6468 matches found
Ultimate Appointment Booking & Scheduling < 1.1.10 - Authenticated Cross-Site Scripting (XSS)
The Ultimate Appointment Booking & Scheduling WordPress plugin, versions 1.1.9 and older, were vulnerable to Authenticated Cross-Site Scripting XSS within multiple parameters. PoC http://www.example.com/wp-admin/admin.php?page=EWD-UASP-options=EWDUASPAppointmentDetails=AppointmentID=1"...
PT-2020-18687 · WordPress · Srs Simple Hits Counter Plugin
Name of the Vulnerable Software and Affected Versions: SRS Simple Hits Counter Plugin for WordPress versions 1.0.3 through 1.0.4 Description: The issue is related to SQL Injection, where improper neutralization of special elements used in an SQL command allows a remote, unauthenticated attacker t...
M-Shield & kingof - Fake Malware Backdoor Plugins
Sucuri Labs found that the M-Shield & kingof fake WordPress plugins were used as malware droppers, with the initial compromise likely coming from another legitimate vulnerable WordPress plugin security vulnerability...
CVE-2019-12498
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...
Critical Bug in WordPress Theme Plugin Opens 200,000 Sites to Hackers
A popular WordPress theme plugin with over 200,000 active installations contains a severe but easy-to-exploit software vulnerability that, if left unpatched, could let unauthenticated remote attackers compromise a wide range of websites and blogs. The vulnerable plugin in question is 'ThemeGrill...
Remote code execution
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability...
Cross site scripting
The ultimate-weather plugin 1.0 for WordPress has XSS...
EUVD-2014-4488
The ultimate-weather plugin 1.0 for WordPress has XSS...
CVE-2019-19915
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users with subscriber or greater access to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=epsredirectsave and /admin-ajax.php?action=epsredirectdelete actions. This coul...
CVE-2015-9494
CVE-2015-9494 affects the WordPress plugin indieweb-post-kinds (versions prior to 1.3.1.1). It enables a DOM-based XSS via the genericons/example.html anchor identifier, allowing injected script to run in a victim’s browser when that anchor is processed. PoC demonstrates the vulnerability. Remedi...
WordPress ad-inserter plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. ad-inserter is an ad management plugin used in it. A cross-site request forgery vulnerability exists in WordPress ad-inserter plugin...
SyntaxHighlighter Evolved <= 3.5.0 - Stored Cross-Site Scripting (XSS)
The SyntaxHighlighter Evolved WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
CVE-2019-16521
The broken-link-checker plugin through 1.11.8 for WordPress aka Broken Link Checker is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS...
CVE-2015-9471
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload...
CVE-2015-9437
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...
CVE-2015-9430
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header...
EUVD-2015-9255
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
Directory traversal
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal...