Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

4,527 exploits

Nucleimedium

WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting

CVE-2021-24435—

Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting

CVE-2021-24436—

W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

18RISK

open ↗

Nucleicritical

Wordpress Polls Widget < 1.5.3 - SQL Injection

CVE-2021-24442—

Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injection

30RISK

open ↗

Nucleimedium

WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting

CVE-2021-24452—

W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

18RISK

open ↗

Nucleicritical

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery

CVE-2021-24472—

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

30RISK

open ↗

Nucleimedium

WordPress Post Grid <2.1.8 - Cross-Site Scripting

CVE-2021-24488—

Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

43RISK

open ↗

Nucleimedium

Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting

CVE-2021-24495—

Marmoset Viewer < 1.9.3 - Reflected Cross Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting

CVE-2021-24498—

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress Guppy <=1.1 - Information Disclosure

CVE-2021-24997—

WP Guppy < 1.3 - Sensitive Information Disclosure

18RISK

open ↗

Nucleicritical

WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution

CVE-2021-25003—

WPCargo < 6.9.0 - Unauthenticated RCE

50RISK

open ↗

Nucleimedium

The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting

CVE-2021-25008—

Code Snippets < 2.14.3 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Chaty < 2.8.2 - Cross-Site Scripting

CVE-2021-25016—

Chaty < 2.8.3 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Event Tickets < 5.2.2 - Open Redirect

CVE-2021-25028—

Event Tickets < 5.2.2 - Open Redirect

18RISK

open ↗

Nucleicritical

PublishPress Capabilities < 2.3.1 - Missing Authorization

CVE-2021-25032—

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

38RISK

open ↗

Nucleimedium

Noptin < 1.6.5 - Open Redirect

CVE-2021-25033—

Noptin < 1.6.5 - Open Redirect

18RISK

open ↗

Nucleihigh

WordPress Button Generator <2.3.3 - Remote File Inclusion

CVE-2021-25052—

Button Generator < 2.3.3 - RFI leading to RCE via CSRF

18RISK

open ↗

Nucleimedium

WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting

CVE-2021-25055—

FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting

CVE-2021-25063—

Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting

CVE-2021-25065—

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

Landing Page Builder < 1.4.9.6 - Cross-Site Scripting

CVE-2021-25067—

Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

Nucleimedium

WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

CVE-2021-25074—

WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect

18RISK

open ↗

Nucleilow

WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting

CVE-2021-25075—

Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS

18RISK

open ↗

Nucleimedium

Affiliates Manager < 2.9.0 - Cross Site Scripting

CVE-2021-25078—

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Contact Form Entries < 1.2.4 - Cross-Site Scripting

CVE-2021-25079—

Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

WordPress Popup Builder < 4.0.7 - Remote Code Execution

CVE-2021-25082—

Popup Builder < 4.0.7 - LFI to RCE

18RISK

open ↗

Nucleimedium

WOOF WordPress plugin - Cross-Site Scripting

CVE-2021-25085—

WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

CVE-2021-25094—

Tatsu < 3.3.12 - Unauthenticated RCE

60RISK

open ↗

Nucleimedium

WordPress GiveWP <2.17.3 - Cross-Site Scripting

CVE-2021-25099—

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting

CVE-2021-25104—

Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress English Admin <1.5.2 - Open Redirect

CVE-2021-25111—

English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.