mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

WordPress WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents plugin <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WSP MCP AI Agents Connector versions = 2.9.5...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin HivePress versions = 1.7.32...

WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin WP EasyPay versions = 4.5.4...

WordPress Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by nudien, nudien in WordPress Plugin Tourfic versions = 3.0.1...

WordPress Hide My WP Ghost – Security & Firewall plugin <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Hide My WP Ghost versions = 7.0.12...

WordPress Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin Salon booking system versions = 10.31.9...

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin Profile Builder versions = 4.0.3...

WordPress WebberZone Top 10 — Popular Posts plugin <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Top 10 versions = 4.5.2...

WordPress Search Regex plugin <= 3.5 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by R3D in WordPress Plugin Search Regex versions = 3.5...

WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter vulnerability

Unauthenticated Privilege Escalation to 'role' Parameter vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Profile Builder versions = 4.0.3...

WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MDTF versions = 1.4.0...

WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by Peter Tang in WordPress Plugin Booking and Rental Manager versions = 2.8.0...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by ssophiz in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.7 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin ELEX WordPress HelpDesk & Customer Ticketing System versions = 3.3.7...

WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dzaku in WordPress Plugin AI Engine versions = 3.8.3...

WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WordLift versions = 3.54.15...

WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetSmartFilters versions = 3.8.6...

WordPress WP Booking System plugin <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Booking System versions = 2.1.0.1...