52625 matches found
WordPress Advanced Custom Fields plugin 3.1.1 - 6.0.2 - Custom Field Value Exposure vulnerability
Custom Field Value Exposure Through Parsed Shortcode from User Input vulnerability discovered by Juan Hoffmann in WordPress Advanced Custom Fields plugin versions 3.1.1 - 6.0.2. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 6.0.3...
WordPress Simple File List plugin <= 4.2.2 - Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)
Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by h00die and coiffeur in WordPress Simple File List plugin versions = 4.2.2. Solution Update the WordPress Simple File List plugin to the latest available version at least 4.2.3...
WordPress <= 5.0 - PHP Object Injection via Meta Data vulnerability
PHP Object Injection via Meta Data vulnerability found by Sam Thomas in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...
WordPress Timed Popup Plugin <= 1.3 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...
WordPress WPCargo Track & Trace plugin <= 6.8.9 - Unauthenticated Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE vulnerability discovered by Krzysztof Zając in WordPress WPCargo Track & Trace plugin versions = 6.8.9. Solution Update the WordPress WPCargo Track & Trace plugin to the latest available version at least 6.9.0...
WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.6.1 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered in WordPress WCFM – Frontend Manager for WooCommerce plugin versions = 6.6.1. Solution Update the WordPress WCFM – Frontend Manager for WooCommerce plugin to the latest available version at least 6.6.2...
WordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin TailPress versions = 0.4.4...
WordPress Comment Reply Notification Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Comment Reply Notification Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25051 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fac19e90ec15 Credits Mika Require...
WordPress Google Tag Manager plugin <= 1.15 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Cory Buecker and notstoppable in WordPress Google Tag Manager plugin versions = 1.15. Solution Update the WordPress Google Tag Manager plugin to the latest available version at least 1.15.1...
WordPress Google Places Reviews plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krishna Harsha Kondaveeti in WordPress Google Places Reviews plugin versions = 1.5.2. Solution Fixed in version 2.0.0, but has been closed as of April 8, 2022 and is not available for download. This closure is temporary,...
WordPress RSVPMaker plugin <= 9.2.5 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by Tobias Kay Dala oxnan in WordPress RSVPMaker plugin versions = 9.2.5. Solution Update the WordPress RSVPMaker plugin to the latest available version at least 9.2.6...
WordPress Elementor Website Builder plugin <= 3.6.2 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Ramuel Gall Wordfence in WordPress Elementor Website Builder plugin versions = 3.6.2. Solution Update the WordPress Elementor Website Builder plugin to the latest available version at least 3.6.3...
WordPress Uninstall Plugin <= 1.1 - WordPress Deletion via CSRF
Because of this vulnerability, it is possible to delete all WordPress database files and tables. Solution Upgrade this plugin...
WordPress <= 2.0.6 - SQL Injection vulnerability
The attackers can execute arbitrary SQL commands via the "tbid" parameter. Solution Update the WordPress to the latest available version at least 2.0.7...
WordPress Ultimate Member Plugin 2.1.3-2.8.2 is vulnerable to SQL Injection
Software Ultimate Member Type Plugin Vulnerable versions 2.1.3-2.8.2 Fixed in 2.8.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-1071 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d52d7ae096c8 Credits Christiaan Swiers Required privilege...
WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass vulnerability
wpksesbadprotocol Colon Bypass vulnerability found by WordPress.org Security Team in WordPress versions = 5.3. Solution Update the WordPress to the latest available version at least 5.3.1...
WordPress < 7.0.3 - Subscriber+ Site Creation vulnerability
Subscriber+ Site Creation vulnerability discovered by Aikido Security in WordPress core versions 7.0.3...
WordPress Redux Framework plugin <= 4.2.11 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered by Ram Gall WordFence in WordPress Redux Framework plugin versions = 4.2.11. Solution Update the WordPress Redux Framework plugin to the latest available version at least 4.2.13...
WordPress Spectrum Theme - Remote Code Execution
There are a bug in this theme, that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. Solution Update the theme...
WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Bot for Telegram on WooCommerce versions = 1.2.6...
WordPress Catch Sticky Menu plugin <= 1.6.3 - Unauthorized Plugin Setting Change vulnerability
Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Sticky Menu plugin versions = 1.6.3. Solution Update the WordPress Catch Sticky Menu plugin to the latest available version at least 1.7...
WordPress Slider Revolution plugin <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images' vulnerability
Authenticated Contributor+ Arbitrary File Read via 'usedsvg' and 'usedimages' vulnerability discovered by stealthcopter in WordPress Plugin Slider Revolution versions = 6.7.36...
WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Elementor Website Builder versions = 3.29.0...
WordPress WP SVG Icons plugin <= 3.2.3 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution RCE vulnerability discovered by qerogram in WordPress WP SVG Icons plugin versions = 3.2.3. Solution Deactivate and delete. This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress DeepL Pro API translation Plugin <= 2.4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software DeepL Pro API translation Type Plugin Vulnerable versions = 2.4.1.1 Fixed in 2.4.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46620 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 93ab7131fcdf Credits thien...
WordPress KingComposer plugin <= 2.9.6 - Open Redirect vulnerability
Open Redirect vulnerability discovered by Krzysztof Zając in WordPress KingComposer plugin versions = 2.9.6. Solution Deactivate and delete. This plugin has been closed as of February 2, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress Gutenberg plugin <= 14.3.0 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Stored Cross-Site Scripting XSS vulnerabilities via Search, Feature Image, RSS, and Widget blocks were discovered by Alex Concha WP Security team and a third-party audit in the WordPress Gutenberg plugin versions = 14.3.1. Solution Update the WordPress Gutenberg plugin to the latest...
WordPress Use Any Font plugin <= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability was discovered by Rasi Afeef Patchstack Alliance in WordPress Use Any Font plugin versions = 6.1.7. Solution Update the WordPress Use Any Font plugin to the latest available version at least 6.1.8...
WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.0 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.0. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...
NPM: qs array-limit bypass via bracket-key comma parsing
NPM: qs array-limit bypass via bracket-key comma parsing vulnerability discovered by ? in WordPress Npm qs versions = 6.14.2, = 6.15.3...
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Noman Riffat in WordPress Plugin Charitable versions = 1.8.12.1...
WordPress Flo Launch plugin <= 2.4 - Missing Authentication Allows Full Site Takeover vulnerability
Missing Authentication Allows Full Site Takeover vulnerability discovered by Daniel Ruf in WordPress Flo Launch plugin versions = 2.4. Solution Update the WordPress Flo Launch plugin to the latest available version at least 2.4.1...
WordPress LiteSpeed Cache plugin <= 4.4.3 - IP Check Bypass to Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
IP Check Bypass to Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Emil Kylander in WordPress LiteSpeed Cache plugin versions = 4.4.3. Solution Update the WordPress LiteSpeed Cache plugin to the latest available version at least 4.4.4...
WordPress Smart Slider 3 plugin <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Hardik Solanki in WordPress Smart Slider 3 plugin versions = 3.5.0.8. Solution Update the WordPress Smart Slider 3 plugin to the latest available version at least 3.5.0.9...
WordPress 3.7-4.9 - newbloguser Key Bypass
In wp-admin/user-new.php the newbloguser key is set to a string that can be get from the user ID, which allows an attacker to bypass intended access restrictions by entering this string. Solution Update WordPress to 4.9.1...
NPM: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
NPM: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.4...
WordPress Lenxel Core for Lenxel(LNX) LMS Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Software Lenxel Core for LenxelLNX LMS Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9270 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bea8ca18e070 Credits Francesco...
WordPress Popup Builder plugin <= 4.0.6 - Local File Inclusion (LFI) leading to Remote Code Execution (RCE)
Local File Inclusion LFI leading to Remote Code Execution RCE discovered by JrXnm in WordPress Popup Builder plugin versions = 4.0.6. Solution Update the WordPress Popup Builder plugin to the latest available version at least 4.0.7...
WordPress WooCommerce plugin <= 5.5.0 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered in WordPress WooCommerce plugin versions = 5.5.0. Solution Update the WordPress WooCommerce plugin to the latest available version at least 5.5.1...
WordPress Form – Contact Form plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Form – Contact Form plugin versions = 1.2.4. Solution Deactivate and delete. This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a...
WordPress FooBox Image Lightbox plugin < 2.7.17 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress FooBox Image Lightbox plugin versions 2.7.17. Solution Update the WordPress FooBox Image Lightbox plugin to the latest available version at least 2.7.17...
WordPress J Cart Upsell and Cross-sell for WooCommerce plugin < 2.0.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress J Cart Upsell and Cross-sell for WooCommerce plugin versions 2.0.1. Solution Update the WordPress J Cart Upsell and Cross-sell for WooCommerce plugin to the latest available version at least 2.0.1...
WordPress Chatbot Support AI Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Software Chatbot Support AI Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6722 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a3c87b3b7064 Credits Kieran Burge Required...
WordPress WordPress Custom Settings Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software WordPress Custom Settings Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23806 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c898b8c67aa4 Credits Rio Darmawan...
WordPress WS Form Pro premium plugin <= 1.8.175 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Felipe Restrepo Rodriguez in WordPress WS Form Pro premium plugin versions = 1.8.175. Solution Update the WordPress WS Form Pro premium plugin to the latest available version at least 1.8.176...
WordPress 3.9-5.1 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Simon Scannell in WordPress versions 3.9-5.1. Solution Update WordPress to the latest available version at least 5.1.1...
WordPress Stop Spam Comments plugin <= 0.2.1.2 - Access Token Bypass vulnerability
Access Token Bypass vulnerability discovered by Daniel Ruf in WordPress Stop Spam Comments plugin versions = 0.2.1.2. Solution Deactivate and delete. This plugin has been closed as of August 3, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress CubeWP Forms – All-in-One Form Builder Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Software CubeWP Forms – All-in-One Form Builder Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47300 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 126f1788c7ef Credits hunter85...
WordPress Advanced Contact form 7 DB plugin <= 1.8.7 - Persistent Cross-Site Scripting (XSS) vulnerability
Persistent Cross-Site Scripting XSS vulnerability discovered in Advanced Contact form 7 DB plugin versions = 1.8.7 by BEE-K. Solution Update the WordPress Advanced Contact form 7 DB plugin to the latest available version at least 1.8.8...
WordPress WS Form LITE plugin <= 1.8.175 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Felipe Restrepo Rodriguez in WordPress WS Form LITE plugin versions = 1.8.175. Solution Update the WordPress WS Form LITE plugin to the latest available version at least 1.8.176...