14623 matches found
WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Analytics Report Leaks
The plugin was vulnerable to Analytics Report Leaks on some hosting configurations. As well as updating WooCommerce to at least version 5.7.0, and WooCommerce Admin to at least version 2.6.4, it is also recommended that directory listing is disabled on your host. Automattic updates were rolled ou...
OptinMonster < 2.6.1 - Reflected Cross-Site Scripting (XSS)
The plugin was vulnerable to Reflected Cross-Site Scripting XSS due to insufficient input validation in the loadpreviews function found in the /OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0...
Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move
Some of the functions did not have proper capability checks in place, allowing low privilege users such as subscribers to view arbitrary ACF data, movie fields, as well as view field groups...
Booster for WooCommerce < 5.4.4 - Authentication Bypass
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink function found in the...
BuddyPress < 9.1.1 - SQL Injections
The plugin was affected by SQL Injections via the BPNotificationsNotification::getorderbysql and BPInvitation::getorderbysql functions...
Media Usage <= 0.0.4 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /mmuadmin.php file which allows attackers to inject arbitrary web scripts...
Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfilteredhtml capability is disallowed PoC Create a new Form via the plugin, go to Form Settings then add the following payload in the Tit...
WordPress Download Manager < 3.1.25 - Authenticated File Upload
Authenticated File Upload in WordPress Download Manager = 3.1.24 allows authenticated Author+ users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. The destination folder is also protected by an .htaccess file affecting the same...
Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)
Description The theme does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability. Due to a nonce check, this issue is only exploitable on unauthenticated users for as long as the nonce used in the reques...
W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)
The plugin was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This...
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
The Admin Columns WordPress plugin allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns. When a "Custom...
Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSS
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. These vulnerabilities were discovered and patched by Brainstorm Force after the...
Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them even when the unfiletedhtml is disabled PoC Use a payload such as a" in the plugin settings for example, the Powered by Text input...
PhastPress < 1.111 - Open Redirect
There is an open redirect in the plugin that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/ that...
WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin contains an authenticated admin+ stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser. PoC Put the following payload in the "Related Posts Title" settings of the plugin...
Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
"Attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site." PoC...
XCloner Backup and Restore 4.2.1 - 4.2.12 - Unprotected AJAX Action
"This flaw gave authenticated attackers, with subscriber-level or above capabilities, the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution on a vulnerable site’s server. Alternatively, an attacker could create an exploit cha...
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
The Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin was vulnerable to Remote Code Execution via file upload. The plugin used a blacklist of dangerous file extensions that it did not allow to be uploaded, however, the extensions .phar and .phpt were not within the blacklist,...
wpDiscuz < 5.3.6 - Unauthenticated SQL Injection
The Comments – wpDiscuz WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls
Due to incomplete fixes for CVE-2020-12077, an attacker with subscriber privileges may be able to download, delete and upload arbitrary PHP files, which could result in remote command execution...
BigBlueButton < 2.2.4 - Reflected Cross-Site Scripting (XSS)
XSS via closed captions because dangerouslySetInnerHTML in React is used...
OneTone <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting (XSS)
Due to missing capability checks and security nonces, an unauthenticated attacker can use the theme options import feature to inject JavaScript code into all pages and posts of the website...
Pricing Table by Supsystic < 1.8.2 - Unauthenticated Stored XSS
No permission check on the ImportJSONTable endpoint allows for malicious javascript to be injected by unauthenticated users. PoC...
WordPress <= 5.2.3 - JSON Request Cache Poisoning
Description The fix sends the "Vary: Origin" response header for GET requests from unauthenticated users...
Hustle <= 6.0.7 - Unauthenticated CSV Injection
The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability...
Groundhogg < 1.3.5 - Remote Code Execution
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin was affected by a Remote Code Execution security vulnerability...
GraceMedia Media Player 1.0 - Local File Inclusion (LFI)
The GraceMedia Media Player WordPress plugin was affected by a Local File Inclusion LFI security vulnerability...
Ninja Forms <= 3.3.13 - CSV Injection
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a CSV Injection security vulnerability...
Woocommerce Jetpack <= 3.7.0 - XSS
The Booster for WooCommerce WordPress plugin was affected by a XSS security vulnerability...
PixelYourSite < 5.3.0 - XSS
The PixelYourSite – Your smart PIXEL TAG Manager WordPress plugin was affected by a XSS security vulnerability...
Contact Form 7 to Database Extension 2.10.32 - CSV Injection
Note: The plugin has been closed on WP and moved to Github https://github.com/mdsimpson/contact-form-7-to-database-extension/releases...
WPGlobus <= 1.9.6 - Stored XSS & CSRF
The WPGlobus – Multilingual Everything! WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...
WordPress 4.3.0-4.9 - HTML Language Attribute Escaping
...
WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
Versions 3.2.3 and earlier are affected by an issue where cached queries within shortcodes could lead to object injection. This is related to the recent WordPress 4.8.3 security release. This issue can only be exploited by users who can edit content and add shortcodes, but we still recommend all...
User Login History <= 1.5 - Cross-Site Scripting (XSS)
The User Login History WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WP Statistics <= 12.0.7 - Authenticated SQL Injection
The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
Image Gallery with Slideshow <= 1.5.2 - Multiple XSS and SQL Injection
The plugin is still affected and has been closed...
Mail Masta 1.0 - Multiple SQL Injection
Multiple SQL Injection vulnerabilities in Mail Masta Plugin version 1.0 for WordPress. The plugin is still affected and has been closed. PoC Please refer to: https://github.com/hamkovic/Mail-Masta-Wordpress-Plugin...
Headway Theme < 3.8.9 - Authenticated Cross-Site Scripting (XSS)
The headway WordPress theme was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Admin Font Editor <= 1.8 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The admin-font-editor WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/admin-font-editor/css.php?size=""...
e-search <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The e-search WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/e-search/tmpl/dateselect.php?date-from=""...
Role Scoper <= 1.3.66 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Role Scoper Obsolete – Please install PublishPress Permissions WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
Clean Login < 1.5.1 - Reflected XSS
The Clean Login WordPress plugin was affected by a Reflected XSS security vulnerability...
Broken Link Manager <= 0.4.5 - Unauthenticated SQL Injection & XSS
The Broken Link Manager WordPress plugin was affected by an Unauthenticated SQL Injection & XSS security vulnerability...
FeedWordPress <= 2015.0426 - XSS & SQL-Injection
The FeedWordPress WordPress plugin was affected by a XSS & SQL-Injection security vulnerability...
Shoppette < 1.0.5 - Unspecified XSS
The shoppette WordPress theme was affected by an Unspecified XSS security vulnerability...
WonderPlugin Audio Player 2.0 - Blind SQL Injection & XSS
The wonderplugin-audio WordPress plugin was affected by a Blind SQL Injection & XSS security vulnerability...
PowerPress Podcasting < 6.0.1 - Cross-Site Scripting (XSS)
The PowerPress Podcasting plugin by Blubrry WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. PoC /wp-admin/admin.php?page=powerpress/powerpressadmincategoryfeeds.php=powerpress-editcategoryfeed=1';"--...