Khaled Alenazi

CVE-2025-2005. WordPress Front End Users Plugin <= 3.2.32 is vulnerable to Arbitrary File Upload

CVE-2025-6934. Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation

CVE-2025-3102. Wordpress SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

CVE-2025-2266. Checkout Mestres do WP for WooCommerce 8.6.5 - 8.7.5 - Unauthenticated Arbitrary Options Update

CVE-2025-4334. Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation

CVE-2025-8723. Cloudflare Image Resizing <= 1.5.6 | Unauthenticated Remote Code Execution

CVE-2025-7340. HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

CVE-2025-3776. WordPress Verification SMS with TargetSMS Plugin <= 1.5 is vulnerable to Remote Code Execution (RCE)

CVE-2025-1306. Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

CVE-2025-47539. Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation

CVE-2024-9047-Exploit. Exploit for WordPress File Upload Plugin - All versions up to 4.24.11 are vulnerable.

CVE-2025-23942-poc. WP Load Gallery <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

CVE-2025-2294. Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion

CVE-2024-12209. Unauthenticated Local File Inclusion

CVE-2025-39436. WordPress I Draw Plugin <= 1.0 is vulnerable to Arbitrary File Upload

CVE-2025-4190. CSV Mass Importer <= 1.2 - Admin+ Arbitrary File Upload

Nxploited. Config files for my GitHub profile.

CVE-2024-52380-Exploit. Picsmize plugin for WordPress is vulnerable to arbitrary file uploads.

CVE-2025-5288. Wordpress REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation

CVE-2025-5394. Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

CVE-2025-1304. WordPress NewsBlogger Theme <= 0.2.5.1 is vulnerable to Arbitrary File Upload

CVE-2025-23922. WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability

CVE-2024-51788. CVE-2024-51788 - WordPress The Novel Design Store Directory plugin <= 4.3.0 - Unauthenticated Arbitrary File Upload Vulnerability

CVE-2025-32206. WordPress Processing Projects Plugin <= 1.0.2 is vulnerable to Arbitrary File Upload

CVE-2025-3605. WordPress Frontend Login and Registration Blocks Plugin <= 1.0.7 is vulnerable to Privilege Escalation

CVE-2025-32583. WordPress PDF 2 Post Plugin <= 2.4.0 is vulnerable to Remote Code Execution (RCE) +Subscriber

CVE-2024-6132. Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

CVE-2025-47646. WordPress PSW Front-end Login &amp; Registration Plugin <= 1.12 is vulnerable to Broken Authentication

CVE-2024-10924-Exploit. Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

CVE-2025-7955. RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

CVE-2025-39596. Quentn WP <= 1.2.8 - Unauthenticated Privilege Escalation

CVE-2024-49668. WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability

CVE-2025-8625. Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution

CVE-2025-49029. WordPress Custom Login And Signup Widget Plugin <= 1.0 is vulnerable to Arbitrary Code Execution

CVE-2025-1307. Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

CVE-2025-7401. Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write

CVE-2024-50492. ScottCart <= 1.1 - Unauthenticated Remote Code Execution

CVE-2025-39538. WordPress WP-Advanced-Search <= 3.3.9.3 - Arbitrary File Upload Vulnerability

CVE-2024-30485. WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

CVE-2025-39601. WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability

CVE-2024-52402. WordPress Exclusive Content Password Protect plugin <= 1.1.0 - CSRF to Arbitrary File Upload vulnerability

CVE-2025-25101. WordPress Munk Sites plugin <= 1.0.7 - CSRF to Arbitrary Plugin Installation vulnerability

CVE-2025-32579. WordPress Sync Posts Plugin <= 1.0 is vulnerable to Arbitrary File Upload

CVE-2025-5287. WordPress Likes and Dislikes Plugin <= 1.0.0 is vulnerable to SQL Injection

CVE-2024-51793. WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability

CVE-2024-12252. SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)

CVE-2025-48129. WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Plugin <= 2.4.37 is vulnerable to Privilege Escalation

CVE-2025-32118. WordPress CMP – Coming Soon & Maintenance plugin <= 4.1.13 - Remote Code Execution (RCE) vulnerability

CVE-2025-5701. WordPress HyperComments Plugin <= 1.2.2 is vulnerable to Privilege Escalation

CVE-2024-56249. WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

CVE-2025-30772. WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

CVE-2025-3604. Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover

CVE-2025-28915. WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

CVE-2024-9756. Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload

CVE-2025-8570. BeyondCart Connector <= 2.1.0 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation

CVE-2025-9286. Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation