14633 matches found
HashThemes Demo Importer < 1.1.2 - Improper Access Control to Blog Reset
The plugin does not have capability checks in some of its AJAX action, relying on CSRF nonces for this, which are displayed for any authenticated users. As a result, a user with a role as low as subscriber could use the hdiinstalldemo AJAX action to reset the entire blog including the tables in t...
Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF
The plugin does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover. PoC The following HTML code can be...
YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module
The plugin is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of...
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Analytics Report Leaks
The plugin was vulnerable to Analytics Report Leaks on some hosting configurations. As well as updating WooCommerce to at least version 5.7.0, and WooCommerce Admin to at least version 2.6.4, it is also recommended that directory listing is disabled on your host. Automattic updates were rolled ou...
OptinMonster < 2.6.1 - Reflected Cross-Site Scripting (XSS)
The plugin was vulnerable to Reflected Cross-Site Scripting XSS due to insufficient input validation in the loadpreviews function found in the /OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0...
Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site Scripting
The plugin does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=cs-woo-altcoin-all-coins="...
Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move
Some of the functions did not have proper capability checks in place, allowing low privilege users such as subscribers to view arbitrary ACF data, movie fields, as well as view field groups...
Booster for WooCommerce < 5.4.4 - Authentication Bypass
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink function found in the...
PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls
The plugin performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values. PoC You can run this from a browser's javascript console:...
Skaut bazar < 1.3.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file which allows attackers to inject arbitrary web scripts PoC https://example.com/wp-admin/options-general.php/"/?page=skatubazaroption...
Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfilteredhtml capability is disallowed PoC Create a new Form via the plugin, go to Form Settings then add the following payload in the Tit...
WordPress Download Manager < 3.1.25 - Authenticated File Upload
Authenticated File Upload in WordPress Download Manager = 3.1.24 allows authenticated Author+ users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. The destination folder is also protected by an .htaccess file affecting the same...
Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack. PoC Add the...
Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)
Description The theme does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability. Due to a nonce check, this issue is only exploitable on unauthenticated users for as long as the nonce used in the reques...
WP Offload SES Lite < 1.4.5 - Stored Cross-Site Scripting (XSS)
The plugin did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for exampl...
W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)
The plugin was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This...
WP JobSearch < 1.7.4 - Authenticated Stored XSS
The plugin did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue PoC Vulnerable parameters: fieldeducationtitle=,...
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
The Admin Columns WordPress plugin allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns. When a "Custom...
Premium Addons for Elementor < 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS)
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Testimonials” widget accepts a “premiumtestimonialpersonnamesize” parameter...
Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSS
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. These vulnerabilities were discovered and patched by Brainstorm Force after the...
Abandoned Cart Lite for WooCommerce < 5.8.3 - Unauthenticated SQL Injection
The plugin is affected by an unauthenticated SQL injection via the billingfirstname parameter of the savedata AJAX call. PoC From the original researcher: ./sqlmap.py -u https://example.com/wp-admin/admin-ajax.php --cookie='cookies content here' --method='POST'...
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
The Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin was vulnerable to Remote Code Execution via file upload. The plugin used a blacklist of dangerous file extensions that it did not allow to be uploaded, however, the extensions .phar and .phpt were not within the blacklist,...
wpDiscuz < 5.3.6 - Unauthenticated SQL Injection
The Comments – wpDiscuz WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls
Due to incomplete fixes for CVE-2020-12077, an attacker with subscriber privileges may be able to download, delete and upload arbitrary PHP files, which could result in remote command execution...
Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
SQL injection in the Photo Gallery 10Web Photo Gallery plugin before 1.5.55 exists via the frontend/models/model.php bwgsearchx parameter. Impact All gallerytype is affected by this bug and any unauthenticated remote attacker can exploit the plugin. PoC Sqlmap payload: sqlmap -u...
Ultimate FAQ < 1.8.25 - Unauthenticated Options Import/Export
The Ultimate FAQ – WordPress Q Plugin WordPress plugin was affected by an Unauthenticated Options Import/Export security vulnerability...
WordPress 5.2.2 - Cross-Site Scripting (XSS) in Dashboard
Description According to the WordPress release notes: "Props to Ian Dunn of the Core Security Team for finding and disclosing a case where reflected cross-site scripting could be found in the dashboard."...
Email Subscribers & Newsletters < 4.1.8 - SQL Injection
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...
Hustle <= 6.0.7 - Unauthenticated CSV Injection
The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability...
Groundhogg < 1.3.5 - Remote Code Execution
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin was affected by a Remote Code Execution security vulnerability...
GraceMedia Media Player 1.0 - Local File Inclusion (LFI)
The GraceMedia Media Player WordPress plugin was affected by a Local File Inclusion LFI security vulnerability...
Woocommerce Jetpack <= 3.7.0 - XSS
The Booster for WooCommerce WordPress plugin was affected by a XSS security vulnerability...
WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)
Description An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress...
WPGlobus <= 1.9.6 - Stored XSS & CSRF
The WPGlobus – Multilingual Everything! WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...
User Login History <= 1.5 - Cross-Site Scripting (XSS)
The User Login History WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WP Statistics <= 12.0.7 - Authenticated SQL Injection
The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
Clean Login <= 1.7.12 - Change Redirect URL CSRF
The Clean Login WordPress plugin was affected by a Change Redirect URL CSRF security vulnerability. PoC...
Headway Theme < 3.8.9 - Authenticated Cross-Site Scripting (XSS)
The headway WordPress theme was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Admin Font Editor <= 1.8 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The admin-font-editor WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/admin-font-editor/css.php?size=""...
WP-Invoice <= 4.1.0 - Multiple Vulnerabilities
WP-Invoice plugin = 4.1.0 contains multiple security vulnerabilities that include information disclosure, unauthorised updating of meta data, and privilege escalation...
Role Scoper <= 1.3.66 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Role Scoper Obsolete – Please install PublishPress Permissions WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
S3Bubble Amazon S3 Video And Audio Streaming With Analytics <= 2.0 - Arbitrary File Download
The s3bubble-amazon-s3-audio-streaming WordPress plugin was affected by an Arbitrary File Download security vulnerability...
Broken Link Manager <= 0.4.5 - Unauthenticated SQL Injection & XSS
The Broken Link Manager WordPress plugin was affected by an Unauthenticated SQL Injection & XSS security vulnerability...
Adsense Click Fraud Monitoring <= 1.7.5 - XSS
XSS via the phpwhois https://github.com/phpWhois/phpWhois component, which is also affected by a RCE apparently https://github.com/phpWhois/phpWhois/issues/34. It is unclear whether or not the issue has been fixed in the plugin...
Twenty Fifteen Theme <= 1.1 - DOM Cross-Site Scripting (XSS)
Genericons = 3.2 vulnerable to DOM XSS in the example.html file due to using outdated version of jQuery and vulnerable code. Vulnerable Code: permalink = "genericon-" + window.location.hash.split''1; cssclass = jQuery '.' + permalink .attr'class'; PoC...
WonderPlugin Audio Player 2.0 - Blind SQL Injection & XSS
The wonderplugin-audio WordPress plugin was affected by a Blind SQL Injection & XSS security vulnerability...
Easing Slider <= 2.2.0.6 - 2 x Cross-Site Scripting (XSS)
The Easing Slider WordPress plugin was affected by a 2 x Cross-Site Scripting XSS security vulnerability...
Pie Register - wp-login.php Multiple Parameter XSS
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a wp-login.php Multiple Parameter XSS security vulnerability...