4359 matches found
Form Maker by 10Web < 1.13.36 - Authenticated SQL Injection
Authenticated admin+ SQL injection in the Form Maker by 10Web WordPress Plugin 1.13.35 exists via the /wordpress/wp-admin/admin.php?page=blockedipsfm=1" s parameter. Edit WPScanTeam: - Initial reported version 5.4.1 does not exist, confirmed to be 1.13.35 by researcher - May 25th, 2020 - details...
wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via s Parameter
The plugin did not escape, validate or escape the 's' GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in admin https://example.com/wp-admin/admin.php?page=wpforo-phrases&s="alert/XSS/...
WP Last Modified Info < 1.6.6 - Authenticated Stored XSS
When saving a new campaign, a user with administrator capabilities can store scripts in the plugin's options. The code can then be executed on every page or post on the website. An administrator can store scripts in the "Custom Message to Display on Posts" text input field. Reason for this was...
Ultimate Membership Pro < 8.7 - Cross-Site Request Forgery allowing Arbitrary Account Deletion and Creation
While confirming the issues from https://wpvulndb.com/vulnerabilities/10086 have been remediated, two CSRF issues were identified, allowing attackers to make logged in administrator delete arbitrary accounts, as well as create a new administrator account. Other CSRF may be present but haven't bee...
AccessAlly < 3.3.2 - Unauthenticated Arbitrary PHP Code Execution
Prior to version 3.3.2, this plugin allowed arbitrary PHP code execution through the loginerror function. This exploit is out in the wild now and actively being exploited. curl -Ls http://www.example.com/login/?loginerror=%3C?%20$a%20=%20getcwd;%20echo%20$a;%20?%3E...
ListingPro < 2.5.4 - Unauthenticated Reflected Cross-Site Scripting
Reflected XSS was discovered in the «ListingPro - WordPress Directory Theme», tested version — v2.5.3 Edit - WPScanTeam: January 13th, 2020 - Report Received & Envato Contacted January 13th, 2020 - Envato Investigating January 15th, 2020 - Theme updated, v2.5.4, fixing the issue ----- Info: -----...
About Author <= 1.3.9 - Authenticated Stored Cross-Site Scripting (XSS)
Wordpress About Author plugin with a version lower or equal with 1.3.9 is affected by an authenticated Stored Cross-site scripting XSS vulnerability. Stored Cross-site scripting XSS: - Using an Wordpress user, access /wp-admin/post-new.php?posttype=aboutauthor About Author Add new - Insert in...
School Management < 57.0 - CSRF and Stored XSS
CSRF and Stored XSS Cross Site Scripting Edit WPScanTeam: June 17th - Issue Reported to Envato June 17th - Envato Support confirmed they are investigating the issue June 28th - New version released, fixing the XSS but not the CSRF. Envato notified July 5th - Demo fixed, new version to be released...
FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS
The vulnerable function is exposed to unauthenticated users over wpajaxnoprivfvwpflowplayeremailsignup ajax hook. It saves anything that user provides in email POST parameter. Send POST request to wp-admin/admin-ajax.php with body content: "action=fvwpflowplayeremailsignup&list=1&[email protected]"...
CarSpot Theme <= 2.1.6 - Authenticated Stored XSS
Bad input field data filtering has been discovered in the 'CarSpot – Automotive Car Dealer Wordpress Classified Theme'. Current version of this Premium Theme is 2.1.5. Authorize on the demo website for tests: https://carspot.scriptsbundle.com/, login is [email protected] and passowrd i...
ProfileGrid – User Profiles, Groups and Communities <= 2.8.5 - Authenticated Code Execution
The plugin ProfileGrid – User Profiles, Groups and Communities versions prior to 2.8.6 is vulnerable to Arbitrary Code Execution. An authenticated user with a role as low as Subscriber can execute arbitrary PHP code on websites using the plugin. Send an authenticated POST request to...
Category Order and Taxonomy Terms Order <= 1.5.2.2 - Authenticated PHP Object Injection
Usage of unserialize on user input in the saving request of the orders leads to PHP object injection vulnerability. Send POST request to "URL/wp-admin/admin-ajax.php" with parameters "action=update-taxonomy-order&order=SERIALIZED-OBJECT"...
BuddyBoss Media <= 3.2.3 - Stored XSS
The album description does not perform input / output validation. According to the researcher: No reply from vendor. Issue not patched. Vulnerability can be exploited by any user. Form not vulnerable to CSRF. '"alert"test";...
Smooth Slider <= 2.8.6 - Authenticated SQL Injection
During the security analysis, ThunderScan discovered SQL injection vulnerability in Smooth Slider WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugin settings...
Caldera Forms <= 1.5.4 - Authenticated Cross-Site Scripting (XSS)
Version 1.5.4 and earlier of Caldera Forms is vulnerable to a reflected cross-site scripting vulnerability in the "edit" parameter, which is not properly escaped before being printed in an HTML attribute. An attacker can use this to craft URLs that, when clicked, result in malicious JavaScript...
SQL Shortcode <= 1.1 - Authenticated SQL Execution
It's not an SQL injection actually, it's just executing SQL with an account as low-privileged as a subscriber. The plugin description says it all. This https://blog.sucuri.net/2016/08/sql-injection-vulnerability-ninja-forms.html great article will help understanding how to exploit shortcodes and...
Pressforward <= 5.2.3 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise the $SERVER'QUERYSTRING' before outputting it back in the page, leading to a reflected Cross-Site Scripting issue. The issue was initially reported in v4.3.0 but was never fixed, and is still affecting v5.2.3...
NextGEN Gallery geo <= 1.0 - Unauthenticated PHP Object Injection
The plugin nextgen-gallery-geo insecurely trusts serialized data submitted over AJAX requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. The original researcher notified the WordPress Plugins team. Attack is exploitable over AJAX calls sites with the...
WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)
The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...
Mobile App Native <= 3.0 - Remote File Upload
The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. $ curl -F "file=@/var/www/shell.php"...
Xtreme Locator Dealer Locator Plugin 1.5 – Authenticated SQL Injection
Type user access: admins user. $GET‘id’ is not escaped. Is accessible for only admins user. 1 - logged with admin user; 2 - send resquest get; http://www.example.com/wp-admin/admin.php?page=xtreme-locator-settings&id=0+UNION+ALL+SELECT+1%2Cslug%2Cname%2C4%2C5+FROM+wpterms+WHERE+termid%3D1...
iThemes Security <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The 404 detection module needs to be enabled. curl "http://ithemesprotected.target/index.php/2016/09/22/trigger-404/?x=String/YWxlcnQoInRlc3QiKQ==/;x=x.substring1,x.length-1;evalatobx;" -H 'Accept-Encoding: gzip, deflate, sdch' -H 'Accept-Language: en-US,en;q=0.8' -H 'Upgrade-Insecure-Requests: 1...
brafton WordPress Plugin <=3.4.7 - Reflected XSS
Title -brafton WordPress Plugin XSS Exploit Title : Vulnerabilitie XSS in brafton WordPress Plugin Date: Fri May 20 2016 Reported Date : Fri May 20 2016 Vendor Homepage: http://www.brafton.com/support/wordpress/ Version: v3.3.10 – January2016 Software Link:...
HDW WordPress Video Gallery <= 1.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hdw-tube WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/hdw-tube/playlist.php?playlist="alert1;alert1;"...
AJAX Random Post <= 2.00 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The ajax-random-post WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/ajax-random-post/js.php?interval="alert1;"...
Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The tidio-gallery WordPress plugin was affected by a Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/tidio-gallery/popup-insert-help.php?galleryId="alert1;"...
New Year Firework <= 1.1.9 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The new-year-firework WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/new-year-firework/firework/index.php?text="alert1;"...
Stop User Enumeration <= 1.3.3 - Username Enumeration Bypass
Using the plugin "Stop User Enumeration 1.3.3" is possible bypass it to get the usernames. Blocked: http://www.example.com/?author%00=%001 Passed: http://www.example.com/?bypass=1&author%00=1...
Sola Support Ticket <= 3.12 - XSS & Configuration Change
Any logged in user with any role and access to wp-admin in any way can update plugin settings including allowing HTML to be parsed. One can also change any notification messages to include JS which then can be used to obtain information by forgery. Make POST request to /wp-admin with parameters...
wp-championship <= 5.8 - Authenticated Blind SQL Injection
The wp-championship WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. $ sqlmap -u 'http://www.example.com/wp-admin/wp-championship/csadminusers.php&userid=' --data="isadmin=1&user" --cookie=AUTHCOOKIEHERE --level=5 --risk=3...
Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload
The code in csv2wpecCouponFileUpload.php does not properly sanitize user input, it checks the file mime-type for type x-php but this can be tricked when using the short code for "; $uploadfile="/var/www/s.pht"; $ch =...
WP Symposium <= 15.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The wp-symposium WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/wp-symposium/getalbumitem.php?size=alert/xss/...
MDC YouTube Downloader <= 2.1.0 - Local File Inclusion
The MDC YouTube Downloader WordPress plugin was affected by a Local File Inclusion security vulnerability. http://www.example.com/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd...
WordPress 2.1.1 - Command Execution Backdoor
http://www.example.com/wp-includes/feed.php?ix=phpinfo; http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd...
GDPR CCPA Compliance Support < 2.4 - Unauthenticated PHP Object Injection
The GDPR CCPA Compliance Support WordPress plugin was vulnerable to an Unauthenticated PHP Object Injection security vulnerability. The vulnerability could triggered within the "njtgdprallowpermissions" Base64 encoded cookie value...
Realia <= 1.4 - Unauthenticated IDOR leading to Arbitrary Post Deletion
While investigating an IDOR issue on a premium theme, allowing arbitrary deletion of Ads, submitted by Vlad Vector, the Realia plugin was found to be the root cause. In fact, having this plugin installed which some themes require can allow unauthenticated attackers to delete arbitrary posts, by...
WP DS FAQ Plus < 1.4.2 - Stored Cross-Site Scripting (XSS)
Weak security checks in the Question form. https://www.youtube.com/watch?v=UPYitCT9xtk...
My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection
The plugin my-geo-posts-free insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. Attack is exploitable over HTTP requests to sites with the my-geo-posts-free Plugin. The original researcher notifi...
Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/?author=1...
WP Whois Domain <= 1.0.0 - Unauthenticated Cross-Site Scripting (XSS)
The plugin is still affected and has been closed...
W3 Total Cache <= 0.9.4.1 – Unauthenticated Security Token Bypass
The /pub/apc.php file is used to empty the OPCache/APC. The script seems protected by a nonce aka security token: $nonce = W3Request::getstring'nonce'; $uri = $SERVER'REQUESTURI'; if wphash$uri == $nonce But the flaw stays in the == operator which is not the one to use when you want to compare...
404 to 301 <= 2.3.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Description There is a stored XSS in the 404-to-301 WP plugin alertdocument.cookie HTTP/1.1 Host: wordpress Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/51.0.2704.103 Safari/537.36 Accept:...
CYSTEME Finder <= 1.3 - Unauthenticated LFI and Unauthenticated File Upload
CYSTEME does not properly check SESSION Cookies allowing a remote attacker to upload, view, or delete files from any location on the remote file system. - Retrieve all data in the root wordpress directory. This will return JSON. Exploit:...
Tera Charts 1.0 - Unauthenticated Cross-Site Scripting (XSS)
The tera-charts WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. http://www.example.com/tera-charts/charts/treemap.php?fn=";alert1;"&userid=1...
MiniMax <= 2.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The page-layout-builder WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layoutsettingsid="alert1;"...
Indexisto WordPress Site Search <= 1.0.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The indexisto WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexistoindex="alert1;"...
Infusionsoft Gravity Forms Add-on <= 1.5.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Infusionsoft Gravity Forms Add-on WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/infusionsoft/Infusionsoft/examples/leadscoring.php?ContactId="alert1;"...
MW Font Changer <= 4.2.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/parsi-font/css.php?size="alert1;"...
Hero Maps Pro <= 2.1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hero-maps-pro WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/hero-maps-pro/views/dashboard/index.php?v="alert1;"...
InstaLinker <= 1.1.1 - Reflected Cross-Site Scripting (XSS)
Due to a lack of input sanitization in the includes/instalinker-admin-preview.php file, it is possible to utilise a reflected XSS vector to run a script in the target user's browser and potentially compromise the WordPress installation...