WP iCal Availability <= 1.0.3 - Missing Authorization

Description The WP iCal Availability plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on one of its functions in versions up to, and including, 1.0.3. This makes it possible for authenticated attackers, with subscriber-level access and abov...

Wp photo text slider 50 < 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Information Reel < 10.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

TelSender <= 1.14.8 - Missing Authorization

Description The TelSender plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tscfwcformajaxreqest function hooked via an AJAX action in versions up to, and including, 1.14.8. This makes it possible for authenticated attackers, with...

Vertical marquee plugin < 7.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings

Description The Dragfy Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level...

AI ChatBot < 4.9.1 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

Description The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcldopenaiuploadpagetrainingfile function. This allows subscriber-level attackers to append "...

Up down image slideshow gallery < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

10Web Map Builder for Google Maps < 1.0.74 - Missing Authorization to Notice Dismissal

Description The 10Web Map Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gmwdbpinstallnoticestatus function in versions up to, and including, 1.0.73. This makes it possible for authenticated attackers, with subscriber-level...

Nexter < 2.0.4 - Authenticated (Subscriber+) SQL Injection via 'to' and 'from'

Description The Nexter theme for WordPress is vulnerable to SQL Injection via the 'to' and 'from' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameter and lack of valid preparation on the existing SQL query. This makes it possible for...

Copy Or Move Comments <= 5.0.4 - Authenticated (Subscriber+) SQL Injection

Description The Copy Or Move Comments plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode

Description The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially...

Image vertical reel scroll slideshow < 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

WP Users Media <= 4.2.3 - Missing Authorization via wpusme_save_settings

Description The WP Users Media plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpusmesavesettings function in versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber-level permission...

Superb slideshow gallery < 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

UserPro < 5.1.5 - Authenticated (Subscriber+) Privilege Escalation

Description The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userproupdateuserprofile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber,...

WP EXtra < 6.3 - Missing Authorization to Export Settings

Description The WP EXtra plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to export plugin...

Jquery news ticker < 3.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

Themify Ultra < 7.3.6 - Authenticated (Subscriber+) PHP Object Injection

Description The themify-ultra theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.3.3 via deserialization of untrusted input. This makes it possible for authenticated attackers with subscriber access and above to inject a PHP Object. If a POP chain is...

Easy Social Icons < 3.2.5 - Missing Authorization via cnss_save_ajax_order

Description The Easy Social Icons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cnsssaveajaxorder function in versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with subscriber-level access a...