14629 matches found
Pods < 3.1 - Contributor+ Remote Code Execution
Description The plugin is vulnerable to Remote Code Execution via shortcode, allowing authenticated attackers, with contributor level access or higher, to execute code on the server...
Events Manager < 6.4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the physical location value in all versions up to, and including, 6.4.7.1 due to insufficient input sanitization and output escaping. This makes it possibl...
Canto < 3.0.7 - Unauthenticated RCE
Description The plugin is vulnerable to Remote Code Execution via the 'abspath' parameter due to the use of the includeonce statement on the parameter allowing remote file inclusion. This makes it possible for unauthenticated attackers to execute code on the server...
Avada < 7.11.2 - Author+ Arbitrary File Upload via Zip Extraction
Description The theme is vulnerable to arbitrary file uploads due to missing file type validation when extracting zip files in the 'processupload' and 'regenerateiconfiles' functions. This makes it possible for authenticated attackers with author permissions to upload arbitrary files on the...
Currency Converter Widget < 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Description The Currency Converter Widget – Exchange Rates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...
Enable Media Replace < 4.1.5 - Reflected Cross-Site Scripting
Description The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXELDEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...
Contact Form Email < 1.3.42 - Captcha Bypass
Description The Contact Form Email plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.3.41. This makes it possible for unauthenticated attackers to bypass the Captcha Verification...
Mollie Payments for WooCommerce < 7.3.12 - Authenticated (Shop Manager+) Arbitrary File Upload
Description The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in one of its functions in all versions up to, and including, 7.3.11. This makes it possible for authenticated attackers, with Shop Manager access to...
Porto Theme - Functionality < 2.12.1 - Missing Authorization
Description The Porto Theme - Functionality plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to perform an unauthorized...
Astra Bulk Edit < 1.2.8 - Missing Authorization
Description The Astra Bulk Edit plugin for WordPress is vulnerable to unauthorized missing authorization due to a missing capability check on the savepostbulkedit function in versions up to, and including, 1.2.7. This makes it possible for attackers with contributor-level access or higher to bulk...
ProfilePress < 4.13.2 Cross-Site Request Forgery via 'admin_notice'
Description The ProfilePress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on the 'adminnotice' function. This makes it possible for unauthenticated attackers to dismiss admin notices...
Garden Gnome Package < 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
Master Slider Pro <= 3.6.5 - Unauthenticated PHP Object Injection
Description The Master Slider Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable...
WoodMart < 7.2.5 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
eaSYNC <= 1.3.8 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Ultimate Member < 2.6.1 - Form Duplication via CSRF
The plugin does not have CSRF checks when duplicating a form, which could allow attackers to make logged in admins perform such actions via a CSRF attack...
Google Analytics by Monster Insights < 8.14.1- Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Transbank Webpay REST < 1.6.7 - Admin+ SQLi
The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
WCFM Marketplace < 3.4.12 - Subscriber+ Unauthorised AJAX Calls
The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscriber to call them and modify shipping method details/products, delete arbitrary posts, as well as lead to privilege escalation...
RapidLoad Power-Up for Autoptimize < 1.7.2 - Multiple Subscriber+ Unauthorised AJAX Calls
The plugin does not have authorisation and CSRF checks in multiple AJAX actions, which could allow users with a role as low as subscriber or an attacker making any authenticated user open a malicious page to call them and modify the plugins cache, add a new license, delete logs files, update cach...
Hide My WP < 6.2.9 - Unauthenticated SQLi
The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. PoC curl -k --location --request GET "http://localhost:10008" --header "X-Forwarded-For:...
Videojs HTML5 Player < 1.1.9 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the following shortcode in a page/post videojsvideo...
Videos sync PDF <= 1.7.4 - Unauthenticated LFI
The plugin does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues PoC https://example.com/wp-content/plugins/video-synchro-pdf/reglages/MenuPlugins/tout.php?p=LFI...
iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip
The settings of the plugin can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process,...
LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting
The plugin does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting PoC As admin, enter the following payload in the Domain Key setting of the plugin: Then open...
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
The wcfmajaxcontroller AJAX action of the plugin, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections PoC v 3.4.11 POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...
Shopping Cart & eCommerce Store < 5.1.1 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts...
Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection
The plugin did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an SQL Injection issues PoC Via...
Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)
The settings page of the plugin did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/options-general.php?page=moove-taxonomy-settings=" onMouseOver="alert1;...
SuperStoreFinder & SuperInteractiveMaps - Unauthenticated SQL Injections
The ssf-social-action.php and sim-wp-data.php files from the respective superstorefinder-wp = 5.0.12 AND time-based blind query SLEEP Payload: action=selectwpid=1 AND SELECT 7900 FROM SELECTSLEEP5gxXh Type: UNION query Title: Generic UNION query NULL - 7 columns Payload: action=selectwpid=1 UNION...
Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload
"A subscriber could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/themes/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further...
WordPress < 5.4.2 - Authenticated XSS via Media Files
Description Props to Luigi – gubello.me for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files...
Email Subscribers & Newsletters < 4.2.3 - Multiple Issues
- Unauthenticated File Download leading to Information Disclosure - Blind SQL Injection in INSERT statement - Insecure Permissions on Dashboard and Settings - CSRF on Settings - Send Test Emails from the Administrative Dashboard as an Authenticated User with a role of Subscriber and above -...
Easy Fancybox < 1.8.18 - Authenticated Stored XSS
The Easy FancyBox WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...
WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection
An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. PoC time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...
Buddyforms < 2.2.8 - SQL Injection
The Contact – Registration – Post Form Builder & FrontEnd Editor BuddyForms – Making WordPress Forms A Breeze WordPress plugin was affected by a SQL Injection security vulnerability...
GoUrl Bitcoin Payment Gateway < 1.4.14 - Shell Upload
The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership WordPress plugin was affected by a Shell Upload security vulnerability...
Plainview Activity Monitor <= 20161228 - Remote Command Execution (RCE)
The Plainview Activity Monitor WordPress plugin was affected by a Remote Command Execution RCE security vulnerability...
flickrRSS <= 5.3.1 - XSS and CSRF
The flickr-rss WordPress plugin was affected by a XSS and CSRF security vulnerability...
WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC
...
WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation
...
WordPress <= 4.3 - Publish Post & Mark as Sticky Permission Issue
...
Aviary Image Editor Add-on For Gravity Forms <= 3.0beta - Unauthenticated File Upload
There is a remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms/includes/upload.php. An unauthenticated user can upload any file to the system, including PHP files. upload.php does not check that the user is authenticated and a simple POST request will allow arbitrary...
XCloner - Backup and Restore 3.1.2 - XSS & Command Execution
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin was affected by a Backup and Restore 3.1.2 - XSS & Command Execution security vulnerability...
Import any XML or CSV File to WordPress <= 3.2.3 - RCE
WP All Import does not properly verify that a user has permission to execute functions. Coupled with an interesting method that allows arbitrary functions in specific objects to be called allows this to be leveraged in many ways...
WP Symposium <= 14.11 - Unauthenticated Shell Upload
The wp-symposium WordPress plugin was affected by an Unauthenticated Shell Upload security vulnerability...
AdRotate <= 3.9.4 - clicktracker.php track Parameter SQL Injection
The AdRotate – Ad manager & AdSense Ads WordPress plugin was affected by a clicktracker.php track Parameter SQL Injection security vulnerability...
WordPress 3.0 - 3.6 Crafted String URL Redirect Restriction Bypass
...
Duplicate Post 2.5 - duplicate-post-admin.php User Login Cookie Value SQL Injection
The Yoast Duplicate Post WordPress plugin was affected by a duplicate-post-admin.php User Login Cookie Value SQL Injection security vulnerability...
Ultimate Addons for WPBakery Page Builder < 3.19.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimateinfotable shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This...