Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,236cataloged exploits

39,844CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,068VulnCheck XDB 9,820Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

4,478 exploits

Nucleihigh

WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

CVE-2021-24862—

RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection

60RISK

open ↗

Nucleimedium

WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting

CVE-2021-24875—

eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting

CVE-2021-24876—

Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

CVE-2021-24878—

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Elementor Website Builder <3.1.4 - Cross-Site Scripting

CVE-2021-24891—

Elementor < 3.4.8 - DOM Cross-Site-Scripting

23RISK

open ↗

Nucleimedium

WordPress Transposh Translation <1.0.8 - Cross-Site Scripting

CVE-2021-24910—

Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Contest Gallery < 13.1.0.6 - SQL injection

CVE-2021-24915—

Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

23RISK

open ↗

Nucleihigh

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

CVE-2021-24916—

Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending

18RISK

open ↗

Nucleihigh

WordPress WPS Hide Login <1.9.1 - Information Disclosure

CVE-2021-24917—

WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

40RISK

open ↗

Nucleimedium

WordPress Domain Check <1.0.17 - Cross-Site Scripting

CVE-2021-24926—

Domain Check < 1.0.17 - Reflected Cross-Site Scripting

43RISK

open ↗

Nucleicritical

WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection

CVE-2021-24931—

Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection

60RISK

open ↗

Nucleimedium

Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting

CVE-2021-24934—

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting

CVE-2021-24940—

Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleicritical

Registrations for the Events Calendar < 2.7.6 - SQL Injection

CVE-2021-24943—

Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection

18RISK

open ↗

Nucleicritical

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

CVE-2021-24946—

Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

60RISK

open ↗

Nucleimedium

WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read

CVE-2021-24947—

RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read

18RISK

open ↗

Nucleimedium

Blog2Social < 6.8.7 - Cross-Site Scripting

CVE-2021-24956—

Blog2Social < 6.8.7 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleihigh

WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

CVE-2021-24970—

All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion

18RISK

open ↗

Nucleimedium

Paid Memberships Pro < 2.6.6 - Cross-Site Scripting

CVE-2021-24979—

Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Super Socializer <7.13.30 - Cross-Site Scripting

CVE-2021-24987—

Super Socializer < 7.13.30 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WooCommerce PDF Invoices & Packing Slips WordPress Plugin < 2.10.5 - Cross-Site Scripting

CVE-2021-24991—

WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Guppy <=1.1 - Information Disclosure

CVE-2021-24997—

WP Guppy < 1.3 - Sensitive Information Disclosure

18RISK

open ↗

Nucleicritical

WordPress WPCargo Track & Trace <6.9.0 - Remote Code Execution

CVE-2021-25003—

WPCargo < 6.9.0 - Unauthenticated RCE

50RISK

open ↗

Nucleimedium

The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting

CVE-2021-25008—

Code Snippets < 2.14.3 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

Chaty < 2.8.2 - Cross-Site Scripting

CVE-2021-25016—

Chaty < 2.8.3 - Reflected Cross-Site Scripting

18RISK

open ↗

Nucleimedium

WordPress Event Tickets < 5.2.2 - Open Redirect

CVE-2021-25028—

Event Tickets < 5.2.2 - Open Redirect

18RISK

open ↗

Nucleicritical

PublishPress Capabilities < 2.3.1 - Missing Authorization

CVE-2021-25032—

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

38RISK

open ↗

Nucleimedium

Noptin < 1.6.5 - Open Redirect

CVE-2021-25033—

Noptin < 1.6.5 - Open Redirect

18RISK

open ↗

Nucleihigh

WordPress Button Generator <2.3.3 - Remote File Inclusion

CVE-2021-25052—

Button Generator < 2.3.3 - RFI leading to RCE via CSRF

18RISK

open ↗

Nucleimedium

WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting

CVE-2021-25055—

FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

18RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.