WordPress WP Simple Booking Calendar Premium plugin <= 6.0-6.1 - Unauthenticated Data leak

When you know the URL which the plugin uses to export iCal feed, then you can see the availability and booking notes via that feed. Solution Update the plugin to 6.2...

WordPress WP Simple Booking Calendar Premium plugin 5.0–5.4 <= Unauthenticated Data leak

The booking notes are shown in the source code of the page. Solution Update the plugin to 5.5 version...

WordPress FormCraft 3 premium plugin <=3.2.31 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found by 8bitsec in WordPress FormCraft 3 premium plugin alternative name - FormCraft Premium WordPress Form Builder. Solution 2017.07.29 - we were unable to find any information about patched version of WordPress FormCraft 3 premium...

WordPress Task Manager Pro plugin <=1.3.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on...

WordPress Plugin Slider Templatic Tevolution 2.3.6 - Arbitrary File Upload

WordPress Plugin Slider Templatic Tevolution 2.3.6 - Arbitrary File Upload Exploit Title: WordPress Templatic = 2.3.6 Tevolution File Upload Vulnerability Date: 30-12-2016 Software Link: Permium plugin Vendor Homepage: https://templatic.com/wordpress-plugins/tevolution Exploit Author: r3m1ck...

CVE-2016-1180

The CVE-2016-1180 issue concerns the Cyber-Will EC-CUBE Social-button Premium plugin. A cross-site scripting (XSS) vulnerability exists in the Social-button Premium plugin before version 1.1 for EC-CUBE 2.13.x, allowing remote attackers to inject arbitrary web script or HTML via unspecified vecto...

WordPress Ajax Store Locator 1.2 SQL Injection Vulnerability

WordPress Ajax Store Locator versions 1.2 and below suffer from a remote SQL injection vulnerability. Exploit Title : Wordpress Ajax Store Locator = 5.0.12 AND time-based blind SE...

WordPress Plugin Slider REvolution 4.1.4 - Arbitrary File Download

WordPress Plugin Slider REvolution 4.1.4 - Arbitrary File Download Exploit Title : WordPress Slider Revolution Responsive = 4.1.4 Arbitrary File Download vulnerability Exploit Author : Claudio Viviani Vendor Homepage : http://codecanyon.net/item/slider-revolution-responsive-wordpress-plugin/27513...