Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)

Description The theme does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability. Due to a nonce check, this issue is only exploitable on unauthenticated users for as long as the nonce used in the reques...

Advanced Menu Manager <= 3.0 - Unauthorised Menu Creation/Deletion

The plugin is lacking any capability and CSRF checks in its myactiondeletemenu and myactioncreatemenuajax AJAX actions, allowing any authenticated users such as subscriber to call them. Such attack could also be performed via a CSRF vector against any logged in user. PoC - To delete a menu: POST...

WOWRestro < 1.1 - CSRF Bypass

The plugin does not properly check for CSRF in numerous of its AJAX actions, allowing attacker to make logged in users call them and perform unwanted actions, such as add/remove an item from their basket and empty it as well. PoC To empty a user basket:...

Frontend File Manager < 18.3 - Authenticated Arbitrary Settings Change to Arbitrary File Upload

The wpfmsavesettings AJAX action of the plugin, available to any authenticated user, was lacking CSRF and capability check, allowing any authenticated user to change the settings, and add PHP to the allowed filetype to be uploaded, which would then allow them to upload a malicious PHP file via th...

Frontend File Manager < 18.3 - Unauthenticated Content Injection and Stored XSS

The wpfmeditfiletitledesc AJAX action of the plugin, available to unauthenticated users, did not check if users were editing their own post and was lacking a CSRF nonce as well. This could allow an unauthenticated user to update any post/page. Furthermore, by editing a post with the 'wpfm-files'...

WordPress WP Fluent Forms plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.A cross-site request forgery vulnerability exists in versions of WordPress WP Fluent Forms plugin prior ...

CVE-2021-34620

The WP Fluent Forms plugin 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions...

Cross site scripting

The WP Fluent Forms plugin 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions...

CVE-2021-34620 CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

The WP Fluent Forms plugin 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions...

CVE-2021-34620 CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation

The WP Fluent Forms plugin 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions...

WordPress Motor theme license issue vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . An authorization issue vulnerability exists in WordPress...

CVE-2021-24407

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24407

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

CVE-2021-24384

The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...

CVE-2021-24375

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

Cross site scripting

The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...

Authentication flaw

Lack of authentication or validation in motorloadmore, motorgalleryloadmore, motorquickview and motorprojectquickview AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php script...

CVE-2021-24407

The CVE CVE-2021-24407 affects the WordPress Jannah theme prior to 5.4.5. The vulnerability is a Reflected Cross-Site Scripting (XSS) due to improper sanitization of the 'query' parameter in the tie_ajax_search AJAX action. Multiple connected sources corroborate this: XSS via POST parameter in ti...

CVE-2021-24384 JoomSport < 5.1.8 - Unauthenticated PHP Object Injection

The joomsportmdload AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget...

CVE-2021-24384

CVE-2021-24384 affects the JoomSport WordPress plugin prior to 5.1.8. The vulnerability is a PHP object injection in the joomsport_md_load AJAX action, which unserialises input from the shattr POST parameter. It is accessible to unauthenticated users, and while the plugin itself lacks a gadget ch...