PT-2022-18891 · WordPress · Metaslider

Name of the Vulnerable Software and Affected Versions: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin versions prior to 3.27.9 Description: The issue concerns the lack of sanitization and escaping of certain Gallery Image parameters, which could allow high-privilege users, such ...

DLA-3141-1 wordpress - security update

Bulletin has no description...

CVE-2022-3119 OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...

CVE-2022-1755 SVG Support < 2.5 - Author+ Stored Cross-Site Scripting

The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in SEO Redirection plugin = 8.9 at WordPress, leading to deletion of 404 errors and redirection history...

PT-2022-23317 · WordPress · Mailoptin

Name of the Vulnerable Software and Affected Versions: MailOptin plugin versions 1.2.49.0 and earlier Description: The issue concerns an Unauthenticated Optin Campaign Cache Deletion vulnerability. This vulnerability affects the MailOptin plugin at WordPress, allowing for unauthenticated cache...

reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed. PoC POST /wp-admin/options.php HTTP/1.1 Accept:...

Download Monitor < 4.5.98 - Admin+ Arbitrary File Download

The plugin does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup. PoC Create a new download on:...

PT-2022-19415 · WordPress · Craw Data Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Craw Data WordPress plugin versions through 1.0.0 Description: The issue is related to the lack of nonce checks in the Craw Data WordPress plugin, which could allow attackers to make a logged-in admin change the url value, performing unwanted...

WordPress 4.3.x < 4.3.29 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 5.4.x < 5.4.11 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 5.8.x < 5.8.5 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 4.5.x < 4.5.27 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

CVE-2022-34656 WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Cross-Site Scripting XSS vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin = 1.7.4 at WordPress...

CVE-2022-2034

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers...

PT-2022-15878 · WordPress · Vr Calendar

Name of the Vulnerable Software and Affected Versions: VR Calendar WordPress plugin versions prior to 2.3.3 Description: The issue allows any user to execute arbitrary PHP functions on the site. This can lead to unauthorized access and potential code execution. Recommendations: For versions prior...

PT-2022-21738 · WordPress · Mailerlite – Signup Forms Plugin

Name of the Vulnerable Software and Affected Versions: MailerLite – Signup forms plugin versions 1.5.7 and earlier Description: A Cross-Site Request Forgery CSRF issue allows an attacker to change the API key. This can be exploited by an attacker to make unauthorized changes. Recommendations: For...

PT-2022-17536 · WordPress · Transposh Wordpress Translation Plugin

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions 1.0.8 and earlier Description: The issue arises from the plugin's failure to properly sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL...

EUVD-2022-36938

Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin = 4.13.1 at WordPress...

Discy < 5.0 - Subscriber+ Broken Access Control to change settings

The theme lacks authorization checks then processing ajax requests to the discyupdateoptions action, allowing any logged in users with privileges as low as Subscriber, to change the theme options by sending a crafted POST request. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type:...