Journey Analytics < 1.0.13 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in some of its function, allowing attacker to make users do unwanted actions...

Cognitive Content Analyzer < 2.3 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its blobinatoranalyze AJAX action, allowing attacker to make a logged in administrator call the blobinatorprocesstext method with arbitrary parameters and update the related post with the results. PoC POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1...

Intimate Payments <= 1.3.1 - CSRF Bypass

The plugin does not properly check for CSRF in its handleselectcurrency and handleupdatetrx AJAX actions, allowing attacker to make logged in admin call them them via CSRF attacks...

ReviewX < 1.2.9 - Unauthorised AJAX call via CSRF

Some of the plugin AJAX actions did not properly check for CRSF nonce, allowing attacker to make users call them and perform unwanted actions...

Woocommerce Tabs Plugin, Add Custom Product Tabs <= 1.0.1 - Arbitrary Tab Deletion/Edition via CSRF

The plugin does not properly check for CSRF in its tabsession, tabsessiondel, tabsessionedit and ptabsubmit AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a tab:...

Cognitive Content Analyzer < 2.3 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its blobinatoranalyze AJAX action, allowing attacker to make a logged in administrator call the blobinatorprocesstext method with arbitrary parameters and update the related post with the results. POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accep...

Global Multisite Search <= 1.0.1 - CSRF Bypass

The plugin does not properly check for CSRF in its wpgmsajaxresultfunction AJAX action, allowing attacker to make logged in user call them it a CSRF attack...

WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF

The plugin does not properly check for CSRF in its delfield and savealldata AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a field from the Registration Form: To change the whole Registration Form:...

MZ MBO Access < 2.0.9 - Unauthorised AJAX call

The plugin did not properly check for CSRF in some of its AJAX action, allowing attackers to make users unwanted actions...

MailOptin < 1.2.35.2 - Unauthorised AJAX Call

The fetchcustomfields and fetchtags function did not have proper CSRF check and authorisation, allowing unauthorised users to call the related AJAX action via either low privilege account or CSRF attack PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.0...

Alkubot < 3.0.0 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its successfulBargain AJAX action, allowing attacker to make users place arbitrary product in their cart...

YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

Strong Testimonials < 2.51.3 - Unauthorised AJAX Call

The plugin did not propely check for CSRF and authorisation in all the wpmtstaddfieldfunction functions, allowing unauthorised call of the associated AJAX actions either via low privilege users or CSRF attack https://example.com/wp-admin/admin-ajax.php?action=wpmtstgetcatcount...

WordPress KONTXT Content Advisor plugin <= 2.1 - Unauthorized AJAX call via Cross-Site Request Forgery (CSRF) vulnerability

Unauthorized AJAX call via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress KONTXT Content Advisor plugin versions = 2.1. Solution Update the WordPress KONTXT Content Advisor plugin to the latest available version at least 2.3...

YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

MZ Mindbody API < 2.8.3 - Unauthorised AJAX Calls

The plugin did not properly check for CSRF and authorisation in various AJAX actions, allowing attacker to make users call them and perform unwanted actions, as well as allow low privilege users to call them PoC As a low privilege user such as subscriber...

MailOptin < 1.2.35.2 - Unauthorised AJAX Call

The fetchcustomfields and fetchtags function did not have proper CSRF check and authorisation, allowing unauthorised users to call the related AJAX action via either low privilege account or CSRF attack POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL Injection

The hndtstactioninstancecallback AJAX call of the plugin, available to any authenticated users, does not sanitise, validate or escape the hndtstpreviewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue. PoC curl -i -s -k -X $'POST' \ -H...

Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS)

The plugin does not sanitize the id parameter of its awesomeweatherrefresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting XSS Vulnerability. Note WPScanTeam: The issue was reported to the WP plugins team on May 4th, 2021, then June 7th, 2021 due to lack of update. PoC...

Enhancesoft osTicket 跨站脚本漏洞

osTicket is a widely used and trusted open source work order support ticket system. A cross-site scripting vulnerability exists in osTicket versions prior to 1.12.6. An attacker can exploit this vulnerability via the queue-name parameter in include/ajax.search.php...