14652 matches found
Duplicator < 1.3.0 - Unauthenticated RCE
Description The plugin does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server. PoC Steps to Reproduce Setup Download WAMP with the...
Contact Form for Plugin by Fluent Forms < 5.0.9 - Insecure Direct Object Reference
Description The Contact Form for Plugin by Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.8 via the addIsRenderableFilter function due to missing validation on the publication status of a form. This makes it possible for...
Olive One Click Demo Import <= 1.0.9 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file
Description The Olive One Click Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the oliveoneclickdemoimportsavefile function in versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...
User Submitted Posts < 20230914 - Unauthenticated Arbitrary File Upload
Description The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uspattachimages function in versions up to, and including, 20230902. This makes it possible for unauthenticatedattackers to upload arbitrary files as long a...
LearnDash LMS < 4.5.3.1 - SQL Injection
Description The plugin does not properly neutralize special elements used in an SQL command, leading to potential SQL injection vulnerability...
AI ChatBot < 4.9.3 - Subscriber+ Arbitrary File Deletion
Description The plugin does not properly validate files to be deleted in the qcldopenaideletetrainingfile function, allowing users with roles as low as subscriber to delete arbitrary files on the server. This vulnerability is the same as CVE-2023-5212 but was accidentally reintroduced in version...
Ad Inserter – Ad Manager & AdSense Ads < 2.7.31 - Unauthenticated Sensitive Information Exposure
Description The plugin is vulnerable to Sensitive Information Exposure via the ai-debug-processing-fe URL parameter...
Slimstat Analytics < 5.0.10 - Contributor+ SQL Injection
Description The plugin is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 5.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers wit...
Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote
The plugin does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll. PoC 1. Create a poll and publish a page with a poll. 2. Visit the page with the...
WP EasyCart < 5.4.11 - Administrator+ Time-based SQL Injection
The plugin does not properly escape user-supplied 'orderby' parameter and lacks adequate preparation of SQL queries. This results in possible appending of additional SQL queries into pre-existing ones, potentially leading to extraction of sensitive data from the database...
Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection
The plugin does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query. PoC While logged in as a subscriber, send the following request: await fetch'/wp-admin/admin-ajax.php',method:'POST', headers: 'Content-Type':...
Mapwiz <= 1.0.1 - Admin+ SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. PoC POST /wp-admin/admin.php?page=myplug/muyplg.php HTTP/1.1...
HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. PoC Exploit shortcode: hashbarbtn btntarget='" onmouseover="alert1"'...
Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS
The plugin does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Plugin settings Style Settings button border radius or other field put to input field:...
Custom Post Type Relations <= 1.0 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts...
Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSS
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. These vulnerabilities were discovered and patched by Brainstorm Force after the...
Wyzi < 2.4.3 - Reflected Cross-Site Scripting (XSS)
The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature PoC https://example.com/business/?keyword=%22%3E%3Cimg%20src=x%20onerror=alert/XSS/%3Easd&wyz-loc-filter-txt;=&loc-filter-txt;=&loc-filter-lat;=&loc-filter-lng;===0...
Paid Membership Pro < 2.5.3 - Unauthorised Order Information Disclosure
The pmprogetorderjson AJAX action, available to authenticated user did not check for authorisation, allowing any authenticated users to retrieve arbitrary order information such as customer names, email addresses, and order numbers via the orderid parameter. PoC...
Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection
The bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL Injection attacks. PoC Vulnerable param: check Vulnerable function:...
WordPress < 5.4.2 - Authenticated XSS via Media Files
Description Props to Luigi – gubello.me for discovering an XSS issue where authenticated users with upload permissions are able to add JavaScript to media files...
Email Subscribers & Newsletters < 4.2.3 - Multiple Issues
- Unauthenticated File Download leading to Information Disclosure - Blind SQL Injection in INSERT statement - Insecure Permissions on Dashboard and Settings - CSRF on Settings - Send Test Emails from the Administrative Dashboard as an Authenticated User with a role of Subscriber and above -...
EU Cookie Law < 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS)
By exploiting the documented vulnerability, an authenticated attacker with high privileges administrator can execute JavaScript code in a victim's browser. By default, in WordPress, administrator users are allowed to inject JavaScript as they have the unfilteredhtml capability. The affected form...
WP Statistics <= 12.6.6.1 - Unauthenticated Blind SQL Injection
An endpoint of the API, which is exposed when the 'use cache plugin' setting is enabled by default disabled, is vulnerable to an unauthenticated blind SQLi issue. PoC time curl -X POST 'http://host/wp-json/wpstatistics/v1/hit' --data...
Groundhogg < 1.3.5 - Remote Code Execution
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin was affected by a Remote Code Execution security vulnerability...
Smush Image Compression and Optimization <= 2.9.1 - Authenticated Phar Deserialization
The Smush – Lazy Load Images, Optimize & Compress Images WordPress plugin was affected by an Authenticated Phar Deserialization security vulnerability...
Plainview Activity Monitor <= 20161228 - Remote Command Execution (RCE)
The Plainview Activity Monitor WordPress plugin was affected by a Remote Command Execution RCE security vulnerability...
WP Live Chat Support < 8.0.06 - Unauthenticated Stored XSS
An unauthenticated user can inject arbitrary javascript code in the admin panel by using the text field "Name" of WP Live Chat Support. The arbitrary code runs on the page wplivechat-menu-history. In the file wp-live-chat-support.php there is no sanitization of $result-id row 4439. WP Live Chat...
Loginizer <= 1.3.5 - Blind SQL Injection
Blind SQL injection in the http-header: X-Forwarded-For and possible others...
WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation
...
VideoWhisper Video Presentation 3.31.17 - Remote File Upload
Vendor marked as won't fix. See references...
Post to Twitter <= 0.7 - CSRF & XSS
The post-to-twitter WordPress plugin was affected by a CSRF & XSS security vulnerability...
WP-ViperGB 1.3.10 - XSS Weakness & CSRF
The WP-ViperGB WordPress plugin was affected by a XSS Weakness & CSRF security vulnerability...
AdRotate <= 3.9.4 - clicktracker.php track Parameter SQL Injection
The AdRotate – Ad manager & AdSense Ads WordPress plugin was affected by a clicktracker.php track Parameter SQL Injection security vulnerability...
NextGEN Gallery 1.9.12 - Arbitrary File Upload
The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
WordPress 3.4 - 3.5.1 DoS in class-phpass.php
...
WP < 7.0.4 - Author+ RCE via PDF Upload
Description WordPress does not properly validate PDF files before generating thumbnail when the PHP Imagick extension and GhostScript are used, which could allow users with a role of author and above to upload malicious PDF filer containing php code and lead to RCE...
Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload
Description The WP Poll Maker – Best WordPress Poll Plugin for Voting Contest plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level acces...
Metform Elementor Contact Form Builder < 3.8.6 - Contributor+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's widgets due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...
Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget
Description The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...
WooCommerce < 8.4.0 - Reflected Cross-Site Scripting
Description The plugin does not properly sanitize user-input provided by the addqueryarg function when echoed back into JavaScript code context. PoC http://vulnerable-site.tld/wp-admin/edit-comments.php?%27;alert1//...
MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS
Description The plugin does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks PoC As a contributor, create/edit a map with the below payload as title and attach it to a post ca...
WP Chat App < 3.4.5 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Simple Counter <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Description The Simple Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
Paid Memberships Pro < 2.12.6 - Missing Authorization via API
Description The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissionscheck...
Adifier System < 3.1.4 - Unauthenticated SQL Injection
Description The Adifier System plugin for WordPress is vulnerable to SQL Injection in versions up to 3.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append...
KP Fastest Tawk.to Chat <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The KP Fastest Tawk.to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
JetBlocks For Elementor < 1.3.8.1 - Reflected Cross Site Scripting
Description The JetBlocks for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
Description The plugin does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server PoC To download /etc/passwd: curl...
MainWP Dashboard < 4.5.1.3 - Authenticated(Administrator+) CSS Injection
Description The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated...
UserPro < 5.1.2 - Authentication Bypass to Administrator
Description The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log ...