CVE-2022-33943: Improper Neutralization of Input During Web Page Generation

Authenticated contributor or higher user role Cross-Site Scripting XSS vulnerability in Nico Amarilla's BxSlider WP plugin = 2.0.0 at WordPress...

WordPress plugin FreeMind WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin FreeMind W...

CVE-2021-24949

The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-36916 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

Sociable <= 4.3.4.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfilteredhtml capability is disallowed PoC Put the following payload in the...

Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue Payloads: - Original reporter:...

WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection

The Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user admin+. Edit WPScanTeam: September 8th, 2020 - Confirmed & Escalated to WP plugins team September 8th, 2020 - WP plugins team investigating November 25th, 2020 - No updates,...

Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected XSS

Bad user input sanitisation leads to unauthenticated reflected XSS. Edit WPScanTeam: January 27th, 2020 - Report received & WP Plugin team notified January 31st, 2020 - WP plugin team acknowledgement & plugin closed. April 11th, 2020 - No updates, disclosing. PoC...

CVE-2016-11011

The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...

CVE-2018-20838

The AMP for WP plugin for WordPress is vulnerable to stored Cross-Site Scripting (XSS) in versions prior to 0.9.97.21 . The root cause is a lack of proper validation of client-side data by the web application within the ampforwp_save_steps_data function. An attacker can exploit this flaw to execu...

WordPress AMP for WP Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in ampforwpsavestepsdata in WordPress AMP for WP plugin versions...

CVE-2019-7412

CVE-2019-7412 affects the WordPress PS PHPCaptcha WP plugin prior to v1.2.0, where input sanitization is mishandled. This vulnerability comes from improper input filtering within the plugin, exposing potential high-impact consequences. The NVD notes a CVSS v3 base score of 9.8 (CRITICAL) with NET...

Delightful Downloads <= 1.6.6 - Unauthenticated Path Traversal

Since no authentication or authorisation checks for direct access to the jqueryFileTree.php are made, the vulnerability allows for browsing the file system on a host out of an unauthenticated context. Even though no file content can be exfiltrated this way, "hidden" files e.g. in the web...

Cross-site scripting vulnerability in wordpress plugin tinyfier-wp

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin tinyfier-wp suffers from a cross-site scripting vulnerability due to improper filtering of user input,...

CVE-2014-9397

Cross-site request forgery CSRF vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the messageformat parameter in the twimp-wp.php page to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the messageformat parameter in the twimp-wp.php page to...

CVE-2014-4593

Cross-site scripting XSS vulnerability in wp-plugins-net/index.php in the WP Plugin Manager wppm plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in wp-plugins-net/index.php in the WP Plugin Manager wppm plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

CVE-2014-4593

Cross-site scripting XSS vulnerability in wp-plugins-net/index.php in the WP Plugin Manager wppm plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter...