WordPress Quiz And Survey Master plugin <= 7.1.17 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by renniepak in WordPress Quiz And Survey Master plugin versions = 7.1.17. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at least 7.1.18...

WordPress Hana Flv Player plugin <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Kishore Hariram in WordPress Hana Flv Player plugin versions = 3.1.3. Solution No patched version is available. The last version was released 8 years ago...

WordPress Popup by Supsystic plugin <= 1.10.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by 0xB9 in WordPress Popup by Supsystic plugin versions = 1.10.4. Solution Update the WordPress Popup by Supsystic plugin to the latest available version at least 1.10.5...

WordPress Imagements plugin <= 1.2.5 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability

Unauthenticated Arbitrary File Upload leading to Remote Code Execution RCE vulnerability discovered by Jin Huang in WordPress Imagements plugin versions = 1.2.5. Solution Plugin closed. Deactivate and delete...

WordPress Event Banner plugin <= 1.3 - Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Jin Huang in WordPress Event Banner plugin versions = 1.3. Solution This plugin has been closed as of December 24, 2018 and is not available for download. Reason: Guideline Violation...

WordPress OpenID Connect Generic Client plugin <= 3.8.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Austin Bentley in WordPress OpenID Connect Generic Client plugin versions = 3.8.1. Solution Update the WordPress OpenID Connect Generic Client plugin to the latest available version at least 3.8.2...

WordPress Bello - Directory & Listing premium theme <= 1.5.9 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze Patchstack Red Team in WordPress Bello - Directory & Listing premium theme versions = 1.5.9. Solution Update the WordPress Bello - Directory & Listing premium theme to the latest available version at least 1.6.0...

WordPress DiveBook plugin <= 1.1.4 - Improper Authorisation Check vulnerability

Improper Authorisation Check vulnerability found by Hooper Labs in WordPress DiveBook plugin versions = 1.1.4. Solution 2020-12-09 - we were unable to find a patched version of this plugin Last updated: 10 years ago...

WordPress WooCommerce Blocks plugin <= 3.7.0 - Guest Account Creation vulnerability

Guest Account Creation vulnerability found in WordPress WooCommerce Blocks plugin versions = 3.7.0. Solution Update the WordPress WooCommerce Blocks plugin to the latest available version at least 3.7.1...

WordPress Activello theme <= 1.4.1 - Unauthenticated Function Injection vulnerability

Unauthenticated Function Injection vulnerability found by Jerome Bruandet NinTechNet in WordPress Activello theme versions = 1.4.1. Solution Update the WordPress Activello theme to the latest available version at least 1.4.2...

WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 5.1.0 - Persistent Cross-Site Scripting (XSS) vulnerability

Persistent Cross-Site Scripting XSS vulnerability found by Jinson Varghese Behanan in WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin versions = 5.1.0. Solution Update the WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin to...

WordPress KingComposer plugin <= 2.9.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress KingComposer plugin versions = 2.9.4. Solution Update the WordPress KingComposer plugin to the latest available version at least 2.9.5...

WordPress Advanced Access Manager plugin <= 6.6.1 - Authenticated Authorization Bypass and Privilege Escalation vulnerability

Authenticated Authorization Bypass and Privilege Escalation vulnerability discovered by WordFence in WordPress Advanced Access Manager plugin versions = 6.6.1. Solution Update the WordPress Advanced Access Manager plugin to the latest available version at least 6.6.2...

WordPress Media Library Assistant plugin <= 2.81 - Unauthenticated Limited Local File Inclusion (LFI) vulnerability

Unauthenticated Limited Local File Inclusion LFI vulnerability discovered by Daniel Monzón stark0de in WordPress Media Library Assistant plugin versions = 2.81. Solution Update the WordPress Media Library Assistant plugin to the latest available version at least 2.82...

WordPress Envira Photo Gallery plugin <= 1.7.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fortinet in WordPress Envira Photo Gallery plugin versions = 1.7.6. Solution Update the WordPress Envira Photo Gallery plugin to the latest available version at least 1.7.7...

WordPress Mesmerize theme <=1.6.89 - Authenticated Options Update vulnerability

Authenticated Options Update vulnerability found by NinTechNet in WordPress Mesmerize theme versions =1.6.89. Solution Update the WordPress Mesmerize theme to the latest available version at least 1.6.90...

WordPress YITH Custom Thank You Page for Woocommerce plugin <=1.1.7 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH Custom Thank You Page for Woocommerce plugin versions =1.1.7. Solution Update the WordPress YITH Custom Thank You Page for Woocommerce plugin to the latest available version at leas...

WordPress LifterLMS plugin <= 3.34.5 - Unauthenticated Options Import vulnerability

Unauthenticated Options Import vulnerability found by Jerome Bruandet Nintechnet in WordPress LifterLMS plugin versions = 3.34.5. Solution Update the WordPress LifterLMS plugin to the latest available version at least 3.35.1...

WordPress HandL UTM Grabber plugin <= 2.6.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress HandL UTM Grabber plugin versions = 2.6.4. Solution Update the WordPress HandL UTM Grabber plugin to the latest available version at least 2.6.5...

WordPress Everest Forms plugin <= 1.4.9 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Tin Duong in WordPress Everest Forms plugin versions = 1.4.9. Solution Update the WordPress Everest Forms plugin to the latest available version at least 1.5.0...

WordPress Hybrid Composer plugin <= 1.4.6 - Unauthenticated Options Update vulnerability

Unauthenticated Options Update vulnerability found by rootetsy in WordPress Hybrid Composer plugin versions = 1.4.6. Solution Update the WordPress Hybrid Composer plugin to the latest available version at least 1.4.7...

WordPress Form Maker by 10Web plugin <= 1.13.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Daniele Scanu in WordPress Form Maker by 10Web plugin versions = 1.13.20. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.3...

WordPress WP Booking System <= 1.5.1.1 - CSRF vulnerability to Authenticated SQL Injection vulnerability

CSRF vulnerability to Authenticated SQL Injection vulnerability possible in WordPress WP Booking System versions = 1.5.1.1 found by Magnus K. Stubman. Solution Update the WordPress WP Booking System to the latest available version at least 1.5.2...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.0.22 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Jasper Weijts Onvio in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.0.22. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least 3.0.23...

WordPress Ultimate Member plugin <= 2.0.39 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Georg Knabl in WordPress Ultimate Member plugin versions = 2.0.39. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.40...

WordPress WP Live Chat Support plugin <= 8.0.17 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Tim Coen in WordPress WP Live Chat Support plugin versions = 8.0.17. Solution Update the WordPress WP Live Chat Support plugin to the latest available version at least 8.0.18...

WordPress Smart Forms plugin <= 2.5.15 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Toshiharu Sugiyama in WordPress Smart Forms plugin versions = 2.5.15. Solution Update the WordPress Smart Forms plugin to the latest available version at least 2.6.16...

WordPress Yet Another Stars Rating plugin <= 1.8.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability found by Paul Dannewitz in WordPress Yet Another Stars Rating plugin versions = 1.8.6. Solution Update the WordPress Yet Another Stars Rating plugin to the latest available version at least 1.8.7...

WordPress wpForo Forum plugin <=1.4.9 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection via a search with the /forum/ wpfo parameter found by cate4cafe in WordPress wpForo Forum plugin versions =1.4.9. Solution Update the WordPress wpForo Forum plugin to the latest available version at least 1.4.11...

WordPress Cookie Consent plugin <=2.3.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found in WordPress Cookie Consent plugin versions =2.3.9. Solution Update the WordPress Cookie Consent plugin to the latest available version at least 2.3.10...

WordPress GD Rating System plugin 2.3 - Directory Traversal vulnerability (2)

A second Directory Traversal vulnerability found by d4wner in WordPress GD Rating System plugin version 2.3. Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page. Solution 1/9/2018 - we were unable to find a patched version of this plugin...

WordPress GD Rating System plugin 2.3 - Cross-Site Scripting (XSS) vulnerability (2)

A second Cross-Site Scripting XSS vulnerability found by d4wner in WordPress GD Rating System plugin version 2.3 Solution 1/9/2018 - we were unable to find a patched version of this plugin...

WordPress ImageInject plugin 1.15 - Stored Cross-Site Scripting vulnerability

Stored Cross-Site Scripting vulnerability found by wpl0v3r in WordPress ImageInject plugin version 1.15. Vulnerable via the flickrappid parameter to wp-admin/options-general.php. Solution 1/9/2018 - we were unable to find a patched version of the plugin. Dangerous to use...

WordPress Affiliate Ads for Clickbank Products plugin <= 1.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Neorichi in WordPress Affiliate Ads for Clickbank Products plugin versions = 1.6. It is vulnerable to a Cross-Site Scripting XSS vulnerability via the textadsajax.php bordercolor parameter. Solution Update the WordPress Affiliate Ads for...

WordPress Heat Trackr Plugin <= 1.0 - Reflected XSS

This plugin is prone to a cross site scripting vulnerability via /heat-trackr/heat-trackrabtestadd.php file. Solution Update the plugin...

WordPress Indexisto Plugin <= 1.0.5 - Reflected XSS

This plugin is prone to a cross site scripting vulnerability. Solution Upgrade the plugin...

WordPress Pondol Form to Mail Plugin <= 1.1 - Cross Site Scripting (XSS)

Because of this vulnerability, the variable itemid appears to send unsanitized data back to the users browser. Vulnerable file is pondol-formmail/pages/admin-mail-info.php. Solution Update the plugin...

WordPress Pondol Form to Mail Plugin <= 1.1 - Cross Site Scripting (XSS)

Because of this vulnerability, the variable itemid appears to send unsanitized data back to the users browser. Vulnerable file is pondol-formmail/pages/admin-mail-info.php. Solution Update the plugin...

WordPress Ajax Random Post Plugin <= 2.00 - Cross Site Scripting (XSS)

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress <= 4.4.1 - Open Redirect

This vulnerability in the wpvalidateredirect function in wp-includes/pluggable.php allows an attacker to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL which triggers incorrect hostname parsing. Solution Update WordPress...

WordPress Payment Form for PayPal Pro Plugin <= 1.0.1 - XSS

This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...

WordPress Easy2Map Plugin 1.24 - SQL Injection

This WordPress Easy2Map plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Slider Revolution Plugin <= 4.2.2 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via the "clientaction" parameter. Solution Update the plugin...

WordPress WP Photo Album Plus Plugin <= 6.1.2 - Multiple XSS

Because of these vulnerabilities in wppa-ajax-front.php, the attackers can inject arbitrary web script or HTML via the "comemail" or "comname" parameters. Solution Update the plugin...

WordPress Simple Ads Manager Plugin - Information Disclosure

Simple Ads Manager plugin is prone to an information disclosure vulnerability via "simple-ads-manager/sam-ajax-admin.php". This vulnerability allows an attacker to obtain sensitive information and in this way lead to further attacks. Solution Upgrade the plugin...

WordPress Simple Ads Manager Plugin <= 2.5.95 - Unrestricted File Upload

This vulnerability exists in sam-ajax-admin.php and allows an attacker to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the "path" parameter. Solution Update the plugin...

WordPress <= 4.2.3 - SQL Injection

Because of this vulnerability, an attacker can execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash. Solution Update WordPress...

WordPress DesignFolio Plus Theme 1.2 - Arbitrary File Upload

WordPress DesignFolio Plus theme is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Update the theme...

WordPress Fusion Theme <= 3.1 - Arbitrary File Upload

Because of this vulnerability in this Fusion theme, the authenticated users can execute arbitrary code by uploading a file with an executable extension in a fusionsave action and then accessing it via unspecified vectors. Solution Update the theme...

WordPress mTouch Quiz Plugin <= 3.0.6 - SQL Injection

Because of this vulnerability in question.php, the attackers can execute arbitrary SQL commands via the "quiz" parameter to wp-admin/edit.php. Solution Update the plugin...