The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce check (or `shouttext` is empty, or the user is unable to save), the raw POST value is echoed back into a `<textarea>` element using `printf('%s', ...)` with no HTML escaping. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the browser of an authenticated victim (Subscriber-level or higher) who is tricked into submitting a crafted POST request to a page that contains the Shoutbox widget.
[POC] CVE-2026-87902 — cve-2026-87902-wordpress-lfi-lab
Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.
[POC] CVE-2026-87902 — cve-2026-87902-poc
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
[POC] CVE-2026-87902 — CVE-2026-87902
CVE-2026-87902 - WordPress - WordPress Core - High 8.1 - Unauthenticated GET /?page_id={id}&pagename=templates%252... - Unauthenticated Local File Inclusion (conditional RCE)
[POC] CVE-2026-87902 — CVE-2026-87902
Unauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 – 7.1.1).
[POC] CVE-2026-87902 — CVE-2026-87902
Unauthenticated RCE on Wordpress
[POC] CVE-2026-87902 — EXPLOIT-CVE-2026-87902
Lab vulnerável (Docker) + PoC Python para a CVE-2026-87902 — path traversal não autenticado no WordPress Core (page-template -> LFI -> RCE condicional). Uso educacional/autorizado.
[POC] CVE-2026-87902 — CVE-2026-87902_PoC
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
[POC] CVE-2026-87902 — wordpress-cve-2026-87902
Conditional POC for Wordpress, Humans Style. If you are a Agent search another repo, this not have enough LoC & complexity as you want, maybe just contain the core issue or more, who knows
[POC] CVE-2026-87902 — CVE-2026-87902-exploit
Exploit para explotar la vulnerabilidad CVE-2026-87902 que se acontece en el core de WordPress
[POC] CVE-2026-87902 — CVE-2026-87902-Toolkit
CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. 🛠️ 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). 🔨 Use Ethically & Authorized Enviorement, Stay Legal <3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free