimanwartefak/cve-2026-5118

Detection tooling for CVE-2026-5118, an unauthenticated privilege escalation in Divi Form Builder <= 5.1.2, identifying affected WordPress…

ebrasha/cve-2024-28000

LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000

nxploited/cve-2025-2563

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is…

nxploited/cve-2025-53580

WordPress Simple Business Directory Pro Plugin < 15.6.9 is vulnerable to a high priority Privilege Escalation

yetazyyy/cve-2025-4606

Python-based scanner that tests WordPress sites for CVE-2025-4606, a privilege escalation vulnerability in the Sala theme allowing unauthenticated…

jenderal92/cve-2026-5118

CVE-2026-5118 – Python2 mass exploit for Divi WordPress plugin Unauthenticated administrator registration via admin-ajax.php. Multi‑threaded scanner…

thebl4ckph4nt0m/cve-2025-39459

Unauthenticated Privilege Escalation

yucaerin/cve-2026-5118

Divi Form Builder <= 5.1.2 — Unauthenticated Privilege Escalation via Role Injection