5M WordPress Sites Running 'Contact Form 7' Plugin Open to Attack

A patch for the popular WordPress plugin called Contact Form 7 was released Thursday. It fixes a critical bug that allows an unauthenticated adversary to takeover a website running the plugin or possibly hijack the entire server hosting the site. The patch comes in the form of a 5.3.2 version...

WordPress Contact Form by WPForms plugin <= 1.5.8.2 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Jinson Varghese Behanan in WordPress Contact Form by WPForms plugin versions = 1.5.8.2. Solution Update the WordPress Contact Form by WPForms plugin to the latest available version at least 1.5.9...

Wordpress Strong Testimonials 2.40.1 Plugin - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Strong Testimonials 2.40.0 - Persistent Cross-Site Scripting Vendor Homepage: https://strongtestimonials.com Vendor Changelog: https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txt Exploit...

WordPress Strong Testimonials 2.40.1 Cross Site Scripting

Exploit Title: Wordpress Plugin Strong Testimonials 2.40.0 - Persistent Cross-Site Scripting Date: 2020-01-23 Vendor Homepage: https://strongtestimonials.com Vendor Changelog: https://github.com/MachoThemes/strong-testimonials/blob/master/changelog.txt Exploit Author: Jinson Varghese Behanan Auth...

WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting

Exploit Title: LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Date: 2020-01-14 Vendor Homepage: https://www.learndash.com Vendor Changelog: https://learndash.releasenotes.io/release/uCskc-version-312 Exploit Author: Jinson Varghese Behanan Author Advisory:...

LearnDash < 3.1.2 - Reflected Cross Site Scripting (XSS) issue on the [ld_profile] search field.

Reflected Cross Site Scripting XSS issue on the ldprofile search field. First reported to Learndash on January 14, 2020, and update 3.1.2 to fix it was released same day. This report is based on an email LearnDash sent out to their users on January 14, 2020. From the Original Researcher Jinson...

WordPress LearnDash LMS premium plugin <= 3.1.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jinson Varghese Behanan in WordPress LearnDash LMS premium plugin versions = 3.1.1.1. Solution Update the WordPress LearnDash LMS premium plugin to the latest available version at least 3.1.2...