49933 matches found
WordPress Ajax Load More plugin <= 5.5.3 - Authenticated Arbitrary File Read vulnerability
Authenticated Arbitrary File Read vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Ajax Load More plugin versions = 5.5.3. Solution Update the WordPress Ajax Load More plugin to the latest available version at least 5.5.4...
WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 3.0.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WooCommerce PDF Invoices & Packing Slips plugin versions = 3.0.0. Solution Update the WordPress WooCommerce PDF Invoices & Packing Slips plugin to the latest available version at least 3.0.1...
WordPress Banner Cycler plugin <= 1.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered by MOTEKI TAKERU in WordPress Banner Cycler plugin versions = 1.4. Solution Deactivate and delete. This plugin has been closed as of June 30, 2022 and is not available for download. This closure is...
WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered by Ngo Van Thien Patchstack Alliance in the WordPress WP Hotel Booking plugin versions = 1.10.5. Solution Update the WordPress WP Hotel Booking plugin to the latest available version at least 1.10.6...
WordPress Team plugin <= 4.1.1 - Authenticated Arbitrary File Read and Deletion vulnerability
Authenticated Arbitrary File Read and Deletion vulnerability discovered by Nhật Nam in WordPress Team plugin versions = 4.1.1. Solution Update the WordPress Team plugin to the latest available version at least 4.1.2...
WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities were discovered by Ngo Van Thien Patchstack Alliance in the WordPress Team plugin versions = 1.2.6. Solution Deactivate and delete. This plugin has been closed as of May 3, 2022 and is not available for download. Reason:...
WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by Lana Codes in WordPress WP OAuth2 Server plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 23, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress YaySMTP plugin <= 2.2 - Authenticated Logs Disclosure vulnerability
Authenticated Logs Disclosure vulnerability discovered by Rafshanzani Suhada in WordPress YaySMTP plugin versions = 2.2. Solution Update the WordPress YaySMTP plugin to the latest available version at least 2.2.1...
WordPress Request a Quote plugin <= 2.3.7 - CSV Injection vulnerability
CSV Injection vulnerability discovered by Benachi in WordPress Request a Quote plugin versions = 2.3.7. Solution Deactivate and delete. This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress CDI plugin <= 5.1.8 - Reflected Cross-Site-Scripting (XSS) vulnerability
Reflected Cross-Site-Scripting XSS vulnerability discovered by WordPress CDI plugin versions = 5.1.8. Solution Update the WordPress CDI plugin to the latest available version at least 5.1.9...
WordPress Admin Management Xtended plugin <= 2.4.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Nguy Minh Tuan Patchstack Alliance in the WordPress Admin Management Xtended plugin versions = 2.4.4. Solution Update the WordPress Admin Management Xtended plugin to the latest available version at least 2.4.5...
WordPress Genki Pre-Publish Reminder plugin <= 1.4.1 - Stored XSS and RCE via CSRF vulnerability
Stored XSS and RCE via CSRF vulnerability discovered by Daniel Ruf in WordPress Genki Pre-Publish Reminder plugin versions = 1.4.1. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress Jupiter premium theme <= 6.10.1 - Insufficient Access Control leading to Authenticated Arbitrary Plugin Deletion
Insufficient Access Control leading to Authenticated Arbitrary Plugin Deletion discovered by Ramuel Gall Wordfence in WordPress Jupiter premium theme versions = 6.10.1. Solution Update the WordPress Jupiter premium theme to the latest available version at least 6.10.2...
WordPress Ask Me premium theme < 6.8.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Veshraj Ghimire in WordPress Ask Me premium theme versions 6.8.2. Solution Update the WordPress Ask Me premium theme to the latest available version at least 6.8.2...
WordPress Form Maker by 10Web plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Abhinav Porwal & Hitesh Kumar in WordPress Form Maker by 10Web plugin versions = 1.14.11. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.14.12...
WordPress Fancy Product Designer plugin <= 4.7.5 – Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload
Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary File Upload discovered by Lin Yu in WordPress Fancy Product Designer plugin versions = 4.7.5. Solution Update the WordPress Fancy Product Designer plugin to the latest available version at least 4.7.6...
WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability was discovered by Ngo Van Thien Patchstack Alliance in WordPress Responsive Tabs plugin versions = 4.0.5. Solution No patched version is available...
WordPress Optimole plugin <= 3.3.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Mika in WordPress Optimole plugin versions = 3.3.1. Solution Update the WordPress Optimole plugin to the latest available version at least 3.3.2...
WordPress Pz-LinkCard plugin <= 2.4.5.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Pz-LinkCard plugin versions = 2.4.5.2. Solution Update the WordPress Pz-LinkCard plugin to the latest available version at least 2.4.5.3...
WordPress Locations and Areas – Leaflet Map with Region Tabs plugin <= 1.7.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Locations and Areas – Leaflet Map with Region Tabs plugin versions = 1.7.0. Solution Update the WordPress Locations and Areas – Leaflet Map with Region Tabs plugin to the latest available version at least 1.7.1...
WordPress Header Footer Code Manager plugin <= 1.1.16 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ramuel Gall in WordPress Header Footer Code Manager plugin versions = 1.1.16. Solution Update the WordPress Header Footer Code Manager plugin to the latest available version at least 1.1.17...
WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure
Sensitive Information Disclosure vulnerability discovered in WordPress wpDiscuz plugin versions = 7.3.11 by Muhammad Daffa. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.3.12...
WordPress Code Snippets plugin <= 2.14.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Code Snippets plugin versions = 2.14.2. Solution Update the WordPress Code Snippets plugin to the latest available version at least 2.14.3...
WordPress Redux Framework plugin <= 4.2.11 - Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion vulnerability
Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion vulnerability discovered by Ramuel Gall WordFence in WordPress Redux Framework plugin versions = 4.2.11. Solution Update the WordPress Redux Framework plugin to the latest available version at least 4.2.13...
WordPress WP Fusion Lite plugin <= 3.37.18 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Xu-Liang Liao in WordPress WP Fusion Lite plugin versions = 3.37.18. Solution This plugin has been closed as of August 6, 2021 and is not available for download. This closure is temporary, pending a full review...
WordPress WordPress Download Manager plugin <= 3.1.24 - Authenticated Directory Traversal vulnerability
Authenticated Directory Traversal vulnerability discovered by Ramuel Gall WordFence in WordPress WordPress Download Manager plugin versions = 3.1.24. Solution Update the WordPress WordPress Download Manager plugin to the latest available version at least 3.1.25...
WordPress ProfilePress plugin 3.0 – 3.1.3 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Chloe Chamberland WordFence in WordPress ProfilePress plugin versions 3.0 – 3.1.3. 06.29.2021 - WordFence updated the vulnerable version to 3.0 - 3.1.3. Solution Update the WordPress ProfilePress plugin to the latest version at leas...
WordPress All In One SEO Pack plugin <= 4.1.0.1 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by darkpills in WordPress All In One SEO Pack plugin versions = 4.1.0.1. Solution Update the WordPress All In One SEO Pack plugin to the latest available version at least 4.1.0.2...
WordPress Car Seller – Auto Classifieds Script plugin <= 2.1.0 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Car Seller – Auto Classifieds Script plugin versions = 2.1.0. Solution This plugin has been closed as of April 19, 2021 and is not available for download. This closure is permanent...
WordPress Post PDF Export plugin <= 1.0.1 - Unauthenticated Local File Inclusion (LFI) vulnerability
Unauthenticated Local File Inclusion LFI vulnerability discovered by Random Robbie in WordPress Post PDF Export plugin versions = 1.0.1. Solution Plugin closed. Deactivate and delete...
WordPress Photo Gallery by 10Web plugin <= 1.5.34 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability found in WordPress Photo Gallery by 10Web plugin versions = 1.5.34. Solution Update the WordPress Photo Gallery by 10Web plugin to the latest available version at least 1.5.35...
WordPress Multi Step Form plugin <= 1.2.5 - Multiple Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerabilities
Multiple Unauthenticated Reflected Cross-Site Scripting XSS vulnerabilities found by Javier Olmedo in WordPress Multi Step Form plugin versions = 1.2.5. Solution Update the plugin WordPress Multi Step Form plugin to the latest available version at least 1.2.6...
WordPress Meta Slider Plugin <= 2.1.6 - Full Path Disclosure
This plugin is prone to a full path disclosure vulnerability. Solution Update the plugin...
WordPress WPML Plugin <= 3.1.8 - Multiple Vulnerabilities
This WordPress Multilingual plugin is prone to SQL injection, missing authentication, page/post/menu deletion and reflected XSS vulnerabilities. Solution Update the plugin...
WordPress O2Tweet Plugin <= 0.0.4 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress <= 3.9.1 - Denial Of Service Attacks #2
The Incutio XML-RPC IXR Library permits entity declarations without considering recursion during entity expansion. In that way the attackers can cause a denial of service attacks via a crafted XML document containing a large number of nested entity references. Related records:...
WordPress Ad-Minister Plugin <= 0.6 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "key" parameter in a delete action to wp-admin/tools.php. Solution Update the plugin...
WordPress Bradesco Gateway Plugin <= 2.0 - XSS
Because of this vulnerability in falha.php, the attackers can inject arbitrary web script or HTML via the QUERYSTRING. Solution Update the plugin...
WordPress Events Manager Plugin <= 5.3.4 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "scope" parameter to index.php. Solution Update the plugin...
WordPress WPStoreCart Plugin 2.5.27 - 2.5.29 - Arbitrary File Upload
WPStoreCart plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible. Solutio...
WordPress BackWPup Plugin - Remote and Local Code Execution
WordPress BackWPup plugin is prone to a remote and local code execution vulnerability. The input that is passed to the component "wpxmlexport.php" via the "wpabs" variable allows the inclusion and execution of local or remote PHP files as long as a "nonce" value is known. Solution Update the plug...
WordPress - Privileges Unchecked in admin.php and Multiple Information
This WordPress vulnerability was found in the way that WordPress handles some URL requests. It results the content of plugins configuration pages in some plugins modifying plugin options, unprivileged users viewing and injecting JavaScript code. The code is abitrary and it may be run by a malicio...
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
NPM: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.12.0...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Form Submission Data Exposure vulnerability discovered by Z3no in WordPress Plugin Kirki – Freeform Page Builder, Website Builder & Customizer versions = 6.0.6...
WordPress NextGEN Gallery Plugin < 3.59.5 is vulnerable to Cross Site Scripting (XSS)
Software NextGEN Gallery Type Plugin Vulnerable versions 3.59.5 Fixed in 3.59.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6393 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0e6857ff3928 Credits WPscan Required privileg...
WordPress Chartify Plugin <= 2.9.5 is vulnerable to Remote Code Execution (RCE)
Software Chartify Type Plugin Vulnerable versions = 2.9.5 Fixed in 2.9.6 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-10571 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 97f7a98a5728 Credits abrahack Required privilege Unauthenticated...
WordPress WP Testimonial Widget Plugin <= 3.1 is vulnerable to SQL Injection
Software WP Testimonial Widget Type Plugin Vulnerable versions = 3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43966 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 505085fbb60c Credits hnwmn Required privilege Administrator Publishe...
WordPress Multilingual CMS Plugin <= 4.6.12 is vulnerable to Remote Code Execution (RCE)
Software Multilingual CMS Type Plugin Vulnerable versions = 4.6.12 Fixed in 4.6.13 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-6386 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 31c994cd7315 Credits stealthcopter Required...
WordPress WPBakery Page Builder Plugin <= 7.7 is vulnerable to Cross Site Scripting (XSS)
Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.7 Fixed in 7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5708 Patch priority Low CVSS severity Low 5.9 Developer WPBakery PSID 535392115bbf Credits João Pedro Soares de Alcântar...
WordPress Ajax Load More Plugin <= 7.1.1 is vulnerable to Cross Site Scripting (XSS)
Software Ajax Load More Type Plugin Vulnerable versions = 7.1.1 Fixed in 7.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4711 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 049ac1eade10 Credits Webbernaut Required...