WordPress Ninja Forms 2.9.51 Cross Site Scripting

------------------------------------------------------------------------ Multiple Cross-Site Scripting vulnerabilities in Ninja Forms WordPress Plugin ------------------------------------------------------------------------ Han Sahin, July 2016...

WordPress Ultimate Membership Pro 3.3 Plugin - SQL Injection

Exploit for php platform in category web applications Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass...

WordPress NEX-Forms Lite Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . NEX-Forms Lite is one of the user-defined plugin to create forms . A cross-site scripting vulnerability exists in...

jeugdlimburg.be XSS vulnerability

Vulnerable URL: http://jeugdlimburg.be/wp-admin/admin-ajax.php?action=search=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FXSSPOSED%2F%29%3E=11f3c046f5 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Ale...

WP Fastest Cache <= 0.8.4.8 - Blind SQL Injection

According to the researcher, for this vulnerability to be present WP-Polls plugin also needs to be installed...

Floating Social Bar 1.1.5 XSS

Everyone can access saveorder. File: floating-social-bar\class-floating-social-bar.php addaction 'wpajaxfsbsaveorder', array $this, 'saveorder' ; addaction 'wpajaxnoprivfsbsaveorder', array $this, 'saveorder' ; $REQUEST'items' is not escaped. File: floating-social-bar\class-floating-social-bar.ph...

hotelheavenkolkata.com XSS vulnerability

Vulnerable URL: http://hotelheavenkolkata.com/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21086238 Google Pageran...

bellevuewinespirits.com XSS vulnerability

Open Bug Bounty ID: OBB-83569 Description| Value ---|--- Affected Website:| bellevuewinespirits.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

rotaryleiderdorp.nl XSS vulnerability

Open Bug Bounty ID: OBB-83550 Description| Value ---|--- Affected Website:| rotaryleiderdorp.nl Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

turevosgb.com.tr XSS vulnerability

Open Bug Bounty ID: OBB-83482 Description| Value ---|--- Affected Website:| turevosgb.com.tr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

WordPress Plugin BuddyPress Activity Plus 'admin-ajax' Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin BuddyPress Activity Plus 'admin-ajax'. An attacker...

WordPress Easy2Map plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site. easy2Map is one of the plug-ins to support the creation of customized Google maps . WordPress Easy2Map plugin...

CVE-2015-4153

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

CVE-2014-8606

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

WordPress Users Ultra Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed in the PHP language that supports personal blog sites on servers running PHP and MySQL.Users Ultra is a plugin for creating user communities. The WordPress Users Ultra ratings module wp-admin/admin-ajax.php script fails to adequately filter the...

WordPress Plugin Free Counter Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Free Counter is one of the counting and statistics plugin. A cross-site scripting vulnerability exists in version 1...

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...

WordPress Plugin Ajax Store Locator 1.2 - SQL Injection

WordPress Plugin Ajax Store Locator 1.2 - SQL Injection Exploit Title : Wordpress Ajax Store Locator = 5.0.12 AND time-based blind SELECT' injectable for the remaining tests, do you want to include all tests for 'MySQ...

WordPress Plugin Shareaholic 7.6.0.3 - Cross-Site Scripting

Exploit Title: Shareaholic 7.6.0.3 XSS Date: 10-11-2014 Software Link: https://wordpress.org/plugins/shareaholic/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ CVE: CVE-2014-9311 Category: webapps 1. Description...

QAEngine Theme - Privilege Escalation

QAEngine vulnerability allows an attacker to have an administrator account on the target's website. PoC http://www.example.com/wp-admin/admin-ajax.php?action=ae-sync-user=createlogin=xADMINpass=xPASS=administrator...