14629 matches found
Awesome Support < 6.0.0 - Stored XSS via Ticket Title
The lack of sanitisation in the posttitle of a ticket could allow users with the Support Supervisor capability to create tickets containing XSS payloads. The risk is relatively low, as CSRF checks are in place and the affected role is close to an admin one. Using the DISALLOWUNFILTEREDHTML consta...
Broken Link Checker <= 1.11.8 - Authenticated Cross-Site Scripting (XSS)
The Broken Link Checker WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
WP Live Chat Support < 8.0.06 - Unauthenticated Stored XSS
An unauthenticated user can inject arbitrary javascript code in the admin panel by using the text field "Name" of WP Live Chat Support. The arbitrary code runs on the page wplivechat-menu-history. In the file wp-live-chat-support.php there is no sanitization of $result-id row 4439. WP Live Chat...
WPML Translation Management <= 2.4.1 - PHP Object Injection
The wpml-translation-management WordPress plugin was affected by a PHP Object Injection security vulnerability...
DTracker 1.5 - Multiple Unauthenticated Blind SQL Injections
The dtracker WordPress plugin was affected by a Multiple Unauthenticated Blind SQL Injections security vulnerability...
WordPress 4.7-4.7.2 - Cross-Site Scripting (XSS) via Taxonomy Term Names
...
WordPress 4.2.0-4.7.1 - Press This UI Available to Unauthorised Users
...
e-search <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The e-search WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/e-search/tmpl/dateselect.php?date-from=""...
WP-Piwik <= 1.0.4 - Cross-Site Scripting (XSS)
The WP-Matomo Integration WP-Piwik WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
BJ Lazy Load <= 0.7.5 - Remote File Inclusion (Timthumb)
The BJ Lazy Load WordPress plugin was affected by a Remote File Inclusion Timthumb security vulnerability...
WPML 2.9.3-3.2.6 - Cross-Site Scripting (XSS) in Accept-Language Header
The sitepress-multilingual-cms WordPress plugin was affected by a Cross-Site Scripting XSS in Accept-Language Header security vulnerability...
WordPress 3.9-4.1.1 - Same-Origin Method Execution
...
Ninja Forms <= 2.8.8 - Stored & Reflected XSS
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Stored & Reflected XSS security vulnerability...
Creative Contact Form <= 0.9.7 - Shell Upload
The Creative Contact Form WordPress plugin was affected by a Shell Upload security vulnerability...
timelineoptinpro - XSS
The timelineoptinpro WordPress plugin was affected by a XSS security vulnerability...
WP Ultimate Email Marketer - Multiple Vulnerabilities
The wp-ultimate-email-marketer WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
WordPress 2.1.2 - Authenticated XMLRPC SQL Injection
...
WordPress 3.7.1 & 3.8.1 - Privilege Escalation
Description From the researcher edik who discovered the vulnerability: Using the bulk edit feature you can publish posts and pages PUBLICLY without the publishing-cap. The problem is that there are no checks for publishing-cap's on serverside. It's only protected in UI. How to reproduce: 1. Login...
WordPress 3.5.2 - SWFUpload Content Spoofing
...
Simple Gmail Login < 1.1.4 - FPD
The Simple Gmail Login WordPress plugin was affected by a FPD security vulnerability...
Divi < 4.25.2 - Contributor+ Stored XSS
Description The theme is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse...
Checkout Field Editor for WooCommerce (Pro) < 3.6.3 - Unauthenticated Arbitrary File Deletion
Description The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.6.2. This is due to the plugin not properly validating a file or it's path prior to deleting it. This makes it possible for unauthenticat...
Slider Revolution < 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting
Description The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...
Contact Form Plugin by Fluent Forms < 5.1.16 - Contributor+ PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additiona...
Crelly Slider <= 1.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Description The Crelly Slider plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perfo...
LoginPress Pro < 3.0.0 - Captcha Bypass
Description The plugin is vulnerable to Bypass, allowing unauthenticated attackers to bypass the Captcha Verification...
LearnPress – WordPress LMS Plugin < 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
MasterStudy LMS < 3.3.4 - Unauthenticated Local File Inclusion via template
Description The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of...
Slider by Supsystic < 1.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Slider by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Aparat for WordPress < 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Aparat for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, t...
Easy Social Feed < 6.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fb_appid
Description The Easy Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fbappid' parameter in versions up to, and including, 6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget
Description The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...
WP ERP <= 1.12.9 - Authenticated (AccountingManager+) SQL Injection
Description The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and including, 1.12.9...
Paid Memberships Pro < 3.0 - Cross-Site Request Forgery
Description The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmproliftersavestreamlineoption...
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.6.24 - Cross-Site Request Forgery to Plugin Data Reset
Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssafactoryreset function. This...
FileBird < 5.6.1 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Popup Box Pro < 7.9.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC Create/edit a new popup and add the following payload in the Custom Content: Save, and...
Beds24 Online Booking < 2.0.25 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
404 Solution < 2.33.1 - Sensitive Information Exposure via Log File
Description The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.33.0 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data including plugin configuration and debug data...
wpDiscuz < 7.6.13 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Custom 404 Pro < 3.10.1 - Unauthenticated Stored Cross-Site Scripting via logging
Description The Custom 404 Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several logged parameters in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Uncanny Automator < 5.1.0.3 - Sensitive Information Exposure via Log File
Description The Uncanny Automator – Automate everything with the 1 no-code automation and integration plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.0.2 via the plugin's log file. This makes it possible for unauthenticated...
Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaxaddattachment' function, allowing unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible...
404 Solution < 2.35.0 - Admin+ SQLi
Description The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
Astra Pro < 4.3.2 - Authenticated(Contributor+) Remote Code Execution via Metabox
Description The Astra Pro Addon plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.3.1 via the ast-advanced-hook-php-code meta field. This makes it possible for authenticated attackers, with contributor access and above, to execute code on the serv...
KP Fastest Tawk.to Chat <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The KP Fastest Tawk.to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
12 Step Meeting List < 3.14.25 - Authenticated (Contributor+) Server-Side Request Forgery
Description The 12 Step Meeting List plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.14.24 via the tsmladddatasource parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web reques...
Perfmatters < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Description The Perfmatters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in all versions up to 2.2.0 exclusive due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access or...
Give - Donation Plugin < 2.33.1 - Authenticated(Give Manager+) Privilege Escalation
Description The Give - Donation Plugin plugin for WordPress is vulnerable to privilege escalation due to an insufficient capability check when updating default roles in versions up to, and including, 2.33.0. This makes it possible for authenticated attackers with Give Manager privileges to elevat...
MainWP Dashboard < 4.5.1.3 - Authenticated(Administrator+) CSS Injection
Description The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated...