Newsletter < 6.8.2 - Authenticated PHP Object Injection

The ‘restoreoptionsfromrequest‘ function called by the AJAX function ‘tnpcrendercallback‘ runs ‘unserialize’ directly on ‘$options'inlineedits'’ which is provided by user input in the $POST‘options’ parameter. This creates the potential for an Object Injection vulnerability. For example, a user...

MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls

Due to incomplete fixes for CVE-2020-12077, an attacker with subscriber privileges may be able to download, delete and upload arbitrary PHP files, which could result in remote command execution...

MapPress Maps < 2.53.9 - Authenticated Map Creation/Deletion Leading to Stored Cross-Site Scripting (XSS)

Both the Free and Pro versions of this plugin register AJAX actions that call functions which lack capability checks and nonce checks. It is possible for a logged-in attacker with minimal permissions, such as a subscriber, to add a map containing malicious JavaScript to an arbitrary post or page ...

BigBlueButton < 2.2.4 - Reflected Cross-Site Scripting (XSS)

XSS via closed captions because dangerouslySetInnerHTML in React is used...

Hustle <= 6.0.7 - Unauthenticated CSV Injection

The Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin was affected by an Unauthenticated CSV Injection security vulnerability...

Multi Step Form <= 1.2.5 - Cross-Site Scripting (XSS)

The Multi Step Form WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Contact Form 7 to Database Extension 2.10.32 - CSV Injection

Note: The plugin has been closed on WP and moved to Github https://github.com/mdsimpson/contact-form-7-to-database-extension/releases...

WPGlobus <= 1.9.6 - Stored XSS & CSRF

The WPGlobus – Multilingual Everything! WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...

Elementor Page Builder <= 1.7.12 - Authenticated Unrestricted Editing

Many AJAX actions are unsecured, allowing logged in users unrestricted access to the internal Elementor functions...

User Login History <= 1.5 - Cross-Site Scripting (XSS)

The User Login History WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WP Live Chat Support < 7.1.03 - XSS

The 3CX Live Chat WordPress plugin was affected by a XSS security vulnerability...

WP Statistics <= 12.0.7 - Authenticated SQL Injection

The WP Statistics WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks

...

WordPress 4.7-4.7.2 - Cross-Site Scripting (XSS) via Taxonomy Term Names

...

WordPress 3.0-4.7 - Cryptographically Weak Pseudo-Random Number Generator (PRNG)

...

Nelio Ab Testing < 4.5.11 - SSRF

The Nelio AB Testing WordPress plugin was affected by a SSRF security vulnerability...

Headway Theme < 3.8.9 - Authenticated Cross-Site Scripting (XSS)

The headway WordPress theme was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Admin Font Editor <= 1.8 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The admin-font-editor WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/admin-font-editor/css.php?size=""...

WP-Invoice <= 4.1.0 - Multiple Vulnerabilities

WP-Invoice plugin = 4.1.0 contains multiple security vulnerabilities that include information disclosure, unauthorised updating of meta data, and privilege escalation...

WordPress 3.7-4.4.1 - Local URIs Server Side Request Forgery (SSRF)

...

WordPress <= 4.3 - User List Table Cross-Site Scripting (XSS)

...

GigPress <= 2.3.10 - Authenticated XSS & Blind SQLi

The GigPress WordPress plugin was affected by an Authenticated XSS & Blind SQLi security vulnerability...

Clean Login < 1.5.1 - Reflected XSS

The Clean Login WordPress plugin was affected by a Reflected XSS security vulnerability...

Broken Link Manager <= 0.4.5 - Unauthenticated SQL Injection & XSS

The Broken Link Manager WordPress plugin was affected by an Unauthenticated SQL Injection & XSS security vulnerability...

WordPress 3.9-4.1.1 - Same-Origin Method Execution

...

Shoppette < 1.0.5 - Unspecified XSS

The shoppette WordPress theme was affected by an Unspecified XSS security vulnerability...

Lattice < 1.1.4 - Unspecified XSS

The lattice WordPress theme was affected by an Unspecified XSS security vulnerability...

Live Forms - Visual Form Builder 3.0.1 - Blind SQL Injection

The AJAX action ‘getreqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return...

PowerPress Podcasting < 6.0.1 - Cross-Site Scripting (XSS)

The PowerPress Podcasting plugin by Blubrry WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. PoC /wp-admin/admin.php?page=powerpress/powerpressadmincategoryfeeds.php=powerpress-editcategoryfeed=1';"--...

W3 Total Cache <= 0.9.4 - Debug Mode XSS

If debug mode is enabled an XSS vector exists in the HTML comments...

ChurcHope Theme <= 2.1 - Local File Inclusion (LFI)

The vulnerability is caused by improper filtration of user-supplied input passed via the 'file' HTTP GET parameter to the '/lib/downloadlink.php' script, which is publicly accessible. PoC http://www.example.com/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php...

WordPress 3.9, 3.9.1, 3.9.2, 4.0 - XSS in Media Playlists

...

Creative Contact Form <= 0.9.7 - Shell Upload

The Creative Contact Form WordPress plugin was affected by a Shell Upload security vulnerability...

vkontakte-api - vkontakte-api/swf/tagcloud.swf tagcloud Parameter XSS

The VKontakte API – crossposting, comments, social buttons, login WordPress plugin was affected by a vkontakte-api/swf/tagcloud.swf tagcloud Parameter XSS security vulnerability...

Extend 1.3.7 - Shell Upload

The extend-wordpress WordPress plugin was affected by a Shell Upload security vulnerability...

WordPress 2.1.1 - Command Execution Backdoor

PoC http://www.example.com/wp-includes/feed.php?ix=phpinfo; http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd...

WordPress 2.1.2 - Authenticated XMLRPC SQL Injection

...

Simple Gmail Login < 1.1.4 - FPD

The Simple Gmail Login WordPress plugin was affected by a FPD security vulnerability...

Sodahead Polls < 2.0.4 - XSS

The SodaHead Polls WordPress plugin was affected by a XSS security vulnerability...

WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block

Description Gutenberg does not restrict a block attribute used as an HTML tag name, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the Gutenberg plugin and,...

Avada Theme < 7.11.14 - Unauthenticated Arbitrary Shortcode Execution

Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before...

Dextaz Ping <= 0.65 - Admin+ RCE

Description The plugin is vulnerable to Remote Code Execution, allowing authenticated attackers, with administrator-level access and above, to execute code on the server...

Greenshift – animation and page builder blocks < 8.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social share block in all versions up to, and including, 8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes...

Newspaper < 12.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta

Description The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Events Addon for Elementor < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Description The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...

Integrate Google Drive < 1.3.94 - Missing Authorization

Description The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and includin...

Slider Revolution < 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting

Description The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

Hash Form – Drag & Drop Form Builder < 1.1.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution

Description The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload...

iframe < 5.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

Description The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to and including 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Tutor LMS Pro < 2.7.1 - Missing Authorization to SQL Injection

Description The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'getcalendarmaterials' function. The plugin is also vulnerable to SQL Injection via the ‘year’ parameter of that function du...