WordPress sitepress-multilingual-cms 3.6.3 - Cross-Site Scripting Detection

WordPress plugin sitepress-multilingual-cms 3.6.3 is vulnerable to cross-site scripting in processforms via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin...

WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting Detection

WordPress Car Repair Services & Auto Mechanic before 4.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the serviceestimatekey parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Car Repair Services & Auto...

WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting Detection

WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ctcommunity parameter in its search listing page before outputting it back. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pro Real Estate 7 theme befo...

Newspaper Theme 6.4–6.7.1 - Privilege Escalation Detection

Newspaper Theme versions 6.4 to 6.7.1 for WordPress lacked proper options access control through tdajaxupdatepanel, which led to a Privilege Escalation vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Newspaper Theme versions 6.""" from kittysploit import from...

WordPress 15Zine <3.3.0 - Cross-Site Scripting Detection

WordPress 15Zine before 3.3.0 is vulnerable to reflected cross-site scripting because the theme does not sanitize the cbi parameter before including it in the HTTP response via the cbsa AJAX action. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress 15Zine before 3.""" from kittysploit import...

WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting Detection

WordPress Goto Tour & Travel theme before 2.0 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize the keywords and startdate GET parameters on its Tour List page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Goto Tour & Travel theme before 2.""...

WordPress Jannah Theme <5.4.4 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme...

WordPress Twenty Nineteen - Full Path Disclosure Detection

The WordPress Twentytwenty themes was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Twentytwenty themes was detected to be vulnerable to Full Path Disclosure, allowing...

WordPress OceanWP - Full Path Disclosure Detection

WordPress OceanWP theme is vulnerable to full path disclosure via direct access to theme files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress OceanWP theme is vulnerable to full path disclosure via direct access to theme files.""" from kittysploit import from lib.protocols.http.httpclien...

WordPress Storefront Theme - Full Path Disclosure Detection

The Storefront theme for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Storefront theme...

WordPress Ambience Theme <=1.0 - Cross-Site Scripting Detection

WordPress Ambience Theme 1.0 and earlier was affected by a cross-site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ambience Theme 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress Bricks Builder Theme Version Detection

Checks for Bricks Builder Theme versions. !/usr/bin/env python3 -- coding: utf-8 -- """- Checks for Bricks Builder Theme versions.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Bricks Builder...

Mega Wordpress Theme - Cross site scripting Detection

WordPress theme with a 'Mega-Theme' design is vulnerable to a reflected XSS attack through the '?s=' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress theme with a 'Mega-Theme' design is vulnerable to a reflected XSS attack through the '?s=' parameter.""" from kittysploit import...

WordPress Javo Spot Premium Theme - Unauthenticated Directory Traversal Detection

WordPress Javo Spot Premium Theme wp-config was discovered via local file inclusion. This file is remotely accessible and its content available for reading. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Javo Spot Premium Theme wp-config was discovered via local file inclusion.""" from...

WordPress Oxygen-Theme - Local File Inclusion Detection

WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.""" from kittysploit import from...

WordPress Twenty Twenty Theme - Full Path Disclosure Detection

WordPress theme twentytwenty internal file system path of a WordPress installation is exposed or disclosed to unauthorized users. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress theme twentytwenty internal file system path of a WordPress installation is exposed or disclosed to .""" from...

WordPress ProStore <1.1.3 - Open Redirect Detection

WordPress ProStore theme before 1.1.3 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress ProStore theme...

WordPress Twenty Fifteen Theme - Full Path Disclosure Detection

WordPress theme twentyfifteen internal file system path of a WordPress installation is exposed or disclosed to unauthorized users. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress theme twentyfifteen internal file system path of a WordPress installation is exposed or disclosed to.""" from...

WordPress Javo Spot Premium Theme - Local File Inclusion Detection

WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that allows remote unauthenticated attackers access to locally stored file and return their content. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Javo Spot Premium Theme is vulnerable to local file inclusion that...

Reality Estate Multipurpose WP-Theme < 2.5.3 - Cross-Site Scripting Detection

Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...