CVE-2022-29445

CVE-2022-29445 affects the WordPress Popup Box plugin (versions ≤ 2.1.2). The issue is an Authenticated Local File Inclusion (LFI) vulnerability that arises because the plugin (likely in the include path logic) does not properly validate the current tab before including a file, enabling an admini...

CVE-2022-29445: Use of Incorrectly-Resolved Name or Reference

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Popup Box plugin = 2.1.2 at WordPress...

PT-2022-19619

Name of the Vulnerable Software and Affected Versions Wow-Company's Popup Box plugin versions = 2.1.2 Description The issue is related to an Authenticated Local File Inclusion LFI vulnerability. This means that an attacker with administrator or higher role privileges can potentially include and...

CVE-2022-29445

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Popup Box plugin = 2.1.2 at WordPress...

CVE-2022-29446

Authenticated administrator or higher role Local File Inclusion LFI vulnerability in Wow-Company's Counter Box plugin = 1.1.1 at WordPress...

CVE-2021-25064

The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection...

CVE-2021-25064

The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection...

CVE-2021-25064

Consolidated details for CVE-2021-25064 show: affected product is the WordPress Wow Countdowns plugin up to version 3.1.2. The root cause is improper sanitization of the did parameter, which is directly used in a SQL statement, resulting in an authenticated SQL Injection. Exploitation evidence ap...

PT-2022-9620

Name of the Vulnerable Software and Affected Versions Wow Countdowns WordPress plugin versions prior to 3.1.3 Description The issue arises from the lack of sanitization of user input into the did parameter, which is then used in a SQL statement. This leads to an authenticated SQL Injection...

WordPress plugin Wow Countdowns SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Wow Countdowns plugin version 3.1.2 later has a SQL injection vulnerability, which stems from the plugin using the user The...

CVE-2021-25064: Improper Neutralization of Special Elements used in an SQL Command

The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection...

Wow Countdowns <= 3.1.2 - Admin+ SQLi

The plugin does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection. PoC https://example.com/wp-admin/admin.php?page=mwp-countdown=del=1+AND+SELECT+5382+FROM+SELECTSLEEP5PpNt...

WordPress Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin < 1.4.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin versions 1.4.2. Solution Update the WordPress Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin to the...

CVE-2021-25052

The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

CVE-2021-25053

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

CVE-2021-25052

The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

CVE-2021-25051

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

CVE-2021-25053: Cross-Site Request Forgery (CSRF)

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

PT-2022-9608

Name of the Vulnerable Software and Affected Versions The Button Generator WordPress plugin versions prior to 2.3.3 Description The issue allows for the inclusion of arbitrary files with PHP extension, as well as files using the data:// or http:// protocols, within the wow-company admin menu page...

PT-2022-9609

Name of the Vulnerable Software and Affected Versions WP Coder WordPress plugin versions prior to 2.5.2 Description The issue allows for the inclusion of arbitrary files with PHP extension, as well as files using data:// or http:// protocols, within the wow-company admin menu page. This can lead ...