49933 matches found
WordPress Live Chat - Live support plugin <= 3.1.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Yusuke Fukuda Cryptography Laboratory, Department of Information and Communication Engineering, Tokyo Denki University in WordPress Live Chat - Live support plugin versions = 3.1.0. Solution Update the WordPress Live Chat - Live support plugi...
WordPress Chamber Dashboard Business Directory plugin <= 3.3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Mihkel Raba in WordPress Chamber Dashboard Business Directory plugin versions = 3.3.0. Solution Update the WordPress Chamber Dashboard Business Directory plugin to the latest available version at least 3.3.1...
WordPress Product Input Fields for WooCommerce plugin <= 1.2.6 - Unauthenticated Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download vulnerability discovered by NinTechNet in WordPress Product Input Fields for WooCommerce plugin versions = 1.2.6. Solution Update the WordPress Product Input Fields for WooCommerce plugin to the latest available version at least 1.2.7...
WordPress IMPress for IDX Broker plugin <= 2.6.1 - Authenticated Post Creation, Modification, and Deletion vulnerability
Authenticated Post Creation, Modification, and Deletion vulnerability discovered by WordFence in WordPress IMPress for IDX Broker plugin versions = 2.6.1. Solution Update the WordPress IMPress for IDX Broker plugin to the latest available version at least 2.6.2...
WordPress Abstract Submission plugin <= 0.6 - Unauthenticated Local File Inclusion (LFI) vulnerability
Unauthenticated Local File Inclusion LFI vulnerability discovered by Random Robbie in WordPress Abstract Submission plugin versions = 0.6. Solution Plugin closed. Deactivate and delete...
WordPress Import Export WordPress Users plugin <= 1.3.8 - Arbitrary User Creation vulnerability
Arbitrary User Creation vulnerability discovered by WordFence in WordPress Import Export WordPress Users plugin versions = 1.3.8. Solution Update the WordPress Import Export WordPress Users plugin to the latest available version at least 1.3.9...
WordPress Quiz And Survey Master plugin <= 6.3.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found by strongPiggg in WordPress Quiz And Survey Master plugin versions = 6.3.4. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at least 6.3.5...
WordPress YITH WooCommerce Waiting List plugin <=1.3.10 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability
Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Waiting List plugin versions =1.3.10. Solution Update the WordPress YITH WooCommerce Waiting List plugin to the latest available version at least 1.3.11...
WordPress Simple Membership plugin <= 3.8.4 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by rubyman in WordPress Simple Membership plugin versions = 3.8.4. Solution Update the WordPress Simple Membership plugin to the latest available version at least 3.8.5...
WordPress Custom Simple RSS plugin <= 2.0.6 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by rubyman in WordPress Custom Simple RSS plugin versions = 2.0.6. Solution Update the WordPress Custom Simple RSS plugin to the latest available version at least 2.0.7...
WordPress NextScripts plugin <= 4.2.7 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Tim Coen in WordPress NextScripts plugin versions = 4.2.7. Solution Update the WordPress NextScripts plugin to the latest available version at least 4.2.8...
WordPress Quiz And Survey Master plugin <= 6.2.1 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by Tim Coen in WordPress Quiz And Survey Master plugin versions = 6.2.1. Solution 12 March 2019 - plugin disabled in WordPress plugin repository, but changelog available for the patched version 6.2.2...
WordPress WooCommerce plugin <= 3.5.4 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by Fortinet's FortiGuard Labs Zhouyuan Yang in WordPress WooCommerce plugin versions = 3.5.4. Solution Update the WooCommerce plugin to the latest available version at least 3.5.5...
WordPress <= 5.0 - File Upload to XSS on Apache Web Servers vulnerability
File Upload to XSS on Apache Web Servers vulnerability found by Tim Coen and Slavco in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...
WordPress All In One Favicon plugin <= 4.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities
Multiple Stored Authenticated Cross-Site Scripting XSS vulnerabilities found by Javier Olmedo in WordPress All In One Favicon plugin versions = 4.6. Solution This plugin was closed on July 13, 2018 and is no longer available for download. Deactivate and delete asap...
WordPress Add Social Share Messenger Buttons Whatsapp and Viber plugin <= 1.0.8 - Cross-site Request Forgery (CSRF) vulnerability
Cross-site Request Forgery CSRF vulnerability found by ThreatPress Research Team in WordPress Add Social Share Messenger Buttons Whatsapp and Viber plugin versions = 1.0.8. Solution 3 June 2018 - plugin still closed by WordPress Security team, no patched version available...
WordPress WooCommerce Quick Reports plugin <= 1.0.6 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by ThreatPress Research Team in WordPress WooCommerce Quick Reports plugin versions = 1.0.6. Solution 3 June 2018 - plugin still closed by WordPress Security team, no patched version available...
WordPress Activity Log plugin <=2.4.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities
Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress Activity Log plugin versions =2.4.0 Solution Update the WordPress Activity Log plugin to the latest available version at least 2.4.1...
WordPress Splashing Images plugin <=2.1 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Nicolas Buzy-Debat in WordPress Splashing Images plugin versions =2.1. Possible remote injection of arbitrary web script or HTML via the search parameter to wp-admin/upload.php. Solution Update the WordPress Splashing Images plugin to the latest...
WordPress Email Subscribers & Newsletters plugin <=3.4.7 - Missing Function Level Access Control vulnerability
Missing Function Level Access Control vulnerability that causes leakage of subscribers list found by ThreatPress in WordPress Email Subscribers & Newsletters plugin versions =3.4.7. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 3.4.8...
WordPress Simple Download Monitor plugin <=3.5.3 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by wpl0v3r in WordPress Simple Download Monitor plugin versions =3.5.3. Vulnerable to Cross-Site Scripting via the sdmupload parameter in an edit action to wp-admin/post.php. Solution Update the WordPress Simple Download Monitor plugin to...
WordPress Smart Google Code Inserter plugin <=3.4 - Authorization bypass vulnerability
Authorization bypass vulnerability found by Benjamin Lim in WordPress Smart Google Code Inserter plugin versions =3.4. Solution Update the WordPress Smart Google Code Inserter plugin to the latest available version at least version 3.5...
WordPress AccessPress Anonymous Post Pro plugin <=3.1.8 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability found by Colette Chamberland in WordPress AccessPress Anonymous Post Pro plugin versions =3.1.8. Improper sanitization leads make it possible to upload any file with any extension. Solution Update the WordPress AccessPress Anonymous Post Pro...
WordPress Student Result or Employee Database plugin <=1.6.3 - Authorization Bypass vulnerability
Authorization Bypass vulnerability found by Lim Benjamin found in WordPress Student Result or Employee Database plugin version 1.6.3 and earlier versions. Specific Google dork could find vulnerable websites. Some functions of the plugin do not check the authorization. Solution Update the WordPres...
WordPress Simple Custom CSS and JS plugin <=3.3 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by Chris Liu in WordPress Simple Custom CSS and JS plugin version 3.3 and earlier versions. Solution Update WordPress Simple Custom CSS and JS plugin to the latest available version at least 3.4...
WordPress plugin WP Mail <=1.1 - Reflected Cross Site Scripting (XSS) vulnerability
WordPress plugin WP Mail version 1.1 has Reflected Cross Site Scripting XSS vulnerability and allows an attacker to execute JavaScript in the context of the user receiving the mail. Solution Update plugin to the latest version at least 1.2...
WordPress BBS e-Franchise Plugin <= 1.1.1 - SQL Injection
This plugin is prone to an SQL injection vulnerability. It allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress W3 Total Cache Plugin <= 0.9.4.1 - Arbitrary File Upload
This plugin is prone to an authenticated arbitrary file upload vulnerability. Solution Update the plugin...
WordPress MailPoet Newsletters Plugin <= 2.7.2 - SQL Injection
Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...
WordPress EWWW Image Optimizer Plugin <= 2.8.3 - Remote Code Execution
Because of this vulnerability, attackers can create a backdoor or take a site down altogether. Solution Upgrade this plugin...
WordPress S3 Video Plugin <= 0.983 - Reflected Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Anti Plagiarism Plugin <= 3.60 - Cross-Site Scripting (XSS)
This plugin is prone to a cross site scripting vulnerability, because the variable "m" appears to send unsanitized data back to the users browser. Solution Update the plugin...
WordPress Easy Photo Album Plugin <= 1.1.5 - Information Disclosure
This plugin is prone to an information disclosure vulnerability. Solution Update the plugin...
WordPress <= 4.4.1 - SSRF
The vulnerability allows an attacker to conduct these server-side request forgery attacks via a zero value in the first octet of an IPv4 address in the "u" parameter to wp-admin/press-this.php. Solution Update WordPress...
WordPress Jetpack Plugin <= 3.7.0 - Information Disclosure
This plugin is prone to an information disclosure vulnerability in certain hosting configurations. Solution Update the plugin...
WordPress Cool Video Gallery Plugin <= 1.9 - Command Injection
This vulnerability in lib/core.php allows an attacker to execute arbitrary code via shell metacharacters in the "Width of preview image". Solution Update the plugin...
WordPress Salient Theme <= 4.9 - Cross Site Scripting
This vulnerability allows an attacker to inject arbitrary web script or HTML. Solution Update the theme...
WordPress Landing Pages Plugin <= 1.8.4 - XSS
Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php. Solution Upgrade the plugin...
WordPress WP Cumulus Plugin <= 1.22 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
WordPress Cardoza Poll Plugin <= 34.05 - Cross Site Request Forgery
This plugin is prone to a multiple external function remote poll manipulation. Solution Update the plugin...
WordPress Crayon Syntax Highlighter Plugin <= 2.6.10 - Local File Disclosure
This plugin is prone to a local file disclosure vulnerability. It allows attackers to see the content of any file. Solution Update plugin...
WordPress WPML Plugin <= 3.1.8 - SQL Injection #1
Because of the "menu sync" function, remote attackers can delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php. Related records:...
WordPress SEO by Yoast Plugin <= 1.7.3 - Multiple Vulnerabilities
Multiple cross-site request forgery vulnerabilities exist in admin/class-bulk-editor-list-table.php. Because of these vulnerabilities, the attackers can hijack the authentication of certain users for requests that conduct SQL injection attacks. Solution Update the plugin...
WordPress Contact Form DB Plugin <= 2.8.26 - XSS
This vulnerability allows an attacker to inject arbitrary web script or HTML via the "submittime" parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php. Solution Update the plugin...
WordPress Contact Form DB Plugin <= 2.8.31 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that delete all plugin records. Solution Upgrade the plugin...
WordPress Redirection Page Plugin <= 1.2 - Multiple CSRF and XSS
This plugin is prone to multiple cross site request forgery and cross site scripting vulnerabilities. In that way an attacker can change plugin settings via the "source" or "redir" parameters. Solution Update the plugin...
WordPress Banner Effect Header Plugin <= 1.2.7 - XSS
This vulnerability allows an attacker to inject arbitrary web script or HTML via the "bannereffectdivid" parameter. Solution Update the plugin...
WordPress JS Multi Hotel Plugin <= 2.2.1 - XSS
Because of this cross site scripting vulnerability in includes/deleteimg.php, the attackers can inject arbitrary web script or HTML via the "path" parameter. Solution Update the plugin...
WordPress mTouch Quiz Plugin <= 3.0.6 - Multiple XSS
Because of these vulnerabilities in question.php, the attackers can inject arbitrary web script or HTML via the "quiz" parameter to wp-admin/edit.php. Solution Update the plugin...
WordPress Facebook Like Box Plugin <= 2.8.2 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...