49938 matches found
WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 5.174 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ramuel Gall Wordfence in WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin versions = 5.174. Solution Update the WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin to the latest available version at leas...
WordPress Sassy Social Share plugin <= 3.3.39 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Paul J. Martinez in WordPress Sassy Social Share plugin versions = 3.3.39. Solution Update the WordPress Sassy Social Share plugin to the latest available version at least 3.3.40...
WordPress Booking Package plugin <= 1.5.28 - Unauthenticated Sensitive Data Disclosure vulnerability
Unauthenticated Sensitive Data Disclosure vulnerability discovered by Huli Cymetrics in WordPress Booking Package plugin versions = 1.5.28. Solution Update the WordPress Booking Package plugin to the latest available version at least 1.5.29...
WordPress Analytics Cat plugin <= 1.0.9 - Plugin Settings change via Cross-Site Request Forgery (CSRF) vulnerability
Plugin Settings change via Cross-Site Request Forgery CSRF vulnerability discovered by Rasi Afeef Patchstack Alliance in WordPress Analytics Cat plugin versions = 1.0.9. Solution Update the WordPress Analytics Cat plugin to the latest available version at least 1.1.0...
WordPress Popup Like box plugin <= 3.6.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Popup Like box plugin versions = 3.6.0. Solution Update the WordPress Popup Like box plugin to the latest available version at least 3.6.1...
WordPress dTabs plugin <= 1.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress dTabs plugin versions = 1.4. Solution Deactivate and delete. This plugin has been closed as of February 15, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress Gyta BuyBack plugin <= 1.1.6 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Gyta BuyBack plugin versions = 1.1.6. Solution Update the WordPress Gyta BuyBack plugin to the latest available version at least 1.1.7...
WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Server Information Exposure vulnerability
Server Information Exposure vulnerability discovered by Dave Jong Patchstack in WordPress Perfect Brands for WooCommerce plugin versions = 2.0.4. Solution Update the WordPress Perfect Brands for WooCommerce plugin to the latest available version at least 2.0.5...
WordPress Coming soon and Maintenance mode plugin <= 3.6.7 - Arbitrary Email Sending to Subscribed Users via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Email Sending to Subscribed Users via Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof ZajÄ…c in WordPress Coming soon and Maintenance mode plugin versions = 3.6.7. Solution Update the WordPress Coming soon and Maintenance mode plugin to the latest available version ...
WordPress Ad Inserter plugin <= 2.7.9 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Ad Inserter plugin versions = 2.7.9. Solution Update the WordPress Ad Inserter plugin to the latest available version at least 2.7.10...
WordPress Permalink Manager Pro premium plugin <= 2.2.14 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Permalink Manager Pro premium plugin versions = 2.2.14. Solution Update the WordPress Permalink Manager Pro premium plugin to the latest available version at least 2.2.15...
WordPress MapPress Maps for WordPress plugin <= 2.73.3 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress MapPress Maps for WordPress plugin versions = 2.73.3. Solution Update the WordPress MapPress Maps for WordPress plugin to the latest available version at least 2.73.4...
WordPress GTranslate plugin <= 2.9.6 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress GTranslate plugin versions = 2.9.6. Solution Update the WordPress GTranslate plugin to the latest available version at least 2.9.7...
WordPress PowerPack Addons for Elementor plugin <= 2.6.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress PowerPack Addons for Elementor plugin versions = 2.6.1. Solution Update the WordPress PowerPack Addons for Elementor plugin to the latest available version at least 2.6.2...
WordPress WP Guppy plugin <= 1.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered by Keyvan Hardani in WordPress WP Guppy plugin versions = 1.2. Solution Update the WordPress WP Guppy plugin to the latest available version at least 1.3...
WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability
Authenticated Arbitrary File Download vulnerability discovered by Ex.Mi Patchstack in WordPress Download Monitor plugin versions = 4.4.6. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.7...
WordPress Brizy – Page Builder plugin <= 2.3.11 - Incorrect authorization checks allowing Post modification vulnerability
Incorrect authorization checks allowing Post modification vulnerability discovered by Ramuel Gall WordFence in WordPress Brizy – Page Builder plugin versions = 2.3.11. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 2.3.12...
WordPress G Auto-Hyperlink plugin <= 1.0.1 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by Shreya Pohekar Codevigilant Project in WordPress G Auto-Hyperlink plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 18, 2021 and is not available for download. Reason: Security Issue...
WordPress 4k Icons for Visual Composer plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex in WordPress 4k Icons for Visual Composer plugin versions = 1.0. Solution This plugin has been closed and is no longer available for download...
WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.4.6 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability discovered by Swapnil Bodekar in WordPress SMS Alert Order Notifications – WooCommerce plugin versions = 3.4.6. Solution Update the WordPress SMS Alert Order Notifications – WooCommerce plugin to the latest available version at least 3.4.7...
WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by m0ze Patchstack Red Team in WordPress uListing plugin versions = 2.0.5. Solution Update the WordPress uListing plugin to the latest available version at least 2.0.6...
WordPress Social Tape plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Ashish Upsham in WordPress Social Tape plugin versions = 1.0. Solution This plugin has been closed as of June 15, 2021 and is not available for download. Reason: Security Issue...
WordPress Salon booking system plugin <= 6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Phu Tran in WordPress Salon booking system plugin versions = 6.3 Solution Update the WordPress Salon booking system plugin to the latest available version at least 6.3.1...
WordPress YOP Poll plugin <= 6.2.7 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Toby Jackson in WordPress YOP Poll plugin versions = 6.2.7. Solution Update the WordPress YOP Poll plugin to the latest available version at least 6.2.8...
WordPress VikRentCar plugin <= 1.1.6 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Satyender Yadav in WordPress VikRentCar plugin versions = 1.1.6. Solution Update the WordPress VikRentCar plugin to the latest available version at least 1.1.7...
WordPress Smart Slider 3 PRO premium plugin <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Hardik Solanki in WordPress Smart Slider 3 PRO premium plugin versions = 3.5.0.8. Solution Update the WordPress Smart Slider 3 PRO premium plugin to the latest available version at least 3.5.0.9...
WordPress GeoDirectory Location Manager premium plugin <= v2.1.0.9 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities
Multiple Unauthenticated SQL Injection SQLi vulnerabilities discovered by Rafal Goryl in the WordPress GeoDirectory Location Manager premium plugin versions = v2.1.0.9. Solution Update the WordPress GeoDirectory Location Manager premium plugin to the latest available version at least 2.1.0.10...
WordPress Tutor LMS plugin <= 1.8.7 - Authenticated Local File Inclusion vulnerability
Authenticated Local File Inclusion vulnerability discovered by sasa in WordPress Tutor LMS plugin versions = 1.8.7 Solution Update the WordPress Tutor LMS plugin to the latest available version at least 1.8.8...
WordPress N5 Upload Form plugin <= 1.0 - Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)
Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Jin Huang in WordPress N5 Upload Form plugin versions = 1.0. Solution Plugin closed. Deactivate and delete...
WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to file upload
Cross-Site Request Forgery CSRF vulnerability leading to file upload found by WordFence in WordPress NextGen Gallery plugin versions = 3.4.7. Solution Update the WordPress NextGen Gallery plugin to the latest available version at least 3.5.0...
WordPress NextGen Gallery plugin <= 3.4.7 - Cross-Site Request Forgery (CSRF) leading to XSS and RCE via file upload and LFI
Cross-Site Request Forgery CSRF leading to XSS and RCE via file upload and LFI found by WordFence in WordPress NextGen Gallery plugin versions = 3.4.7. Solution Update the WordPress NextGen Gallery plugin to the latest available version at least 3.5.0...
WordPress <= 5.5.1 - Mishandled deserialization requests vulnerability
Mishandled deserialization requests vulnerability found by Alex Concha in WordPress versions = 5.5.1. Solution Update the WordPress plugin to the latest available version at least 5.5.2...
WordPress Knight Lab Timeline plugin <= 3.6.3.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability vulnerable TimelineJS library version discovered in WordPress Knight Lab Timeline plugin versions = 3.6.3.0. Solution Update the WordPress Knight Lab Timeline plugin to the latest available version at least 3.7.0.0...
WordPress Contact Form 7 Datepicker plugin <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Contact Form 7 Datepicker plugin versions = 2.6.0. Solution This plugin has been closed as of April 1, 2020 and is not available for download. Reason: Security Issue...
WordPress WP-Advanced-Search plugin <= 3.3.3 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by Florian Hauser in WordPress WP-Advanced-Search plugin versions = 3.3.3. Solution Update the WordPress WP-Advanced-Search plugin to the latest available version at least 3.3.7...
WordPress Nextgen Gallery plugin <= 3.2.8 - SQL Injection vulnerability
SQL Injection vulnerability found by Tin Duong Fortinet FortiGuard Labs in WordPress Nextgen Gallery plugin versions = 3.2.8. Solution Update the WordPress Nextgen Gallery plugin to the latest available version at least 3.2.10...
WordPress Widget Logic plugin <= 5.10.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress Widget Logic plugin versions = 5.10.2. Solution Update the WordPress Widget Logic plugin to the latest available version at least 5.10.3...
WordPress Flow-Flow Social Stream plugin <= 3.0.71 - Unauthenticated Cross-Site Scripting (XSS) vulnerability
Unauthenticated Cross-Site Scripting XSS vulnerability found by Alaistair Jerrom-Smith in WordPress Flow-Flow Social Stream plugin versions = 3.0.71. Solution Update the WordPress Flow-Flow Social Stream plugin to the latest available version at least 3.0.72...
WordPress GD Rating System plugin 2.3 - Cross-Site Scripting (XSS) vulnerability (4)
A fourth Cross-Site Scripting XSS vulnerability found by d4wner in WordPress GD Rating System plugin version 2.3. XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page. Solution 1/9/2018 - we were unable to find a patched version of this plugin...
WordPress Anti Plagiarism Plugin <= 3.60 - Cross-Site Scripting (XSS)
This plugin is prone to a cross site scripting vulnerability, because the variable "m" appears to send unsanitized data back to the users browser. Solution Update the plugin...
WordPress Symposium Plugin 15.1 - SQL Injection #2
WP Symposium plugin's "size" parameter is prone to an SQL injection via getalbumitem.php. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Related records:...
WordPress ACF Frontend Display Plugin 2.0.5 - File Upload
ACF Frontend Display plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the plugin...
WordPress Slider Revolution Plugin <= 3.0.95 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can upload and execute arbitrary files, create, update, import or export arbitrary sliders via unspecified vectors, also, delete arbitrary sliders. Solution Update the plugin...
WordPress Videowall Plugin - Reflected Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability in index.php pageid parameter. Solution Update the plugin...
WordPress Video Gallery Plugin 2.7.0 - SQL Injection
This WordPress Video Gallery plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress Paid Memberships Pro Plugin 1.7.14 - Directory Traversal
This vulnerability is in the services/getfile.php, It allows the attackers to read arbitrary files in the QUERYSTRING in a getfile action to wp-admin/admin-ajax.php. Solution Update the plugin...
WordPress DBManager Plugin <= 2.7.1 - Multiple Vulnerabilities
There are multiple vulnerabilities in this plugin, that allow remote authenticated users to execute arbitrary commands via shell metacharacters in the $backup'filepath' or $backup'mysqldumppath' variable. Solution Update the plugin...
WordPress BulletProof Security Plugin <= .51 - SQL Injection
This vulnerability is in admin/htaccess/bpsunlock.php. It allows remote authenticated users to execute arbitrary SQL commands via the "tableprefix" parameter. Solution Update the plugin...
WordPress WooCommerce plugin <= 2.2.2 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability discovered by Tom Adams in WordPress WooCommerce plugin versions = 2.2.2. Solution Update the WordPress WooCommerce plugin to the latest available version at least 2.2.3...
WordPress Twitget Plugin 3.3.1 - Multiple Vulnerabilities
WordPress Twitget plugin is prone to multiple vulnerabilities, such as CSRF and XSS. It works when a logged-in administrator visits a specially crafted page. Then options can be updated without their consent and some of those options are output unescaped into the form cross-site scripting. Soluti...