WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

Unauthenticated SQL injection SQLi vulnerability discovered by Dave Jong Patchstack in WordPress Hide My WP premium plugin versions = 6.2.3. Solution Update the WordPress Hide My WP premium plugin to the latest available version at least 6.2.4...

WordPress Hide My WP Ghost plugin <= 2.0.02 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by Jonas Lejon in the WordPress Hide My WP Ghost plugin versions = 2.0.02. Solution Update the WordPress Hide My WP Ghost plugin to the latest available version at least 2.0.03...

Hide My WP <= 2.0.02 - SQL Injection & Script Injection

Versions below 2.0.03 are vulnerable for SQL Injection and Script Injection. Fixed in version 2.0.03 released on 2018-09-15...

Hide My WP <= 4.53 - Stored-Cross Site Scripting (XSS)

An attacker can make a fake attack attempt which will be logged, and can inject JavaScript. curl --referer 'you are using bad filtering for input ript alert"XSS here" ript; :; ;' http://example.com...

WordPress Hide My WP Plugin <= 4.53 - Cross Site Scripting

This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...

Hide My WP <= 4.51.1 - Stored Cross-Site Scripting (XSS)

An attacker can make a fake attack attempt, with a JavaScripting payload, which will be logged by the plugin, resulting in XSS. The attacker also can spoof their IP address in the logs by setting the X-FORWARDED-FOR header. PoC curl --referer '...

WordPress Hide My WP Plugin <= 4.51.1 - Cross Site Scripting

This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...