WordPress <= 5.2.3 - JSON Request Cache Poisoning

Description The fix sends the "Vary: Origin" response header for GET requests from unauthenticated users...

Nextgen Gallery < 3.2.11 - SQL Injection

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a SQL Injection security vulnerability...

Facebook for WooCommerce <= 1.9.12 - CSRF allowing Option Update

The original issue has been fixed via 1.9.14. However, as additional CSRF checks have been implemented in 1.9.15, the fixed in has been set to 1.9.15...

W3 Total Cache <= 0.9.7.3 - Cross-Site Scripting (XSS)

The W3 Total Cache WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. PoC...

The Events Calendar < 4.8.2 - XSS

The The Events Calendar WordPress plugin was affected by a XSS security vulnerability...

Blog2Social <= 5.0.2 - Authenticated Cross-Site Scripting (XSS)

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://example.com/wp-admin/admin.php?page=blog2social-ship=70&b2s;action=1&b2s;updatepublishdate='"...

PixelYourSite < 5.3.0 - XSS

The PixelYourSite – Your smart PIXEL TAG Manager WordPress plugin was affected by a XSS security vulnerability...

WordPress 4.3.0-4.9 - HTML Language Attribute Escaping

...

Elementor Page Builder <= 1.7.12 - Authenticated Unrestricted Editing

Many AJAX actions are unsecured, allowing logged in users unrestricted access to the internal Elementor functions...

WooCommerce <= 3.2.3 - Authenticated PHP Object Injection

Versions 3.2.3 and earlier are affected by an issue where cached queries within shortcodes could lead to object injection. This is related to the recent WordPress 4.8.3 security release. This issue can only be exploited by users who can edit content and add shortcodes, but we still recommend all...

Simple Membership < 3.5.7 - XSS

The Simple Membership WordPress plugin was affected by a XSS security vulnerability...

Photo Gallery by WD <= 1.3.50 - Authenticated SQL Injection

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

All In One Schema.org Rich Snippets <= 1.4.4 - Authenticated Cross-Site Scripting (XSS)

The Schema – All In One Schema Rich Snippets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://vulnerablesite.com/wp-admin/admin.php?page=richsnippetdashboardforcesend=truesendlabel=...

Cforms & CformsII < 14.13 - SQL Injection

...

NextGEN Gallery <= 2.1.56 - Authenticated Local File Inclusion (LFI) & SQLi

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by an Authenticated Local File Inclusion LFI & SQLi security vulnerability...

WordPress 2.8-4.6 - Path Traversal in Upgrade Package Uploader

...

Icegram <= 1.9.18 - Cross-Site Request Forgery (CSRF) & XSS

The Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram WordPress plugin was affected by a Cross-Site Request Forgery CSRF & XSS security vulnerability...

GigPress <= 2.3.10 - Authenticated XSS & Blind SQLi

The GigPress WordPress plugin was affected by an Authenticated XSS & Blind SQLi security vulnerability...

SEO Redirection < 2.9 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability in its settings page, via the search GET parameter PoC https://example.com/wp-admin/options-general.php?page=seo-redirection.php=posts=%22+onmouseover%3Dalert%281%29+%3E...

Clean Login < 1.5.1 - Reflected XSS

The Clean Login WordPress plugin was affected by a Reflected XSS security vulnerability...

Count Per Day 3.4 - SQL Injection

The Count per Day WordPress plugin was affected by a SQL Injection security vulnerability...

Nextend Facebook Connect <= 1.5.4 - Reflected Cross-Site Scripting (XSS)

The Nextend Social Login and Register WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

FeedWordPress <= 2015.0426 - XSS & SQL-Injection

The FeedWordPress WordPress plugin was affected by a XSS & SQL-Injection security vulnerability...

Shoppette < 1.0.5 - Unspecified XSS

The shoppette WordPress theme was affected by an Unspecified XSS security vulnerability...

PowerPress Podcasting < 6.0.1 - Cross-Site Scripting (XSS)

The PowerPress Podcasting plugin by Blubrry WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. PoC /wp-admin/admin.php?page=powerpress/powerpressadmincategoryfeeds.php=powerpress-editcategoryfeed=1';"--...

W3 Total Cache <= 0.9.4 - Debug Mode XSS

If debug mode is enabled an XSS vector exists in the HTML comments...

WP-DBManager < 2.7.2 - Authenticated Command Injection

The WP-DBManager WordPress plugin was affected by an Authenticated Command Injection security vulnerability...

Cart66 Lite - admin.php cart66-products Page Multiple Field Stored XSS

The cart66-lite WordPress plugin was affected by an admin.php cart66-products Page Multiple Field Stored XSS security vulnerability...

All in One SEO Pack <= 2.0.3 - XSS

The All in One SEO Pack WordPress plugin was affected by a XSS security vulnerability...

jaspreetchahals-coupons-lite <= 2.1 - XSS in ZeroClipboard

The JC Coupon WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

Mingle Forum 1.0.33.3 - wpf.class.php Multiple Parameter SQL Injection

The mingle-forum WordPress plugin was affected by a wpf.class.php Multiple Parameter SQL Injection security vulnerability...

Social Discussions - Multiple Path Disclosure

The Social Discussions WordPress plugin was affected by a Multiple Path Disclosure security vulnerability...

WP125 <= 1.4.9 - CSRF

The WP125 WordPress plugin was affected by a CSRF security vulnerability...

WordPress 2.1.1 - Command Execution Backdoor

PoC http://www.example.com/wp-includes/feed.php?ix=phpinfo; http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd...

portable-phpMyAdmin < 1.3.1 - Authentication Bypass

The portable-phpmyadmin WordPress plugin was affected by an Authentication Bypass security vulnerability...

Limit Login Attempts < 1.7.1 - Auth Cookies Brute Force Bypass

From the changelog of the plugin: "Auth cookies" are special cookies set at login that authenticating you to the system. It is how WordPress "remembers" that you are logged in between page loads. During lockout these are supposed to be cleared, but a change in 1.6.2 broke this. It allowed an...

WordPress 2.5 - 3.3.1 XSS in swfupload

...

WP Cumulus < 1.22 - XSS

The wp-cumulus WordPress plugin was affected by a XSS security vulnerability...

Tubepress < 1.6.5 - XSS

The TubePress WordPress plugin was affected by a XSS security vulnerability...

Dextaz Ping <= 0.65 - Admin+ RCE

Description The plugin is vulnerable to Remote Code Execution, allowing authenticated attackers, with administrator-level access and above, to execute code on the server...

Newspaper < 12.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta

Description The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Events Addon for Elementor < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

Description The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...

Integrate Google Drive < 1.3.94 - Missing Authorization

Description The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and includin...

GP Premium < 2.4.1 - Reflected Cross-Site Scripting

Description The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

Description The plugin does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks PoC % time curl "https://example.com/?restroute=/h5vp/v1/video/1=1'+OR+SELECT+1+FROM+SELECTSLEEP5xyz--+-"...

Form Maker by 10Web < 1.15.25 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output escaping. This makes it...

Tutor LMS Pro < 2.7.1 - Missing Authorization

Description The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add,...

Pricing Table by Supsystic < 1.9.13 - Admin+ Content Injection

Description The Pricing Table by Supsystic plugin for WordPress is vulnerable to content injection in all versions up to, and including, 1.9.12. This makes it possible for authenticated attackers, with admin-level access and above, to inject arbitrary content. This is not a security issue by...

Blocksy < 2.0.34 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

ClickCease Click Fraud Protection <= 3.2.6 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an...