48064 matches found
WordPress Modern Events Calendar Lite plugin <= 5.1.6 - Multiple Stored Cross-Site Scripting (XSS) Vulnerabilities
Multiple Stored Cross-Site Scripting XSS Vulnerabilities discovered by WordFence in WordPress Modern Events Calendar Lite plugin versions = 5.1.6. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.1.7...
WordPress Gistpress plugin <= 3.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Paul Ritchie in WordPress Gistpress plugin versions = 3.0.1. Solution Update the WordPress Gistpress plugin to the latest available version at least 3.0.2...
WordPress WP Spell Check plugin <= 7.1.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Takuya Yamaguchi in WordPress WP Spell Check plugin versions = 7.1.9. Solution Update the WordPress WP Spell Check plugin to the latest available version at least 7.1.10...
WordPress SlickQuiz plugin <= 1.3.7.1 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability found by Julien Ahrens in WordPress SlickQuiz plugin versions = 1.3.7.1 Solution 11 September 2019 - we were unable to find a patched version of this plugin...
WordPress Search Exclude plugin <= 1.2.2 - Arbitrary Settings Change vulnerability
Arbitrary Settings Change vulnerability found by Jerome Bruandet in WordPress Search Exclude plugin versions = 1.2.2. Solution Update the WordPress Search Exclude plugin to the latest available version at least 1.2.4...
WordPress WP DSGVO Tools (GDPR) plugin <= 2.2.18 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress WP DSGVO Tools GDPR plugin versions = 2.2.18. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 2.2.19...
WordPress WP Fastest Cache plugin <= 0.8.9.5 - Directory Traversal vulnerability
Directory Traversal vulnerability found by Imre Rad in WordPress WP Fastest Cache plugin versions = 0.8.9.5. Solution Update the WordPress WP Fastest Cache plugin to the latest available version at least 0.8.9.6...
WordPress Simple Membership plugin <= 3.8.4 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by rubyman in WordPress Simple Membership plugin versions = 3.8.4. Solution Update the WordPress Simple Membership plugin to the latest available version at least 3.8.5...
WordPress WPGraphQL plugin <= 0.2.3 - Multiple Vulnerabilities
Multiple Vulnerabilities found in WordPress WPGraphQL plugin versions = 0.2.3. Solution Update the WordPress WPGraphQL plugin to the latest available version at least 0.3.0...
WordPress WP Statistics plugin <= 12.6.3 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found in WordPress WP Statistics plugin versions = 12.6.3. Solution Update the WordPress WP Statistics plugin to the latest available version at least 12.6.4...
WordPress Font Organizer plugin <=2.1.1 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found Tim Coen in WordPress Font Organizer plugin versions =2.1.1. Solution 22 March 2019 - we were unable to find a patched version of this plugin. There is a notice on the WordPress plugin repository "This plugin was closed on March 18, 2019 and is no long...
WordPress Contact Form Email plugin <= 1.2.65 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Tim Coen in WordPress Contact Form Email plugin versions = 1.2.65. Solution Update the WordPress Contact Form Email plugin to the latest available version at least 1.2.66...
WordPress Contact Form 7 Multi-Step Forms plugin <= 3.0.8 - Authenticated Option Update vulnerability (Fremius Library security issue)
Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Contact Form 7 Multi-Step Forms plugin versions = 3.0.8. Solution Update the WordPress Contact Form 7 Multi-Step Forms plugin to the latest available version at least 3.0.9...
WordPress Social Network Tabs premium plugin <=1.7.1 - Social Media API Key Leakage vulnerability
Social Media API Key Leakage vulnerability found by @fs0c131y in WordPress Social Network Tabs premium plugin versions =1.7.1. Solution 26 January 2019 - we were unable to find any information about the patched version of this plugin. We recommend to deactivate and delete this plugin from your...
WordPress <= 5.0 - File Upload to XSS on Apache Web Servers vulnerability
File Upload to XSS on Apache Web Servers vulnerability found by Tim Coen and Slavco in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...
WordPress Arigato Autoresponder and Newsletter plugin <= 2.5.1.8 - Authenticated Blind SQL Injection (SQLi) vulnerability
Authenticated Blind SQL Injection SQLi vulnerability found by Larry W. Cashdollar in WordPress Arigato Autoresponder and Newsletter plugin versions = 2.5.1.8. Solution Update the WordPress Arigato Autoresponder and Newsletter plugin to the latest available version at least 2.5.2...
WordPress Gift Voucher plugin <=1.0.5 - Authenticated Blind SQL Injection (SQLi) vulnerability
Authenticated Blind SQL Injection SQLi vulnerability found by Renos Nikolaou in WordPress Gift Voucher plugin versions =2.0.1. Solution 2018.09.01 - we were unable to find information about fixed vulnerability...
WordPress Chained Quiz plugin <= 1.0.8 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability found by Qlirim Emini in WordPress Chained Quiz plugin versions = 1.0.8. Solution Update the WordPress Chained Quiz plugin to the latest available version at least 1.0.9...
WordPress WooCommerce Quick Reports plugin <= 1.0.6 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Research Team in WordPress WooCommerce Quick Reports plugin versions = 1.0.6. Solution 3 June 2018 - plugin still closed by WordPress Security team, no patched version available...
WordPress WP Security Audit Log plugin <=3.1.1 - Sensitive Information Disclosure
Sensitive Information Disclosure found in WordPress WP Security Audit Log plugin versions =3.1.1. Failed login log files indexable by Google. Solution Update the WordPress WP Security Audit Log plugin to the latest available version at least 3.1.2...
WordPress Activity Log plugin <=2.4.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities
Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress Activity Log plugin versions =2.4.0 Solution Update the WordPress Activity Log plugin to the latest available version at least 2.4.1...
WordPress Bookly plugin <= 14.4 - Unauth. Stored Cross-Site Scripting (XSS) vulnerability
Unauth. Stored Cross-Site Scripting XSS vulnerability discovered by Luigi in the WordPress Bookly plugin versions = 14.4. Solution Update the WordPress Bookly plugin to the latest available version at least 14.5...
WordPress SagePay Server Gateway for WooCommerce plugin <=1.0.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability
Unauthenticated Cross-Site Scripting XSS vulnerability found in WordPress SagePay Server Gateway for WooCommerce plugin versions =1.0.8. Solution Update the WordPress SagePay Server Gateway for WooCommerce plugin to the latest available version at least 1.0.9...
WordPress Simple Download Monitor plugin <=3.5.3 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by wpl0v3r in WordPress Simple Download Monitor plugin versions =3.5.3. Vulnerable to Cross-Site Scripting via the "sdmuploadthumbnail" parameter in an edit action to wp-admin/post.php. Solution Update the WordPress Simple Download Monito...
WordPress CSV Import-Export plugin <=1.1.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities
Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress CSV Import-Export plugin versions =1.1.0. Solution Dec 20, 2017 - we were unable to find a patched version of this plugin last updated three years ago. Uninstall or use it at your own risk...
WordPress Duplicator plugin <=1.2.28 – Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by Ricardo Sanchez in WordPress Duplicator plugin versions =1.2.28. The plugin is vulnerable due to incorrectly filtered values "urlnew" and "logging". Solution Update the WordPress Duplicator plugin to the latest available version at least...
WordPress AddToAny Share Buttons plugin <=1.7.14 - Conditional Host Header Injection vulnerability
Conditional Host Header Injection vulnerability found by Paul Dannewitz in WordPress AddToAny Share Buttons plugin. Vulnerable plugin version used Host header instead of homeurl thus allows custom Hostheader injection by crafted link, web cache poisoning and it may end up with sharing malicious...
WordPress Loginizer plugin <=1.3.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Jonas Lejon WPScans in WordPress Loginizer plugin version 1.3.5 and earlier versions. The vulnerability exists in the init.php file of the "Blacklist and Whitelist IP Wizard." Solution Update the WordPress Loginizer plugin to the latest...
WordPress WatuPRO plugin 5.5.1 - SQL Injection vulnerability
SQL Injection vulnerability found by Manich Koomsusi in WatuPRO 5.5.1 WordPress plugin. Data sent with “watuproquestions” parameter not sanitized before SQL statement. Solution Update the WatuPRO WordPress plugin to the latest available version at least 5.5.3.7...
WordPress Event List plugin <=0.7.8 - SQL Injection vulnerability
WordPress Event List plugin =0.7.8 vulnerable to SQL injection. Vulnerability allows an authenticated user to execute arbitrary SQL commands via the "id" parameter to "wp-admin/admin.php" Solution WordPress Event List plugin removed from WordPress.org plugin repository, please deactivate the plug...
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary File Upload
This plugin is prone to an authenticated arbitrary file upload vulnerability. Solution Update the plugin...
WordPress Simplified Content Plugin <= 1.0.0 - Reflected XSS
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
WordPress <= 4.5.1 - XSS
This vulnerability in plupload.flash.swf in Plupload before 2.1.9 allows an attacker to inject arbitrary web script or HTML via a Same-Origin Method Execution SOME attack. Solution Update WordPress...
WordPress <= 4.4 - Service Side Request Forgery
This WordPress version is prone to a service side request forgery vulnerability via crafted address. Solution Upgrade WordPress...
WordPress Infusionsoft Gravity Forms Add-on Plugin <= 1.5.11 - XSS
This plugin is prone to a cross site scripting vulnerability. Solution Upgrade the plugin...
WordPress Ajax Random Post Plugin <= 2.00 - Cross Site Scripting (XSS)
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress New Year Firework Plugin <= 1.1.9 - Cross Site Scripting (XSS)
Because of this vulnerability, the variable text appears to send unsanitized data back to the users browser. The vulnerable file is /new-year-firework/firework/index.php. Solution Update the plugin...
WordPress SiteMile Project Theme 2.0.9.5 - Multiple Vulnerabilities
There are multiple vulnerabilities in this theme, such as stored cross-site scripting, reflected cross-site scripting and cross-site request forgery. Solution Upgrade the theme...
WordPress <= 4.4.1 - SSRF
The vulnerability allows an attacker to conduct these server-side request forgery attacks via a zero value in the first octet of an IPv4 address in the "u" parameter to wp-admin/press-this.php. Solution Update WordPress...
WordPress <= 4.4.0 - Multiple XSS
Multiple cross site scripting vulnerabilities were found in wp-includes/class-wp-theme.php. These vulnerabilities allow the attackers to inject arbitrary web script or HTML via a 1. stylesheet name or 2. template name to wp-admin/customize.php. Solution Upgrade WordPress...
WordPress Wordfence Plugin <= 5.1.4 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress CKEditor Plugin <= 4.0 - Arbitrary File Upload
This plugin is prone to an arbitrary file upload exploit vunerability. Solution There is no fix...
WordPress Wordfence Plugin <= 5.2.3 - Bypass
This plugin is prone to banned IP functionality bypass vulnerability. Unlogged requests won't trigger automatic throttling and banning. Solution Update plugin...
WordPress WooCommerce Plugin <= 1.3 - Absolute Path Traversal
This vulnerability is in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin. It allows an attacker to read arbitrary files in the "requrl" parameter via a full pathname. Solution Update the plugin...
WordPress Church Admin Plugin 0.800 - Stored XSS
Better Church Admin plugins is prone to a stored XSS vulnerability that allow to steal cookies or gain privileged access to the affected site. Solution Fixed in version 0.810...
WordPress Crayon Syntax Highlighter Plugin <= 2.6.10 - Local File Disclosure
This plugin is prone to a local file disclosure vulnerability. It allows attackers to see the content of any file. Solution Update plugin...
WordPress Slideshow Plugin <= 2.2.21 - Bypass
This plugin is prone to option value disclosure vulnerability. Solution Update plugin...
WordPress Twenty Fifteen Theme <= 1.1 - Cross Site Scripting
This WordPress theme is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the theme...
WordPress Photocrati Theme 4.x.x - SQL Injection and XSS
Because of SQL injection and XSS vulnerabilities, an attacker can execute a remote injection in URL site and get an important information. Solution Upgrade the theme...