WordPress 10Web Map Builder for Google Maps <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting (XSS) via Plugin Settings Change vulnerability

Unauthenticated Stored Cross-Site Scripting XSS via Plugin Settings Change vulnerability found by Sean Murphy, QA Lead Matt Rusnak, and QA Engineer Ramuel Gall Wordfence in WordPress 10Web Map Builder for Google Maps = 1.0.63. Solution Update the WordPress 10Web Map Builder for Google Maps plugin...

WordPress Profile Builder plugin <= 3.1.0 - User Registration With Administrator Role vulnerability

User Registration With Administrator Role vulnerability found by Noman Riffat in WordPress Profile Builder plugin versions = 3.1.0. Solution Update the WordPress Profile Builder plugin to the latest available version at least 3.1.1...

WordPress Login by Auth0 plugin <= 3.11.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Muhamad Visat in WordPress Login by Auth0 plugin versions = 3.11.2. Solution Update the WordPress Login by Auth0 plugin to the latest available version at least 3.11.3...

WordPress Code Snippets plugin <= 2.13.3 - Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE) vulnerability

Cross-Site Request Forgery CSRF to Remote Code Execution RCE vulnerability found by Chloe Chamberland in WordPress Code Snippets plugin versions = 2.13.3. Solution Update the WordPress Code Snippets plugin to the latest available version at least 2.14.0...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <=5.127.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin versions =5.127.3. Solution Update the WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin to the latest available version at least 5.127.4...

WordPress SlickQuiz plugin <= 1.3.7.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Julien Ahrens in WordPress SlickQuiz plugin versions = 1.3.7.1 Solution 11 September 2019 - we were unable to find a patched version of this plugin...

WordPress Variation Swatches for WooCommerce plugin <= 1.0.61 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found in WordPress Variation Swatches for WooCommerce plugin versions = 1.0.61. Solution Update the WordPress Variation Swatches for WooCommerce plugin to the latest available version at least 1.0.62...

WordPress WooCommerce Product Feed plugin <= 3.1.14 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Damian Ebelties in WordPress WooCommerce Product Feed plugin versions = 3.1.14. Solution Update the WordPress WooCommerce Product Feed plugin to the latest available version at least 3.1.15...

WordPress WP DSGVO Tools (GDPR) plugin <= 2.2.18 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress WP DSGVO Tools GDPR plugin versions = 2.2.18. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 2.2.19...

WordPress WP SVG Icons plugin <= 3.2.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by zeroauth in WordPress WP SVG Icons plugin versions = 3.2.2. Solution Update the WordPress WP SVG Icons plugin to the latest available version at least 3.2.3...

WordPress WP Fastest Cache plugin <= 0.8.9.5 - Directory Traversal vulnerability

Directory Traversal vulnerability found by Imre Rad in WordPress WP Fastest Cache plugin versions = 0.8.9.5. Solution Update the WordPress WP Fastest Cache plugin to the latest available version at least 0.8.9.6...

WordPress AdRotate Banner Manager plugin <= 5.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Tin Duong in WordPress AdRotate Banner Manager plugin versions = 5.2. Solution Update the WordPress AdRotate Banner Manager plugin to the latest available version at least 5.3...

WordPress WPGraphQL plugin <= 0.2.3 - Multiple Vulnerabilities

Multiple Vulnerabilities found in WordPress WPGraphQL plugin versions = 0.2.3. Solution Update the WordPress WPGraphQL plugin to the latest available version at least 0.3.0...

WordPress Font Organizer plugin <=2.1.1 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found Tim Coen in WordPress Font Organizer plugin versions =2.1.1. Solution 22 March 2019 - we were unable to find a patched version of this plugin. There is a notice on the WordPress plugin repository "This plugin was closed on March 18, 2019 and is no long...

WordPress Social Network Tabs premium plugin <=1.7.1 - Social Media API Key Leakage vulnerability

Social Media API Key Leakage vulnerability found by @fs0c131y in WordPress Social Network Tabs premium plugin versions =1.7.1. Solution 26 January 2019 - we were unable to find any information about the patched version of this plugin. We recommend to deactivate and delete this plugin from your...

WordPress <= 5.0 - File Upload to XSS on Apache Web Servers vulnerability

File Upload to XSS on Apache Web Servers vulnerability found by Tim Coen and Slavco in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...

WordPress Arigato Autoresponder and Newsletter plugin <= 2.5.1.8 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability found by Larry W. Cashdollar in WordPress Arigato Autoresponder and Newsletter plugin versions = 2.5.1.8. Solution Update the WordPress Arigato Autoresponder and Newsletter plugin to the latest available version at least 2.5.2...

WordPress FV Flowplayer Video Player plugin <=6.6.4 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress FV Flowplayer Video Player plugin versions =6.6.4. Solution Update the WordPress FV Flowplayer Video Player plugin to the latest available version at least 6.6.5...

WordPress UserPro premium plugin <= 4.9.23 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Yonatan Correa in WordPress UserPro premium plugin versions = 4.9.23. Solution Update the WordPress UserPro premium plugin to the latest available version at least 4.9.24...

WordPress Export Users to CSV plugin <= 1.1.1 - CSV Injection vulnerability

CSV Injection vulnerability found by Javier Olmedo in WordPress Export Users to CSV plugin versions = 1.1.1. Solution 2018.09.01 - we were unable to find a patched version of this plugin...

WordPress Geo Mashup plugin <= 1.10.3 - Unspecified Cross-Site Scripting (XSS) vulnerability

Unspecified Cross-Site Scripting XSS vulnerability found in WordPress Geo Mashup plugin versions = 1.10.3. Solution Update the WordPress Geo Mashup plugin to the latest available version at least 1.10.4...

WordPress All In One Favicon plugin <= 4.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Authenticated Cross-Site Scripting XSS vulnerabilities found by Javier Olmedo in WordPress All In One Favicon plugin versions = 4.6. Solution This plugin was closed on July 13, 2018 and is no longer available for download. Deactivate and delete asap...

WordPress Woo Checkout for Digital Goods plugin <= 2.1 - Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery CSRF vulnerability found by ThreatPress Research Team in WordPress Woo Checkout for Digital Goods plugin versions = 2.1. Solution Update the WordPress Woo Checkout for Digital Goods plugin to the latest available version at least 2.2...

WordPress Events Manager plugin <=5.8.1.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability found in WordPress Events Manager plugin versions =5.8.1.1. Solution Update the WordPress Events Manager plugin to the latest version at least 5.8.1.2...

WordPress File Manager plugin <=5.0.0 - Information Disclosure vulnerability

Information Disclosure vulnerability found in WordPress File Manager plugin versions =5.0.0. Solution Update the WordPress File Manager plugin to the latest available version at least 5.0.2...

WordPress PropertyHive plugin <=1.4.14 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress PropertyHive plugin versions =1.4.14. Cross-Site Scripting possible via the body parameter "includes/admin/views/html-preview-applicant-matches-email.php". Solution Update the WordPress PropertyHive plugin to the latest available version a...

WordPress Smart Google Code Inserter plugin <= 3.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Benjamin Lim in WordPress Smart Google Code Inserter plugin versions = 3.4. Solution Update the WordPress Smart Google Code Inserter plugin to the latest available version at least 3.5...

WordPress Smart Google Code Inserter plugin <=3.4 - Authorization bypass vulnerability

Authorization bypass vulnerability found by Benjamin Lim in WordPress Smart Google Code Inserter plugin versions =3.4. Solution Update the WordPress Smart Google Code Inserter plugin to the latest available version at least version 3.5...

WordPress amtyThumb posts plugin 8.1.3 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found in WordPress amtyThumb posts plugin version 8.1.3. Solution 02.12.2017 - no information about the patched version. The last version released one year ago. Looks like abandoned plugin, use with caution, or uninstall...

WordPress User Login History plugin <=1.5 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress User Login History plugin versions =1.5. Solution Update the WordPress User Login History plugin to the latest available version at least version 1.6...

WordPress AddToAny Share Buttons plugin <=1.7.14 - Conditional Host Header Injection vulnerability

Conditional Host Header Injection vulnerability found by Paul Dannewitz in WordPress AddToAny Share Buttons plugin. Vulnerable plugin version used Host header instead of homeurl thus allows custom Hostheader injection by crafted link, web cache poisoning and it may end up with sharing malicious...

WordPress Loginizer plugin <=1.3.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jonas Lejon WPScans in WordPress Loginizer plugin version 1.3.5 and earlier versions. The vulnerability exists in the init.php file of the "Blacklist and Whitelist IP Wizard." Solution Update the WordPress Loginizer plugin to the latest...

WordPress Gravity Forms Plugin <= 2.0.6.5 - XSS

This plugin is prone to a cross site scripting vulnerability. It allows attackers to inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Page Layout Builder Plugin <= 1.9.3 - Reflected XSS

This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...

WordPress HDW Tube Plugin <= 1.2 - Reflected XSS

This plugin is prone to a cross site scripting vulnerability via /hdw-tube/mychannel.php file. Solution Update the plugin...

WordPress <= 4.5.1 - XSS

This vulnerability in plupload.flash.swf in Plupload before 2.1.9 allows an attacker to inject arbitrary web script or HTML via a Same-Origin Method Execution SOME attack. Solution Update WordPress...

WordPress <= 4.4 - Service Side Request Forgery

This WordPress version is prone to a service side request forgery vulnerability via crafted address. Solution Upgrade WordPress...

WordPress New Year Firework Plugin <= 1.1.9 - Cross Site Scripting (XSS)

Because of this vulnerability, the variable text appears to send unsanitized data back to the users browser. The vulnerable file is /new-year-firework/firework/index.php. Solution Update the plugin...

WordPress Tidio Gallery Plugin <= 1.1 - Cross Site Scripting (XSS)

This vulnerability is in the php code /tidio-gallery/popup-insert-help.php. Solution Update the plugin...

WordPress Easy Photo Album Plugin <= 1.1.5 - Information Disclosure

This plugin is prone to an information disclosure vulnerability. Solution Update the plugin...

WordPress Bulk Delete Plugin 5.5.3 - Privilege Escalation

Because of this vulnerability, an attacker can perform all administrative tasks, such as delete all pages by status, delete all posts by type or delete all users. Solution Update the plugin...

WordPress <= 4.4.1 - SSRF

The vulnerability allows an attacker to conduct these server-side request forgery attacks via a zero value in the first octet of an IPv4 address in the "u" parameter to wp-admin/press-this.php. Solution Update WordPress...

WordPress <= 4.4.0 - Multiple XSS

Multiple cross site scripting vulnerabilities were found in wp-includes/class-wp-theme.php. These vulnerabilities allow the attackers to inject arbitrary web script or HTML via a 1. stylesheet name or 2. template name to wp-admin/customize.php. Solution Upgrade WordPress...

WordPress CKEditor Plugin <= 4.0 - Arbitrary File Upload

This plugin is prone to an arbitrary file upload exploit vunerability. Solution There is no fix...

WordPress Jetpack Plugin <= 3.7.0 - Information Disclosure

This plugin is prone to an information disclosure vulnerability in certain hosting configurations. Solution Update the plugin...

WordPress Floating Social Bar Plugin <= 1.1.5 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via the "items" parameter in an fsbsaveorder action to wp-admin/admin-ajax.php. Solution Update the plugin...

WordPress Swim Team Plugin <= 1.44.10777 - Absolute Path Traversal

This vulnerability is in include/user/download.php. It allows an attacker to read arbitrary files via a full pathname in the "file" parameter. Solution Update the plugin...

WordPress Wordfence Plugin <= 5.2.3 - Bypass

This plugin is prone to banned IP functionality bypass vulnerability. Unlogged requests won't trigger automatic throttling and banning. Solution Update plugin...

WordPress WooCommerce Plugin <= 1.3 - Absolute Path Traversal

This vulnerability is in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin. It allows an attacker to read arbitrary files in the "requrl" parameter via a full pathname. Solution Update the plugin...

WordPress NewStatPress Plugin 0.9.8 - Multiple Vulnerabilities

NewStatPress plugin is prone to multiple vulnerabilities, such as authenticated SQL injection and authenticated XSS. Solution Update the plugin...