14652 matches found
All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS
The plugin uses the wrong content type for, and does not properly escape the response from the ai1wmexport action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Po...
Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing
The plugin is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. PoC curl https://example.com/wp-content/uploads/jobpost Search for this path / folder in search engines to find uploaded resumes...
Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure
The plugin does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. PoC 1. curl 'http://example.com/wp-content/backups-dup-lite/dup-installer/main.installer.php?view=1' 2. curl -d view...
Photo Gallery < 1.6.3 - Unauthenticated SQL Injection
The plugin does not properly escape the $POST'filtertag' parameter, which is appended to an SQL query, making SQL Injection attacks possible. PoC POST /wp-admin/admin-ajax.php?imageid=123 HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: zh,en;q=0.5 Accept-Encoding:...
uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
The plugin does not validate the url parameter in its udrawconverturltobase64 AJAX action available to both unauthenticated and authenticated users before using it in the filegetcontents function and returning its content base64 encoded in the response. As a result, unauthenticated users could re...
WP Mail Logging < 1.10.0 - Outdated Redux Framework
The plugin uses an outdated version of the Redux Framework, which is know to be affected by security issues CVE-2021-38312 and CVE-2021-38314, and could allow unauthenticated attackers to change some of the Framework settings by using CVE-2021-38314 PoC The first endpoint we can identify is...
SEO Redirection < 8.2 - Subscriber+ SQL Injection
The importFromRedirection AJAX action of the plugin, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...
Simple JWT Login < 3.3.0 - Insecure Password Creation
The plugin can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the strshuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation...
WordPress Contact Forms by Cimatti < 1.4.12 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed. PoC 1. go to Forms. 2. go to Add New Form 3. In th title put 4. Save...
wpForo Forum < 1.9.7 - Open Redirect
The plugin did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimat...
WP Smart Import < 1.0.1 - Auhenticated Server-side Request Forgery
The plugin is affected by an authenticated server-side request forgery SSRF vulnerability in versions before 1.0.1...
Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
"A subscriber could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/themes/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further...
Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)
Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...
Safe SVG <= 1.9.4 - Denial of Service
The Safe SVG WordPress plugin was affected by a Denial of Service security vulnerability...
Photo Gallery by 10Web <= 1.5.30 - SQL Injection
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a SQL Injection security vulnerability...
WP Cost Estimation < 9.644 - Arbitrary File Upload and Delete
The WPEstimationForm WordPress plugin was affected by an Arbitrary File Upload and Delete security vulnerability...
WordPress 3.7-4.9.4 - Use Safe Redirect for Login
Description Use safe redirects when redirecting the login page if SSL is forced...
WordPress 2.5-4.6 - Authenticated Stored Cross-Site Scripting via Image Filename
...
Lightbox Plus <= 2.7.2 - CSRF to XSS
The lightbox-plus WordPress plugin was affected by a CSRF to XSS security vulnerability...
User Submitted Posts <= 20151113 - Stored Cross-Site Scripting (XSS)
The User Submitted Posts WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
WP Symposium <= 14.10 - XSS & SQL Injection
The wp-symposium WordPress plugin was affected by a XSS & SQL Injection security vulnerability...
WordPress <= 4.0 - CSRF in wp-login.php Password Reset
Description WordPress 4.0.1 adds a CSRF token called 'rpkey' to the password reset form on wp-login.php. Prior versions are vulnerable to CSRF...
Polylang 1.5.1 - User Description H&ling Stored XSS
The Polylang WordPress plugin was affected by an User Description H Stored XSS security vulnerability...
Login With Ajax - Cross-Site Scripting (XSS)
The Login With Ajax WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor < 2.8.3 - Unauthenticated SQL Injection
Description The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied...
Ecwid Ecommerce Shopping Cart < 6.12.5 - Cross-Site Request Forgery
Description The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.4. This is due to missing nonce validation on several functions hooked via AJAX in the /includes/class-ecwid-admin-storefront-page.php. This...
Events Addon for Elementor < 2.1.3 - Missing Authorization
Description The Events Addon for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the naeventsbwsettingssavefunc, naeventsbwtogglesubmitfunc, naeventsprosettingssavefunc, naeventsprotogglesubmitfunc and naeventsuwsettingssavefun...
10to8 Online Appointment Booking System < 1.1.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Mollie Payments for WooCommerce < 7.3.12 - Authenticated (Shop Manager+) Arbitrary File Upload
Description The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in one of its functions in all versions up to, and including, 7.3.11. This makes it possible for authenticated attackers, with Shop Manager access to...
Porto Theme - Functionality < 2.12.1 - Missing Authorization
Description The Porto Theme - Functionality plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to perform an unauthorized...
Jetpack < 12.8-a.3 - Contributor+ Stored XSS via block attribute
Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Comment Blacklist Updater < 1.2.0 - Cross-Site Request Forgery via update_blacklist_manual
Description The Comment Blacklist Updater plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the 'updateblacklistmanual' function. This makes it possible for unauthenticated attackers to...
Leyka < 3.30.3 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PrePost SEO <= 3.0 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting XSS attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Add XSS payload to plugin's "Account API key" setting: ...
LiteSpeed Cache <= 5.3 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Beautiful Cookie Consent Banner < 2.10.2 - Unauthenticated Stored XSS
The plugin does not have authorisation and CSRF check when updating its settings, and does not escape some of them when outputting them, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks. An initial fix was released in version 2.10.1, and completed in...
Cloak Front End Email < 1.9.2 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC email name='" onmouseover="alert1"...
User Post Gallery <= 2.19 - Unauthenticated RCE
The plugin does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it. PoC Invoke the following curl command to execute the "id" command via PHP's exec function: curl -i...
WPML < 4.5.14 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as change the status of a translation job...
Checkout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object Injection
The plugin unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present PoC To simulate a gadget chain, put the following code in a plugin class Evil public function wakeup : void...
Noptin < 1.6.5 - Open Redirect
The plugin does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue PoC https://example.com/?noptinns=emailclick=https://wpscan.com...
SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting
The plugin is affected by a cross site scripting XSS vulnerability in the plugin's setting page. PoC Enter the payload below for the "SMS Alert Username" in the plugin's settings. "+onfocus="alert1"+autofocus=" You will observe that the JavaScript payload successfully got reflected is and we are...
Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title
The plugin did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117 PoC...
Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users could use the AJAX action "cppluginsdobuttonjoblatercallback" from multiple plugins of the WP-Buy vendor, to install any plugin including a specific version from the WordPress repository, which helps attackers install vulnerable plugins and could lead to more critical...
Limit Login Attempts Reloaded < 2.17.4 - Login Rate Limiting Bypass
When the plugin is configured with a custom header in its Trusted IP Origins setting e.g X-Forwarded-For, attackers could bypass the protection offered by tampering the header sent in requests...
Multi Step Form <= 1.2.5 - Multiple Unauthenticated Reflected XSS
WordPress Plugin Multi Step Form before 1.2.5 allows remote users to execute JavaScript code through Reflected XSS attacks. This issue can be exploited by unauthenticated attackers, by the use of CSRF, for example. PoC The following parameters are vulnerable in fwsenddata function: fwdataid1...
flickrRSS <= 5.3.1 - XSS and CSRF
The flickr-rss WordPress plugin was affected by a XSS and CSRF security vulnerability...
Coming Soon <= 1.1.18 - Authenticated Stored XSS & CSRF
The Coming Soon Page – Responsive Coming Soon & Maintenance Mode WordPress plugin was affected by an Authenticated Stored XSS & CSRF security vulnerability...
WordPress 4.2.3-4.8.1 - Authenticated Cross-Site Scripting (XSS) in Visual Editor
Description A cross-site scripting XSS vulnerability was discovered in the visual editor. Reported by Rodolfo Assis @brutelogic of Sucuri Security...