CVE-2023-0333

The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WP Spell Check < 9.13 - Admin+ Stored Cross-Site Scripting

The plugin does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Add a word to ignore via...

CVE-2022-40130

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-3149

The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor...

VulnCheck KEV: CVE-2022-1609

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site...

PT-2021-16253 · Catch Themes · Catch Infinite Scroll +12

Name of the Vulnerable Software and Affected Versions: Essential Widgets WordPress plugin versions prior to 1.9 To Top WordPress plugin versions prior to 2.3 Header Enhancement WordPress plugin versions prior to 1.5 Generate Child Theme WordPress plugin versions prior to 1.6 Essential Content Typ...

VulnCheck KEV: CVE-2019-14206

An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST'adaptive-images-settings' parameter in adaptive-images-script.php...

Word Press Sensitive Directory exposure &#40;SQL&#41;

Found By: r00tati Web App: Word Press Versions: unknown Level: low File Name: admin-functions.php //SQL EXAMPLE ERROR: Fatal error: Call to undefined function in /usr/local/www//data/wp-admin/admin-functions.php on line 1593 Thanks, r00t...