WordPress Role Based Pricing for WooCommerce premium plugin <= 1.6.1 - Auth. Arbitrary File Upload vulnerability

Auth. Arbitrary File Upload vulnerability discovered by WPScan in WordPress Role Based Pricing for WooCommerce premium plugin versions = 1.6.1. Solution Update the WordPress Role Based Pricing for WooCommerce plugin to the latest available version at least 1.6.2...

WordPress eCommerce Product Catalog plugin <= 3.0.71 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScan in WordPress eCommerce Product Catalog plugin versions = 3.0.71. Solution Update the WordPress eCommerce Product Catalog plugin to the latest available version at least 3.0.72...

WordPress Automatic User Roles Switcher premium plugin <= 1.1.1 - Auth. Privilege Escalation vulnerability

Auth. Privilege Escalation vulnerability discovered by WPScan in WordPress Automatic User Roles Switcher premium plugin versions = 1.1.1. Solution Update the WordPress Automatic User Roles Switcher plugin to the latest available version at least 1.1.2...

WordPress Titan Anti-spam & Security Plugin < 7.3.1 Block Bypass Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Frontend File Manager plugin <= 21.3 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by WPScan in WordPress Frontend File Manager plugin versions = 21.3 Solution Update the WordPress Frontend File Manager plugin to the latest available version at least 21.4...

WordPress Memberpress Downloads premium plugin <= 1.2.4 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WPScan in WordPress Memberpress Downloads premium plugin versions = 1.2.4. Solution No patched version available...

WordPress Booster for WooCommerce plugin <= 5.6.2 - Authenticated Order Status Update vulnerability

Authenticated Order Status Update vulnerability discovered by WPScan in WordPress Booster for WooCommerce plugin versions = 5.6.2. Solution Update the WordPress Booster for WooCommerce plugin to the latest available version at least 5.6.3...

WordPress WPtouch plugin <= 4.3.42 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScan in WordPress WPtouch plugin versions = 4.3.42. Solution Update the WordPress WPtouch plugin to the latest available version at least 4.3.44...

WordPress WPvivid Backup plugin 0.9.76 - Authenticated Arbitrary File Deletion vulnerability

Authenticated Arbitrary File Deletion vulnerability discovered by WPScan in WordPress WPvivid Backup plugin versions 0.9.76. Solution Update the WordPress WPvivid Backup and Migration plugin to the latest available version at least 0.9.77...

WordPress WP Hotel Booking plugin < 2.0.1 - Unauthenticated Arbitrary Settings Update vulnerability

Unauthenticated Arbitrary Settings Update vulnerability discovered by WPScan in WordPress WP Hotel Booking plugin versions 2.0.1. Solution Update the WordPress WP Hotel Booking plugin to the latest available version at least 2.0.1...

WordPress Affiliates Manager Plugin <= 2.9.13 - CSV Injection vulnerability

CSV Injection vulnerability discovered by WPScan in Affiliates Managers versions = 2.9.13 Solution Update the WordPress Affiliates Manager plugin to the latest available version at least 2.9.14...

WordPress Photo Gallery plugin <= 1.7.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScan in WordPress Photo Gallery plugin versions = 1.7.0. Solution Update the WordPress Photo Gallery by 10Web plugin to the latest available version at least 1.7.1...

WordPress Social Slider Feed plugin <= 2.0.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability via Feeds discovered by WPScan in WordPress Social Slider Feed plugin versions = 2.0.6. Solution Update the WordPress Social Slider Feed plugin to the latest available version at least 2.0.7...

WordPress Social Slider Feed plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability via Feeds discovered by WPScan in WordPress Social Slider Feed plugin versions = 2.0.4. Solution Update the WordPress Social Slider Feed plugin to the latest available version at least 2.0.5...

Transposh WordPress Translation 1.0.7 Cross Site Scripting Vulnerability (2)

Transposh WordPress Translation versions 1.0.7 and below have an ajax action "tptp" that is vulnerable to an unauthenticated/authenticated reflected cross site scripting vulnerability when user-supplied input to the HTTP GET parameter "q" is processed by the web application. Since the application...

WordPress Blog2Social Plugin <= 5.5.0 SQLi Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Transposh WordPress Translation 1.0.8.1 Remote Code Execution

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Reliance on File Name or Extension of Externally-Supplied File...

WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting Vulnerability

Tittle: WordPress Plugin Anti-Malware Security and Brute-Force Firewall HTTP/1.1 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzi...

WordPress Hummingbird Plugin < 3.3.2 - Stored Cross-Site Scripting Vulnerability

Tittle: WordPress Plugin Hummingbird Configs edit the "Name and Description" and put the following payload in the Name field: Save and Click 'Apply' to trigger the XSS Go to Hummingbird's Settings Configs and Upload the following config "id": 1, "name": "", "description": "Xss", "config":...

WordPress Ad Inserter Plugin < 2.7.12 - Cross Site Scripting Vulnerability

Tittle: WordPress Plugin Ad Inserter Classification Type XSS OWASP top 10 A7: Cross-Site Scripting XSS CWE-79 wpScan: https://wpscan.com/vulnerability/85582b4f-a40a-4394-9834-0c88c5dc57ba...