CVE-2021-34620 CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

The WP Fluent Forms plugin 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions...

WordPress Motor theme license issue vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . An authorization issue vulnerability exists in WordPress...

CVE-2021-24407

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24407

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24384

The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...

CVE-2021-24375

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

Cross site scripting

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

Authentication flaw

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

CVE-2021-24407

The CVE CVE-2021-24407 affects the WordPress Jannah theme prior to 5.4.5. The vulnerability is a Reflected Cross-Site Scripting (XSS) due to improper sanitization of the 'query' parameter in the tie_ajax_search AJAX action. Multiple connected sources corroborate this: XSS via POST parameter in ti...

CVE-2021-24384

CVE-2021-24384 affects the JoomSport WordPress plugin prior to 5.1.8. The vulnerability is a PHP object injection in the joomsport_md_load AJAX action, which unserialises input from the shattr POST parameter. It is accessible to unauthenticated users, and while the plugin itself lacks a gadget ch...

CVE-2021-24384 JoomSport < 5.1.8 - Unauthenticated PHP Object Injection

The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...

CVE-2021-24375

CVE-2021-24375 affects WordPress Motor theme versions prior to 3.1.0. The vulnerability is a Local File Inclusion via the motor_load_more, motor_gallery_load_more, motor_quick_view, and motor_project_quick_view AJAX handlers, caused by lack of authentication/validation. An unauthenticated attacke...

The vulnerability in the “main/inc/ajax/model.ajax.php” file of the Chamilo e-learning and content management system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the main/inc/ajax/model.ajax.php file of the Chamilo e-learning and content management system relates to the lack of protection for SQL query structures. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

Filter Gallery < 0.0.7 - Unauthorised AJAX Calls

The plugin had a logic flaw in the CSRF checks of its AJAX calls, allowing them to be passed by not providing the related parameter in the request. This could allow attacker to make logged in users do unwanted actions. Furthermore, the AJAX calls are also lacking capability checks, allowing any...

Travel Light <= 1.0 - CSRF Bypass

The plugin does not properly check for CSRF in its booktrip, filterplcbrdaction, filterplcserviceaction , filteraction and filterserviceaction AJAX actions, allowing attacker to make logged in users call them them via CSRF attacks...

Haxcan <= 1.0.0 - CSRF Bypass

The plugin does not properly check for CSRF in its getajaxresponse AJAX action, allowing attacker to make logged in admin call them it via CSRF attack and add arbitrary files in quarantine for example. PoC Add an arbitrary file to quarantine...

Filter Gallery < 0.0.7 - Unauthorised AJAX Calls

The plugin had a logic flaw in the CSRF checks of its AJAX calls, allowing them to be passed by not providing the related parameter in the request. This could allow attacker to make logged in users do unwanted actions. Furthermore, the AJAX calls are also lacking capability checks, allowing any...

CVE-2021-27950

A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id parameter to mesdocs.ajax.php in azurWebEngine/eShop. By default, the query is executed as DBA...

CVE-2021-27950

A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id parameter to mesdocs.ajax.php in azurWebEngine/eShop. By default, the query is executed as DBA...

Workreap < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

The theme's AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were...