Icegram Express < 5.5.1 - Subscriber+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber PoC Open the below URL when logged in as a subscriber and notice the 5s delay...

Car Dealer < 3.05 - Subscriber+ Arbitrary Plugin Installation

The plugin does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Run the below command in the developer console of the web browser while being on the blog as a...

Icegram Express < 5.5.1 - Subscriber+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber Open the below URL when logged in as a subscriber and notice the 5s delay...

Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks PoC add new payment method with XSS exploit: fetch'http://localhost/tester-wp/wp-admin/admin-ajax.php', method: 'POST', headers: ne...

Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion

The plugin does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods. PoC wpajaxshopoptionsajax hook calls shopoptionsajax function without nonce and without access control update shipping method name 0 shipping method id...

AntiHacker < 4.20 - Subscriber+ Arbitrary Plugin Installation

The plugin does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org PoC Run the below command in the developer console of the web browser while being on the blog as ...

WP Memory < 2.46 - Subscriber+ Arbitrary Plugin Installation

The plugin does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Run the below command in the developer console of the web browser while being on the blog as a...

Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion

The plugin does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods. wpajaxshopoptionsajax hook calls shopoptionsajax function without nonce and without access control update shipping method name 0 shipping method id exploit...

CVE-2022-41609

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-45369

Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...

CVE-2022-41788

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...

CVE-2022-41655

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

CVE-2022-40130

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-40216

Auth. subscriber+ Messaging Block Bypass vulnerability in Better Messages plugin = 1.9.10.69 on WordPress...

CVE-2022-40130

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

Cross site scripting

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

Cross site scripting

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...

CVE-2022-40216

CVE-2022-40216 affects the WordPress Better Messages plugin. Affected versions are

CVE-2022-40130

The CVE-2022-40130 entry documents a race-condition vulnerability in the WordPress WP-Polls plugin, affecting versions up to and including 2.76.0. The issue allows authenticated users (subscriber+ level) to tamper with poll votes due to improper synchronization. Remediation according to the sourc...

CVE-2022-41655

CVE-2022-41655 affects the WordPress plugin Phone Orders for WooCommerce (versions ≤ 3.7.1). The root issue is a sensitive data exposure that is accessible to authenticated users with subscriber-level privileges (and higher). Documented impact is exposure of Auth. (subscriber+) data. The vulnerab...