733 matches found
Wordpress Responsive Cookie Consent v1.5 / v1.6 / v1.7 - Authenticated Persistent Cross-Site Scripti
Exploit for php platform in category web applications Exploit Title: Wordpress Responsive Cookie Consent v1.5 / v1.6 / v1.7 - Authenticated Persistent Cross-Site Scripting Exploit Author: B0UG Vendor Homepage: http://www.jameskoussertari.co.uk/ Software Link:...
WordPress UK Cookie Consent 2.3.9 Cross Site Scripting
Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting Date: 2018-04-22 Exploit Author: B0UG Vendor Homepage: https://catapultthemes.com/ Software Link: https://en-gb.wordpress.org/plugins/uk-cookie-consent/description Version: Tested on version 2.3.9 older versions may also be...
WordPress Update Breaks Automatic Update Feature—Apply Manual Update
WordPress administrators are once again in trouble. WordPress version 4.9.3 was released earlier this week with patches for a total 34 vulnerabilities, but unfortunately, the new version broke the automatic update mechanism for millions of WordPress websites. WordPress team has now issued a new...
WordPress WP No External Links plugin <=4.3 - Backdoored
Backdoor code found by WordFence in WordPress WP No External Links plugin versions =4.3. Solution This plugin has been closed for new installs. Deactivate and delete the plugin...
WordPress No Follow All External Links plugin <=2.3.0 - Backdoored
Backdoor code found by WordFence in WordPress No Follow All External Links plugin versions =2.3.0. Solution This plugin was closed on 2017 December 19 and is no longer available for download on WordPress plugin repository. Deactivate and delete the plugin...
WordPress Duplicate Page and Post plugin <=2.1.1 - Backdoored
Backdoor code found by WordFence team in WordPress Duplicate Page and Post plugin versions =2.1.1. Solution This plugin was closed on 2017 December 14 and is no longer available for download on WordPress plugin repository. Deactivate and delete the plugin...
WordPress Captcha plugin <=4.4.4 - Backdoored
Backdoor found by WordFence team in WordPress Captcha plugin versions 4.3.6–4.4.4. Solution WordPress plugin repository team patched the plugin, but you need to decide on your own to use this plugin further or not...
Hidden Backdoor Found In WordPress Captcha Plugin Affects Over 300,000 Sites
Buying popular plugins with a large user-base and using it for effortless malicious campaigns have become a new trend for bad actors. One such incident happened recently when the renowned developer BestWebSoft sold a popular Captcha WordPress plugin to an undisclosed buyer, who then modified the...
WordPress UserPro 4.6.17 Authentication Bypass
Exploit Title: Userpro a WordPress Plugin a Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?srank=9...
WordPress Userpro Plugin < 4.9.17.1 - Authentication Bypass Vulnerability
Exploit for php platform in category web applications Exploit Title: Userpro – WordPress Plugin – Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage:...
Contact Form for WordPress – Ultimate Form Builder Lite plugin <=1.3.6 - SQL Injection (SQLi) vulnerability
SQL Injection vulnerability found by WordFence Security Team in Contact Form for WordPress – Ultimate Form Builder Lite plugin. Solution Update the Contact Form for WordPress – Ultimate Form Builder Lite plugin to the latest available version at least 1.3.7...
WordPress Appointments plugin <=2.2.1 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability found by Matt Barry WordFence in WordPress Appointments plugin versions =2.2.1. Solution Update the WordPress Appointments plugin to the latest available version at least 2.2.2...
WordPress Flickr Gallery plugin <=1.5.2 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability found by Matt Barry WordFence in WordPress Appointments plugin versions =1.5.2. Solution Update the WordPress Flickr Gallery plugin to the latest available version at least 1.5.3...
Rogue Wordpress Plugin Allowed Spam Injection
A popular WordPress plugin called Display Widgets running on 200,000 sites was removed from the official WordPress.org plugin repository after researchers discovered the plugin had a backdoor that was injecting spam ads into victims’ sites. According to researchers at Wordfence who publicly...
WordPress Plugin DZS Videogallery 8.60 - Multiple Vulnerabilities
WordPress Plugin DZS Videogallery 8.60 - Multiple Vulnerabilities Exploit Title: Wordpress DZS Videogallery Plugin - Multiple Vulnerabilities --------------------------------------- Unauthenticated CSRF & XSS POC:...
WordPress Wordfence Plugin <= 5.1.4 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.3 - Bypass
This plugin is prone to banned IP functionality bypass vulnerability. Unlogged requests won't trigger automatic throttling and banning. Solution Update plugin...
WordPress Wordfence Plugin <= 5.2.4 - Stored XSS
This plugin is prone to IPTraf.php URI request stored cross site scripting vulnerability. Solution Update plugin...