14652 matches found
User Registration < 2.3.3 - Subscriber+ PHP Object Injection
The plugin unserializes user input via the urgetuserextrafields and userregistrationformfield function, which could allow any authenticated users, such as subscriber to perform PHP Object Injection when a suitable gadget is present on the blog...
Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS
The plugins do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC cmplz-consent-area...
ProfilePress < 4.5.5 - Reflected XSS
The plugin does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
UpQode Google Maps <= 1.0.5 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC Exploit: vcugmmap mapheight='100px;...
0mk Shortener <= 0.2 - Stored XSS via CSRF
Description The plugin does not have CSRF check in its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...
ShortPixel Adaptive Images < 3.6.3 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin PoC https://example.com/?SPAIVJS=%3C/script%3E%3Cimg%20src%3D1%20onerror%3Dalert/XSS/;%3E...
VikRentCar < 1.3.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Quiz and Survey Master < 8.0.5 - Unauthenticated iFrame Injection
The plugin does not sanitise and escape the questionid parameter, which could allow unauthenticated users to perform iFrame injection attack...
Photo Gallery < 1.8.3 - Stored XSS via CSRF
The plugin does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control. Note: The XSS will only trigger for the...
User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
The plugin does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example. PoC The following Python script automates the exploitation of this plugin by...
Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
The theme does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE PoC Upload a File: The response give the path to the file uploaded:...
5 Anker Connect < 1.2.7 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import intentionally or not a malicious Customizer Styling file and a suitable gadget chain is present on the blog. PoC To simulate a gadget chain, put the followin...
Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
The plugin is vulnerable to an authenticated SQL injection. By adding a new language via the settings page containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected. PoC To exploit the vulnerability, someone must send a...
BuddyPress Group Reviews < 2.8.4 - Subscriber+ Arbitrary Settings Update & Review Modification
The plugin is missing capability and CSRF checks in various of its AJAX functions available to any authenticated users, which could allow users with a role as low as subscriber to update arbitrary settings and modify reviews...
MashShare <= 3.8.1 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Jupiter < 6.10.2 & JupiterX Core < 2.0.8 - Subscriber+ Privilege Escalation and Post Deletion
When the theme is installed, any logged-in user can elevate their privileges to an administrator by sending an AJAX request with the action parameter set to abbuninstalltemplate. This calls the uninstallTemplate function, which calls the resetWordpressDatabase function, where the site is...
VikBooking Hotel Booking Engine & PMS < 1.5.7 - Stored Cross-Site Scripting via CSRF
The plugin does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack PoC XSS will be triggered...
SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users PoC Create a new email petition /wp-admin/admin.php?page=dkspeakoutaddnew, check x Do not send email...
Database Peek <= 1.2 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=ab-database-peek=wpusers="...
SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting
The plugin does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=sqbulkseo=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28/XSS/%29+xxx=pp...
WP Import Export < 3.9.16 - Unauthenticated Sensitive Data Disclosure
The plugins are vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or...
Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection
The plugin does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue PoC https://example.ocm/wp-admin/options-general.php?page=acfe-options=1%20and%20sleep0.02%23...
Crisp Live Chat < 0.32 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisppluginsettingspage function found in the /crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31...
Survey Maker < 2.0.7 - Unauthenticated Store Cross-Site Scripting
The plugin is affected by an unauthenticated Stored Cross-Site Scripting issue...
Download Monitor < 4.4.7 - Admin+ Arbitrary File Download
The plugin does not validate files to be downloaded, which could allow high privilege users such as admin to access arbitrary files from the server...
OptinMonster < 2.6.5 - Unprotected REST-API Endpoints
OptinMonster was missing appropriate capability checks on several REST-API endpoints which made it possible for unauthenticated attackers, and in some instances authenticated with low privileges, to perform unauthorized actions, as well as access sensitive information such as the...
Ninja Forms < 3.6.4 - Admin+ SQL Injection
The plugin does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks PoC POST /wp-admin/post.php HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: zh,en;q=0.5...
Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF
The plugin does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover. PoC The following HTML code can be...
YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module
The plugin is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of...
Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue PoC https://example.com/forum/?subscribetopic=1%20union%20select%201%20and%20sleep10...
WordPress Real Media Library < 4.14.2 - Author Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the /inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names...
Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move
Some of the functions did not have proper capability checks in place, allowing low privilege users such as subscribers to view arbitrary ACF data, movie fields, as well as view field groups...
PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls
The plugin performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values. PoC You can run this from a browser's javascript console:...
Skaut bazar < 1.3.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file which allows attackers to inject arbitrary web scripts PoC https://example.com/wp-admin/options-general.php/"/?page=skatubazaroption...
Media Usage <= 0.0.4 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /mmuadmin.php file which allows attackers to inject arbitrary web scripts...
Add Sidebar <= 2.0.0 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the add parameter in the /wpsidebarMenu.php file which allows attackers to inject arbitrary web scripts...
TypoFR <= 0.11 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the /vendor/OrgHeigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts...
Form Maker < 1.13.60 - Authenticated Stored XSS
The plugin does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue PoC Create or edit a form and add the following payload in the Form Title field "autofocus...
WP JobSearch < 1.7.4 - Authenticated Stored XSS
The plugin did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue PoC Vulnerable parameters: fieldeducationtitle=,...
WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE)
The plugin was affected by an authenticated admin+ RCE in the settings page due to input validation failure and weak $cachepath check in the WP Super Cache Settings - Cache Location option. Direct access to the wp-cache-config.php file is not prohibited, so this vulnerability can be exploited for...
WordPress < 5.5.2 - Stored XSS in Post Slugs
Description The release notes state: "Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs."...
Post Grid < 2.0.73 & Team Showcase < 1.22.16 - PHP Object Injection
Ram Gall from Wordfence discovered an authenticated subscriber+ PHP Object Injection vulnerability in the Post Grid and Team Showcase WordPress plugins...
Newsletter < 6.8.2 - Authenticated PHP Object Injection
The ‘restoreoptionsfromrequest‘ function called by the AJAX function ‘tnpcrendercallback‘ runs ‘unserialize’ directly on ‘$options'inlineedits'’ which is provided by user input in the $POST‘options’ parameter. This creates the potential for an Object Injection vulnerability. For example, a user...
MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls
Due to incomplete fixes for CVE-2020-12077, an attacker with subscriber privileges may be able to download, delete and upload arbitrary PHP files, which could result in remote command execution...
MapPress Maps < 2.53.9 - Authenticated Map Creation/Deletion Leading to Stored Cross-Site Scripting (XSS)
Both the Free and Pro versions of this plugin register AJAX actions that call functions which lack capability checks and nonce checks. It is possible for a logged-in attacker with minimal permissions, such as a subscriber, to add a map containing malicious JavaScript to an arbitrary post or page ...
BigBlueButton < 2.2.4 - Reflected Cross-Site Scripting (XSS)
XSS via closed captions because dangerouslySetInnerHTML in React is used...
Hustle <= 6.0.7 - Unauthenticated CSV Injection
The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability...
Multi Step Form <= 1.2.5 - Cross-Site Scripting (XSS)
The Multi Step Form WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Contact Form 7 to Database Extension 2.10.32 - CSV Injection
Note: The plugin has been closed on WP and moved to Github https://github.com/mdsimpson/contact-form-7-to-database-extension/releases...