14622 matches found
Magazine Basic - wp-content/themes/magazine-basic/view_artist.php id Parameter SQL Injection
The Magazine Basic WordPress theme was affected by a wp-content/themes/magazine-basic/viewartist.php id Parameter SQL Injection security vulnerability...
Polylang 1.5.1 - User Description H&ling Stored XSS
The Polylang WordPress plugin was affected by an User Description H Stored XSS security vulnerability...
XCloner - Backup and Restore < 3.1.1 - Multiple Actions CSRF
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin was affected by a Backup and Restore 3.1.1 - Multiple Actions CSRF security vulnerability...
myGallery <= 1.4b4 - Unauthenticated File Inclusion
The MySliderGallery WordPress plugin was affected by an Unauthenticated File Inclusion security vulnerability. PoC This vulnerability has been seen exploited in the wild with the following payload:...
WordPress <= 1.5.1.2 - XMLRPC Eval Injection
...
Premmerce Product Filter for WooCommerce < 3.7.3 - Missing Authorization
Description The Premmerce Product Filter for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, t...
Pods < 3.1 - Contributor+ Remote Code Execution
Description The plugin is vulnerable to Remote Code Execution via shortcode, allowing authenticated attackers, with contributor level access or higher, to execute code on the server...
HUSKY – Products Filter for WooCommerce Professional < 1.3.5.3 - Contributor+ SQL Injection
Description The HUSKY – Products Filter for WooCommerce Professional plugin is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already...
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.2.6 - Unauthenticated SQL Injection
Description The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the...
Royal Elementor Addons and Templates < 1.3.88 - Multiple Cross-Site Request Forgery
Description The plugin is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform actions on the site via forged requests grant...
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation when extracting zip files in the 'processupload' and 'regenerateiconfiles' functions. This makes it possible for authenticated attackers with author permissions to upload arbitrary files on the...
Ultimate Addons for WPBakery < 3.19.18 - Cross-Site Request Forgery
Description The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.19.17. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform...
Sayfa Sayaç <= 2.6 - Unauthenticated SQL Injection
Description The Sayfa Sayaç plugin for WordPress is vulnerable to SQL Injection via the in versions up to, and including, 2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...
Photo Gallery by 10Web < 1.8.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
Description The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
Enable Media Replace < 4.1.5 - Reflected Cross-Site Scripting
Description The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXELDEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...
E2Pdf < 1.20.26 - Admin+ Arbitrary File Upload
Description The plugin does not properly validate upload files via the importaction function, allowing users having access to the plugin by default admin to upload arbitrary files...
MW WP Form < 5.0.2 - Unauthenticated Arbitrary File Upload
Description The plugin does not properly handle unauthorised files from being uploaded, only logging the issue without stopping the process, allowing unauthenticated users to upload arbitrary files to the server when the 'Saving inquiry data in database' settings is enabled in the plugin...
Mollie Payments for WooCommerce < 7.3.12 - Authenticated (Shop Manager+) Arbitrary File Upload
Description The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in one of its functions in all versions up to, and including, 7.3.11. This makes it possible for authenticated attackers, with Shop Manager access to...
Porto Theme - Functionality < 2.12.1 - Missing Authorization
Description The Porto Theme - Functionality plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to perform an unauthorized...
eaSYNC <= 1.3.8 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Snow Monkey Forms < 5.0.7 - Unauthenticated Path Traversal
The plugin does not validate file path, allowing unauthenticated users to upload files to arbitrary folders...
Google Analytics by Monster Insights < 8.14.1- Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Transbank Webpay REST < 1.6.7 - Admin+ SQLi
The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscriber to call them and modify shipping method details/products, delete arbitrary posts, as well as lead to privilege escalation...
miniOrange WordPress SAML SSO Premium < 12.1.0 - Open Redirect in SSO login
The plugin does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in...
Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the following shortcode in a page/post videojsvideo...
OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass
The plugin does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address PoC POST / HTTP/1.1...
Page Builder KingComposer <= 2.9.6 - Open Redirect
The plugin does not validate the id parameter before redirecting the user to it via the kcgetthumbn AJAX action available to both unauthenticated and authenticated users PoC https://example.com/wp-admin/admin-ajax.php?action=kcgetthumbn=https://wpscan.com...
Video Conferencing with Zoom < 3.8.17 - E-mail Address Disclosure
The plugin does not have authorisation in its vczapigetwpusers AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog PoC Open the following URL as a subscriber:...
NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection
The plugin does not sanitise and escape the nxid parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection PoC time wget 'https://example.com/?restroute=/notificationx/v1/analytics' --post-data="nxid=sleep2 -- x" -q -O-...
Shopping Cart & eCommerce Store < 5.1.1 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts...
Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User
Low privileged users could use the AJAX action "cppluginsdobuttonjoblatercallback" from multiple plugins of the WP-Buy vendor, to install any plugin including a specific version from the WordPress repository, which helps attackers install vulnerable plugins and could lead to more critical...
WordPress < 5.4.2 - Authenticated XSS via Media Files
Description Props to Luigi – gubello.me for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files...
Email Subscribers & Newsletters < 4.2.3 - Multiple Issues
- Unauthenticated File Download leading to Information Disclosure - Blind SQL Injection in INSERT statement - Insecure Permissions on Dashboard and Settings - CSRF on Settings - Send Test Emails from the Administrative Dashboard as an Authenticated User with a role of Subscriber and above -...
Animate It < 2.3.6 - XSS
The Animate It! WordPress plugin was affected by a XSS security vulnerability...
Visitors Traffic Real Time Statistics < 1.13 - CSRF to Stored XSS/SQLi
A CSRF vulnerability in the plugin gives attackers the possibility to craft an AJAX request, which lets blog administrators alter plugin settings. Due to a lack of encoding for malicious data when displaying it in the admin backend, there is a Stored XSS. Also, as the user input coming from the...
WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection
An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. PoC time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...
GoUrl Bitcoin Payment Gateway < 1.4.14 - Shell Upload
The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership WordPress plugin was affected by a Shell Upload security vulnerability...
Plainview Activity Monitor <= 20161228 - Remote Command Execution (RCE)
The Plainview Activity Monitor WordPress plugin was affected by a Remote Command Execution RCE security vulnerability...
Coming Soon <= 1.1.18 - Authenticated Stored XSS & CSRF
The Coming Soon Page – Responsive Coming Soon & Maintenance Mode WordPress plugin was affected by an Authenticated Stored XSS & CSRF security vulnerability...
WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation
...
User Submitted Posts <= 20151113 - Stored Cross-Site Scripting (XSS)
The User Submitted Posts WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
XCloner - Backup and Restore 3.1.2 - XSS & Command Execution
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin was affected by a Backup and Restore 3.1.2 - XSS & Command Execution security vulnerability...
WordPress Slider Revolution Shell Upload
Description Note: The Construct, Echelon, Fusion, Method, Modular and Myriad affected themes are from the Mysitemyway, who went out of business, and the themes have been forked by BackStop Themes who does not use Revslider...
WPML <= 3.1.7.2 - Multiple Vulnerabilities (Including SQLi)
The sitepress-multilingual-cms WordPress plugin was affected by a Multiple Vulnerabilities Including SQLi security vulnerability...
WordPress <= 1.5.1.2 - XMLRPC SQL Injection
...
WordPress 3.0 - 3.6 Crafted String URL Redirect Restriction Bypass
...
YITH WooCommerce Wishlist < 3.33.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 3.33.0 exclusive due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Salient Shortcodes < 1.5.4 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Description The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...
Smart Recent Posts Widget <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Smart Recent Posts Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...