CVE-2021-38345

The Brizy Page Builder plugin = 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

Brizy 1.0.127 - 2.3.11 - Incorrect Authorization to Post Modification

The Brizy - Page Builder plugin used the BrizyEditor::isadministrator and BrizyEditorUser:isadministrator functions for a wide variety of authorization checks, and any user that passed one of these checks was assumed to be an administrator, effectively bypassing almost all of the other capability...

Easy Accordion < 2.0.22 - Authenticated Stored XSS

The plugin does not properly sanitize inputs when adding new items to an accordion. When adding new items to an accordion, an injection payload of "" for an accordion item's title will result in XSS in the wp-admin page as well as on pages that show the accordion...

Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting

The plugin does not properly sanitize or escape inputs in the plugin's settings. PoC Open "Chained Quiz Social Sharing" in the WP admin panel. Under title field enter the payload : " Click on Save All Setting and the XSS will fire every time the Social Sharing page is loaded...

Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting

The plugin does not properly sanitize or escape inputs in the plugin's settings. Open "Chained Quiz Social Sharing" in the WP admin panel. Under title field enter the payload : "alertdocument.domain Click on Save All Setting and the XSS will fire every time the Social Sharing page is loaded...

PT-2021-16076

Name of the Vulnerable Software and Affected Versions Email Subscriber WordPress plugin versions 1.1 and earlier Description The kento email subscriber ajax AJAX action does not properly sanitise, validate, and escape the submitted subscribe email and subscribe name POST parameters. These...

CVE-2021-24522

CVE-2021-24522 affects ProfilePress (formerly WP User Avatar) for WordPress, before version 3.1.11. The tabbed login/register widget is vulnerable to unauthenticated reflected XSS due to improper escaping, with some cases enabling replication via $_GET because $_POST values were mapped to $_GET. ...

CVE-2021-24522: Improper Neutralization of Input During Web Page Generation

The User Registration, User Profile, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places...

uListing < 2.0.6 - Multiple CSRF

The plugin is lacking proper CSRF checks in multiple protected actions within wp-admin pages, leaving them vulnerable to CSRF attacks. PoC PoC | CSRF | Add/Edit Pricing Plans: POST /wp-admin/admin-ajax.php HTTP/2 Host: example.com Cookie: agent or admin cookies User-Agent: Mozilla/5.0 Content-Typ...

AceIDE <= 2.6.2 - Authenticated (admin+) Arbitrary File Access

The plugin does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory...

PT-2021-19252

Name of the Vulnerable Software and Affected Versions tagDiv Newspaper theme version 10.3.9.1 Description The issue allows for XSS via the td block id parameter in a td ajax block API call to the "wp-admin/admin-ajax.php" endpoint. This enables potential attackers to inject malicious scripts into...

CVE-2021-3135: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php tdblockid parameter in a tdajaxblock API call...

Async JavaScript < 2.21.06.29 - Authenticated (admin+) Stored XSS

The plugin does not validate or escape its Username and API Key from the Wizard tab of its settings, allowing high privilege users such as admin to set JavaScript payload in them, even when the unfilteredhtml capability is disallowed, leading to Stored Cross-Site Scripting issues Set the payload...

PT-2021-3638

Name of the Vulnerable Software and Affected Versions Instant Images – One Click Unsplash Uploads WordPress plugin versions prior to 4.4.0.1 Description The issue is related to the improper validation and sanitization of the unsplash download w and unsplash download h parameter settings in the...

PT-2021-3318

Name of the Vulnerable Software and Affected Versions DSGVO All in one for WP versions prior to 4.0 Description The issue is related to the failure to neutralize special elements, which can lead to cross-site scripting XSS attacks. An unauthenticated attacker can exploit this by submitting...

PT-2021-15760

Name of the Vulnerable Software and Affected Versions: Controlled Admin Access WordPress plugin versions prior to 1.5.2 Description: An Improper Access Control issue was discovered, allowing uncontrolled access to website customization functionality and global CMS settings, such as...

CVE-2021-24200: Improper Neutralization of Special Elements used in an SQL Command

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=getwdtable&tableid=1, on the 'length' HTTP POST parameter...

CVE-2021-24177: Improper Neutralization of Input During Web Page Generation

In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...

PT-2021-15723

Name of the Vulnerable Software and Affected Versions: File Manager WordPress plugin versions prior to 7.1 Description: A Reflected XSS issue can occur in the default configuration of the plugin when a payload is submitted on the User-Agent parameter. This payload is then reflected back on the we...