Lucene search
+L
PatchstackMost viewed

47810 matches found

Patchstack
Patchstack
•added 2020/01/10 12:0 a.m.•21 views

WordPress EasyBook premium theme <= 1.2.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by m0ze in WordPress EasyBook premium theme versions = 1.2.1. Solution Update the WordPress EasyBook premium theme to the latest available version at least 1.2.2...

7.5CVSS2.6AI score0.0317EPSS
SaveExploits4References2Affected Software1
Patchstack
Patchstack
•added 2019/12/27 12:0 a.m.•21 views

WordPress bbPress Login Register Links On Forum Topic Pages plugin <= 2.7.5 - Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability

CSRF to Stored XSS vulnerability found in WordPress bbPress Login Register Links On Forum Topic Pages plugin versions = 2.7.5. Solution Update the WordPress bbPress Login Register Links On Forum Topic Pages plugin to the latest available version at least 2.8.5...

2.3AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2019/10/31 12:0 a.m.•21 views

WordPress YITH WooCommerce Authorize.net Payment Gateway plugin <=1.1.12 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Authorize.net Payment Gateway plugin versions =1.1.12. Solution Update the WordPress YITH WooCommerce Authorize.net Payment Gateway plugin to the latest available versio...

4.3CVSS3.1AI score0.00948EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2019/10/17 12:0 a.m.•21 views

WordPress EU Cookie Law plugin <= 3.0.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Tobias Fink SBA Research in WordPress EU Cookie Law plugin versions = 3.0.6. Solution 17 October 2019 - we were unable to find a patched version of this plugin...

4.8CVSS2AI score0.01033EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2019/10/17 12:0 a.m.•21 views

WordPress WP SlackSync premium plugin <= 1.8.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability found by fs0c131y in WordPress WP SlackSync premium plugin versions = 1.8.5. Solution Update the WordPress WP SlackSync premium plugin to the latest available version at least 1.8.6...

7.5CVSS2.5AI score0.01677EPSS
SaveExploits0References3Affected Software1
Patchstack
Patchstack
•added 2019/08/29 12:0 a.m.•21 views

WordPress WP Social Feed Gallery plugin <= 2.4.7 - Authorization Check vulnerability

Authorization Check vulnerability found in WordPress WP Social Feed Gallery plugin versions = 2.4.7. Solution Update the WordPress WP Social Feed Gallery plugin to the latest available version at least 2.4.8...

8.8CVSS3.8AI score0.00691EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2019/07/10 12:0 a.m.•21 views

WordPress Zoho SalesIQ plugin <= 1.0.8 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities found by Cryptography Laboratory in WordPress Zoho SalesIQ plugin versions = 1.0.8. Solution Update the WordPress Zoho SalesIQ plugin to the latest available version at least 1.0.9...

2.1AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2019/07/10 12:0 a.m.•21 views

WordPress Personalized WooCommerce Cart Page plugin <= 2.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Cryptography Laboratory in WordPress Personalized WooCommerce Cart Page plugin versions = 2.4. Solution Update the WordPress Personalized WooCommerce Cart Page plugin to the latest available version at least 2.5...

8.8CVSS3.1AI score0.01047EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2019/03/12 12:0 a.m.•21 views

WordPress Quiz And Survey Master plugin <= 6.2.1 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Tim Coen in WordPress Quiz And Survey Master plugin versions = 6.2.1. Solution 12 March 2019 - plugin disabled in WordPress plugin repository, but changelog available for the patched version 6.2.2...

6.1CVSS1.7AI score0.01608EPSS
SaveExploits2References1Affected Software1
Patchstack
Patchstack
•added 2019/02/26 12:0 a.m.•21 views

WordPress WooCommerce plugin <= 3.5.4 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Fortinet's FortiGuard Labs Zhouyuan Yang in WordPress WooCommerce plugin versions = 3.5.4. Solution Update the WooCommerce plugin to the latest available version at least 3.5.5...

6.1CVSS1.5AI score0.00983EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2018/12/07 12:0 a.m.•21 views

WordPress Contact Form by WPForms plugin <= 1.4.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by RIPS Technologies in WordPress Contact Form by WPForms plugin versions = 1.4.7. Solution Update the WordPress Contact Form by WPForms plugin to the latest available versions at least 1.4.8...

2.2AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2018/11/08 12:0 a.m.•21 views

WordPress RSVPMaker plugin <= 5.6.3 - SQL Injection (SQLi) vulnerabilities

SQL Injection SQLi vulnerabilities found in WordPress RSVPMaker plugin versions = 5.6.3. Solution Update the WordPress RSVPMaker plugin to the latest available version at least 5.6.4...

9.8CVSS3.3AI score0.02244EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2018/09/09 12:0 a.m.•21 views

WordPress UserPro premium plugin <= 4.9.23 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Yonatan Correa in WordPress UserPro premium plugin versions = 4.9.23. Solution Update the WordPress UserPro premium plugin to the latest available version at least 4.9.24...

6.1CVSS2AI score0.01345EPSS
SaveExploits2References1Affected Software1
Patchstack
Patchstack
•added 2018/07/18 12:0 a.m.•21 views

WordPress Geo Mashup plugin <= 1.10.3 - Unspecified Cross-Site Scripting (XSS) vulnerability

Unspecified Cross-Site Scripting XSS vulnerability found in WordPress Geo Mashup plugin versions = 1.10.3. Solution Update the WordPress Geo Mashup plugin to the latest available version at least 1.10.4...

9.8CVSS1.5AI score0.03054EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2018/07/18 12:0 a.m.•21 views

WordPress All In One Favicon plugin <= 4.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Authenticated Cross-Site Scripting XSS vulnerabilities found by Javier Olmedo in WordPress All In One Favicon plugin versions = 4.6. Solution This plugin was closed on July 13, 2018 and is no longer available for download. Deactivate and delete asap...

4.8CVSS2.7AI score0.02003EPSS
SaveExploits6References1Affected Software1
Patchstack
Patchstack
•added 2018/06/03 12:0 a.m.•21 views

WordPress Advance Search for WooCommerce plugin <= 1.0.9 - Stored Cross-site scripting (XSS) vulnerability

Stored Cross-site scripting XSS vulnerability found by ThreatPress Research Team in WordPress Advance Search for WooCommerce plugin versions = 1.0.9. Solution 3 June 2018 - plugin still closed by WordPress Security team, no patched version available...

6.1CVSS1.2AI score0.00802EPSS
SaveExploits1References2Affected Software1
Patchstack
Patchstack
•added 2018/04/09 12:0 a.m.•21 views

WordPress Relevanssi plugin <=4.0.4 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Relevanssi plugin versions =4.0.4. Attackers can inject arbitrary JavaScript or HTML via the GET parameter. Solution 09.04.2018 - Several sources claim that you need to update to the version 4.1, but we were unable to find this version on...

5.4CVSS1.9AI score0.02009EPSS
SaveExploits5Affected Software1
Patchstack
Patchstack
•added 2018/04/03 12:0 a.m.•21 views

WordPress File Upload plugin <=4.3.2 - Security Issue in plugin shortcodes

Security Issue in plugin shortcodes found in WordPress File Upload plugin versions =4.3.2. Solution Update the WordPress File Upload plugin to the latest available version at least 4.3.3...

5.4CVSS2.7AI score0.03244EPSS
SaveExploits5References1Affected Software1
Patchstack
Patchstack
•added 2018/03/15 12:0 a.m.•21 views

WordPress WP Support Plus Responsive Ticket System plugin <=9.0.2 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities

Multiple Authenticated SQL Injection SQLi vulnerabilities found by 00theway in WordPress WP Support Plus Responsive Ticket System plugin versions =9.0.2. Solution Update the WordPress WP Support Plus Responsive Ticket System plugin to the latest available version at least 9.0.3...

9.8CVSS3.3AI score0.02092EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2018/03/12 12:0 a.m.•21 views

WordPress Import any XML or CSV File to WordPress plugin <=3.4.5 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Mardan Muhidin in WordPress Import any XML or CSV File to WordPress plugin versions =3.4.5. Solution Update the WordPress Import any XML or CSV File to WordPress plugin to the latest available version at least 3.4.6...

6.1CVSS1.4AI score0.01482EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2018/03/02 12:0 a.m.•21 views

WordPress File Manager plugin <=5.0.0 - Information Disclosure vulnerability

Information Disclosure vulnerability found in WordPress File Manager plugin versions =5.0.0. Solution Update the WordPress File Manager plugin to the latest available version at least 5.0.2...

7.5CVSS2.4AI score0.02827EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2018/01/30 12:0 a.m.•21 views

WordPress Social Media Widget by Acurax plugin <=3.2.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Panagiotis Vagenas in WordPress Social Media Widget by Acurax plugin versions =3.2.5. Solution Update the WordPress Social Media Widget by Acurax plugin to the latest available version at least 3.2.6...

8.8CVSS3.2AI score0.00649EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2018/01/09 12:0 a.m.•21 views

WordPress GD Rating System plugin 2.3 - Directory Traversal vulnerability (3)

A third Directory Traversal vulnerability found by d4wner in WordPress GD Rating System plugin version 2.3. Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. Solution 1/9/2018 - we were unable to find a patched version of this plugin...

7.5CVSS2.8AI score0.03699EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2018/01/09 12:0 a.m.•21 views

WordPress Simple Download Monitor plugin <=3.5.3 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by wpl0v3r in WordPress Simple Download Monitor plugin versions =3.5.3. Vulnerable to Cross-Site Scripting via the sdmupload parameter in an edit action to wp-admin/post.php. Solution Update the WordPress Simple Download Monitor plugin to...

5.4CVSS3.3AI score0.0102EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2017/12/20 12:0 a.m.•21 views

WordPress AccessPress Anonymous Post Pro plugin <=3.1.8 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found by Colette Chamberland in WordPress AccessPress Anonymous Post Pro plugin versions =3.1.8. Improper sanitization leads make it possible to upload any file with any extension. Solution Update the WordPress AccessPress Anonymous Post Pro...

9.8CVSS3.8AI score0.19151EPSS
SaveExploits6References1Affected Software1
Patchstack
Patchstack
•added 2017/12/02 12:0 a.m.•21 views

WordPress amtyThumb posts plugin 8.1.3 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found in WordPress amtyThumb posts plugin version 8.1.3. Solution 02.12.2017 - no information about the patched version. The last version released one year ago. Looks like abandoned plugin, use with caution, or uninstall...

6.1CVSS2AI score0.03419EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2017/07/25 12:0 a.m.•21 views

WordPress Simple Custom CSS and JS plugin <=3.3 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Chris Liu in WordPress Simple Custom CSS and JS plugin version 3.3 and earlier versions. Solution Update WordPress Simple Custom CSS and JS plugin to the latest available version at least 3.4...

6.1CVSS2AI score0.01466EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2017/02/10 12:0 a.m.•21 views

WordPress plugin WP Mail <=1.1 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress plugin WP Mail version 1.1 has Reflected Cross Site Scripting XSS vulnerability and allows an attacker to execute JavaScript in the context of the user receiving the mail. Solution Update plugin to the latest version at least 1.2...

6.1CVSS3AI score0.00957EPSS
SaveExploits1References3Affected Software1
Patchstack
Patchstack
•added 2017/01/10 12:0 a.m.•21 views

WordPress plugin WP Support Plus Responsive Ticket System <= 7.1.3 - Privilege Escalation

WordPress plugin WP Support Plus Responsive Ticket System 7.1.3 earlier versions and 7.1.4 vulnerable to privilege escalation. It is possible to log in as any user without knowing password due to the incorrect usage of "wpsetauthcookie". Solution Update the plugin to the latest version atleast...

4.1AI score
SaveExploits0References2Affected Software1
Patchstack
Patchstack
•added 2016/11/28 12:0 a.m.•21 views

WordPress Whois Domain Plugin - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...

1.9AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2016/11/08 12:0 a.m.•21 views

WordPress YITH WooCommerce Compare Plugin <= 2.0.9 - PHP Object injection

Because of this vulnerability, attackers can execute arbitrary PHP code. Solution Update the plugin...

5.7AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2016/06/23 12:0 a.m.•21 views

WordPress <= 4.5.2 - XSS #1

WordPress version 4.5.2 is prone to a cross-site scripting XSS vulnerability in the wpgetattachmentlink function in wp-includes/post-template.php. It allows an attacker to inject arbitrary web script or HTML via a crafted attachment name. Related:...

6.1CVSS3.4AI score0.02123EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2016/04/12 12:0 a.m.•21 views

WordPress Anti Plagiarism Plugin <= 3.60 - Cross-Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because the variable "m" appears to send unsanitized data back to the users browser. Solution Update the plugin...

6.1CVSS3.8AI score0.04195EPSS
SaveExploits2References1Affected Software1
Patchstack
Patchstack
•added 2016/04/12 12:0 a.m.•21 views

WordPress Tidio Gallery Plugin <= 1.1 - Cross Site Scripting (XSS)

This vulnerability is in the php code /tidio-gallery/popup-insert-help.php. Solution Update the plugin...

6.1CVSS1.6AI score0.04486EPSS
SaveExploits2References1Affected Software1
Patchstack
Patchstack
•added 2016/03/03 12:0 a.m.•21 views

WordPress Bulk Delete Plugin 5.5.3 - Privilege Escalation

Because of this vulnerability, an attacker can perform all administrative tasks, such as delete all pages by status, delete all posts by type or delete all users. Solution Update the plugin...

3.9AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/08/25 12:0 a.m.•21 views

WordPress Simple Fields Plugin <= 1.4.10 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

2.4AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/08/10 12:0 a.m.•21 views

WordPress Email Encoder Bundle Plugin <= 1.4.1 - Cross Site Scripting

Because of this vulnerability, unauthenticated users can inject HTML or JS code. Solution Update the plugin...

1.4AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/07/16 12:0 a.m.•21 views

WordPress Floating Social Bar Plugin <= 1.1.5 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via the "items" parameter in an fsbsaveorder action to wp-admin/admin-ajax.php. Solution Update the plugin...

4.3CVSS2.5AI score0.02067EPSS
SaveExploits2References1Affected Software1
Patchstack
Patchstack
•added 2015/07/10 12:0 a.m.•21 views

WordPress Swim Team Plugin <= 1.44.10777 - Absolute Path Traversal

This vulnerability is in include/user/download.php. It allows an attacker to read arbitrary files via a full pathname in the "file" parameter. Solution Update the plugin...

5.3CVSS5.6AI score0.32483EPSS
SaveExploits3References1Affected Software1
Patchstack
Patchstack
•added 2015/05/31 12:0 a.m.•21 views

WordPress WP Smiley Plugin <= 1.4.1 - XSS

This vulnerability allows an authenticated user to inject arbitrary web script or HTML via the "s4w-more" parameter to wp-admin/options-general.php. Solution Update the plugin...

3.5CVSS1.4AI score0.01564EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2015/05/15 12:0 a.m.•21 views

WordPress GRAND Flash Album Gallery Plugin <= 2.55 - SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Vulnerable parameter "gid". Solution Update the plugin...

5.5AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/05/15 12:0 a.m.•21 views

WordPress Zingiri Web Shop Plugin <= 2.5.0 - Arbitrary Code Execution

This plugin is prone to ajaxfilemanager.php path parameter file upload arbitrary code execution. Solution Update the plugin...

2.8AI score
SaveExploits0References2Affected Software1
Patchstack
Patchstack
•added 2015/05/15 12:0 a.m.•21 views

WordPress Mail Subscribe List Plugin <= 2.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...

2.1AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/04/21 12:0 a.m.•21 views

WordPress Tune Library Plugin 1.5.4 - SQL Injection

This WordPress Tune Library plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

8.1CVSS3.7AI score0.04868EPSS
SaveExploits6References1Affected Software1
Patchstack
Patchstack
•added 2015/04/06 12:0 a.m.•21 views

WordPress QAEngine Theme - Privilege Escalation

Because of this vulnerability, the attackers can have an administrator account on the target's website. Solution Update the theme...

5AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/03/09 12:0 a.m.•21 views

WordPress Custom Community Theme <= 2.0.24 - Stored XSS

Because of this vulnerability, any user can perform a stored XSS attack. Solution Update the theme...

2.2AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/03/03 12:0 a.m.•21 views

WordPress Audio Player Plugin <= 2.0 - Multiple SQL Injection

Because of these vulnerabilities, the administrators can execute arbitrary SQL commands via the "itemid" parameter in the wonderpluginaudioshowitem. Also, an authenticated user can execute arbitrary SQL commands via the "itemid" parameter in a wonderpluginaudiosaveitem action to...

6.5CVSS6.3AI score0.02582EPSS
SaveExploits2References1Affected Software1
Patchstack
Patchstack
•added 2015/02/09 12:0 a.m.•21 views

WordPress WPLMS Learning Management System Theme <= 1.8.4.1 - Privilege Escalation

Because of this vulnerability, the attackers can have an administrator account on the target's website. Solution Update the theme...

4.8AI score
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2015/01/13 12:0 a.m.•21 views

WordPress JS Multi Hotel Plugin <= 2.2.1 - XSS

Because of this cross site scripting vulnerability in includes/deleteimg.php, the attackers can inject arbitrary web script or HTML via the "path" parameter. Solution Update the plugin...

4.3CVSS2.7AI score0.02041EPSS
SaveExploits1References1Affected Software1
Patchstack
Patchstack
•added 2015/01/13 12:0 a.m.•21 views

WordPress Photocrati Theme - Cross Site Scripting

Because of this vulnerability in photocrati-gallery/ecomm-sizes.php, the attackers can inject arbitrary web script or HTML via the "prodid" parameter. Solution Update the theme...

4.3CVSS3.1AI score0.02041EPSS
SaveExploits1References1Affected Software1
Total number of security vulnerabilities5000