707 matches found
WordPress Captcha plugin <=4.4.4 - Backdoored
Backdoor found by WordFence team in WordPress Captcha plugin versions 4.3.6–4.4.4. Solution WordPress plugin repository team patched the plugin, but you need to decide on your own to use this plugin further or not...
Hidden Backdoor Found In WordPress Captcha Plugin Affects Over 300,000 Sites
Buying popular plugins with a large user-base and using it for effortless malicious campaigns have become a new trend for bad actors. One such incident happened recently when the renowned developer BestWebSoft sold a popular Captcha WordPress plugin to an undisclosed buyer, who then modified the...
WordPress UserPro 4.6.17 Authentication Bypass
Exploit Title: Userpro a WordPress Plugin a Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?srank=9...
WordPress Userpro Plugin < 4.9.17.1 - Authentication Bypass Vulnerability
Exploit for php platform in category web applications Exploit Title: Userpro – WordPress Plugin – Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage:...
Contact Form for WordPress – Ultimate Form Builder Lite plugin <=1.3.6 - SQL Injection (SQLi) vulnerability
SQL Injection vulnerability found by WordFence Security Team in Contact Form for WordPress – Ultimate Form Builder Lite plugin. Solution Update the Contact Form for WordPress – Ultimate Form Builder Lite plugin to the latest available version at least 1.3.7...
WordPress Appointments plugin <=2.2.1 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability found by Matt Barry WordFence in WordPress Appointments plugin versions =2.2.1. Solution Update the WordPress Appointments plugin to the latest available version at least 2.2.2...
WordPress Flickr Gallery plugin <=1.5.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability found by Matt Barry WordFence in WordPress Appointments plugin versions =1.5.2. Solution Update the WordPress Flickr Gallery plugin to the latest available version at least 1.5.3...
Rogue Wordpress Plugin Allowed Spam Injection
A popular WordPress plugin called Display Widgets running on 200,000 sites was removed from the official WordPress.org plugin repository after researchers discovered the plugin had a backdoor that was injecting spam ads into victims’ sites. According to researchers at Wordfence who publicly...
WordPress Plugin DZS Videogallery 8.60 - Multiple Vulnerabilities
WordPress Plugin DZS Videogallery 8.60 - Multiple Vulnerabilities Exploit Title: Wordpress DZS Videogallery Plugin - Multiple Vulnerabilities --------------------------------------- Unauthenticated CSRF & XSS POC:...
WordPress Wordfence Plugin <= 5.1.4 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.3 - Bypass
This plugin is prone to banned IP functionality bypass vulnerability. Unlogged requests won't trigger automatic throttling and banning. Solution Update plugin...
WordPress Wordfence Plugin <= 3.8.1 - Bypass
This plugin is prone to a password creation restriction bypass vulnerability. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.4 - Stored XSS
This plugin is prone to IPTraf.php URI request stored cross site scripting vulnerability. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.4 - Unspecified Vulnerability
This plugin is prone to an unspecified issue. Solution Update plugin...
WordPress Wordfence Plugin <= 3.8.1 - Stored XSS
This plugin is prone to wp-admin/admin.php whois parameter stored cross site scripting vulnerability. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.2 - Cross Site Scripting
This plugin is prone to cross site scripting in referer header. Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Wordfence Plugin <= 3.8.6 - Stored XSS
This plugin is prone to lib/IPTraf.php User-Agent header stored cross site scripting vulnerability. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.3 - Multiple Vulnerabilities
This plugin is prone to stored XSS, insufficient logging, throttle bypass and exploit detection bypass vulnerabilities. Solution Update plugin...
