14633 matches found
Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation
In the plugin, low level users, such as subscribers, could use the importfromdebug AJAX action to install any plugin from the WordPress repository. PoC $wpuser, 'pwd' = $wppass, 'rememberme' = 'forever', 'wp-submit' = 'Log+In', ; $output = curlexec$ch; curlclose$ch; // Install some plugins $ch =...
Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions
In the plugin, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to add actions to a form, and more...
Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)
The plugin was vulnerable to Reflected Cross-Site Scripting XSS issues via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action available to both unauthenticated and authenticated users PoC...
WP-DownloadManager < 1.68.5 - Server-Side Request Forgery (SSRF)
The plugin before version 1.68.5 is vulnerable to server-side request forgery SSRF attacks. This could allow an attacker identify open ports, network hosts and access web resources on a non-public facing network...
Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE
The plugin does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE. PoC POST /addalisting/ HTTP/1....
Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS
The theme does not sanitise the keywords and startdate GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue. PoC Payload:...
N5 Upload Form <= 1.0 - Unauthenticated Arbitrary File Upload to RCE
The plugin suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5uniqidrand, however, in the case of misconfigured servers with Directory listing enabled,...
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
In the plugin, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript in...
WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS)
The WP Shieldon WordPress plugin, versions 1.6.3 and below, were vulnerable to Unauthenticated Reflected Cross-Site Scripting XSS when the CAPTCHA page is shown. This was due to $SERVER'REQUESTURI' being echoed to a page without any encoding. PoC http://www.example.com/?...
Canto <= 1.7.0 - Unauthenticated Blind SSRF
The plugin is affected by Blind SSRF issues via the domain parameter in three files: /includes/lib/tree.php, /includes/lib/detail.php and /includes/lib/get.php. All requests to the arbitrary domain/IP will be made with the HTTPS protocol PoC The PoC will be displayed once the issue has been...
Easy Registration Forms <= 2.0.6 - CSV Injection
Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...
WordPress < 5.5.2 - Cross-Site Request Forgery (CSRF) to Change Theme Background
Description Erwan, a security researcher from the WPScan team, discovered and responsibly disclosed a Cross-Site Request Forgery CSRF vulnerability that could allow an unauthenticated attacker to change the background image of the theme. For a successful attack, a privileged authenticated WordPre...
WordPress < 5.5.2 - Disable Spam Embeds from Disabled Sites on a Multisite Network
Description The release notes state: "Props to David Binovec on a fix to disable spam embeds from disabled sites on a multisite network."...
Post Grid < 2.0.73 & Team Showcase < 1.22.16 - PHP Object Injection
Ram Gall from Wordfence discovered an authenticated subscriber+ PHP Object Injection vulnerability in the Post Grid and Team Showcase WordPress plugins...
File Manager < 6.5 - Backup File Directory Listing
The File Manager WordPress plugin could expose backup files if the web server had Directory Listing enabled. The File Manager WordPress plugin, version 6.4 and lower, failed to restrict external access to the fmbackups directory with a .htaccess file. This resulted in the ability for...
WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload
Description An authenticated user could upload a purposely broken theme and then change the theme's directory name with a Cross-Site Scripting XSS payload. When WordPress warns the user about the broken theme, the XSS payload is then executed. This vulnerability would be difficult to exploit by a...
WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Search Block
Description An authenticated user could customise the class of the search block, leading to Cross-Site Scripting XSS...
Photo Gallery < 1.5.46 - Multiple Cross-Site Scripting (XSS) Issues
Multiple cross-site scripting vulnerabilities have been discovered in Photo Gallery Plugin version 1.5.45. The vulnerabilities are caused by improper sanitization of user input in the galleries/image edit page...
2 Click Socialmedia Buttons < 0.34 - Multiple XSS
Description The 2 Click Social Media Buttons WordPress plugin was affected by a Multiple XSS security vulnerability...
Popup Builder <= 3.44 - SQL Injection
The Popup Builder – Responsive WordPress Pop up – Subscription & Newsletter WordPress plugin was affected by a SQL Injection security vulnerability...
WPS Limit Login <= 1.4.5 - Multiple Issues
Protection Bypass, Stored XSS...
Ultimate Member <= 2.0.53 - Cross-Site Scripting (XSS)
The changelog states: "Added security fixes XSS"...
AdRotate Banner Manager <= 5.2 - Authenticated SQL Injection
The vendor states: "Earlier this week I was contacted by a security research firm who has apparently been poking around in the code of AdRotate and they found an issue in AdRotate Free. Upon checking the code following their advisory I found a potential weak point in AdRotate Pro as well. Though...
LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS
The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...
Ultimate Member < 2.0.52 - CSRF and Stored XSS issues
A CSRF vulnerability in adding/editing user roles in Ultimate Member 2.0.49. It also lead to stored XSS. Edit WPScanTeam: July 9th, 2019 - v2.0.50 released and still affected. Escalated to WP Plugins Team July 9th, 2019 - v2.0.51 released, fixing the CSRF but not the XSS July 11th, 2019 - Escalat...
WebP Express <= 0.14.10 - Multiple Issues
- Arbitrary File Viewing - CRSF - XSS including https://wpvulndb.com/vulnerabilities/9389 - Unauthorised Access...
Photo Gallery by 10Web <= 1.5.24 - Authenticated LFI
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated LFI security vulnerability...
SG Optimizer <= 5.0.12 - Unauthenticated File Upload
According to the original researchers: "A successful attack on the SiteGround Optimizer would allow bad actors to store backdoors on vulnerable sites."...
JSmol2WP <= 1.07 - Unauthenticated Cross-Site Scripting (XSS)
The jsmol2wp WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://localhost:8080/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true=saveFile=%3Cscript%3Ealert/xss/%3C/script%3E=text/html;%20charset=utf-8...
WordPress <= 5.0 - Authenticated File Delete
Description According to WordPress: "Karim El Ouerghemmi discovered that authors could alter meta data to delete files that they weren’t authorized to."...
Ajax BootModal Login <= 1.4.3 - Captcha Reuse
The Ajax BootModal Login WordPress plugin was affected by a Captcha Reuse security vulnerability...
Enfold Theme < 4.2.1 - Rewrite Portfolio Permalink Structure & Information Disclosure
The changelog describes two security fixes: - fixed: security issue that would allow an attacker to export your enfold theme settings - fixed: security issue that allowed an attacker to rewrite the portfolio permalink structure...
Read and Understood <= 2.1 - Authenticated Stored XSS & CSRF
The Read and Understood WordPress plugin was affected by an Authenticated Stored XSS & CSRF security vulnerability...
WordPress Concours <= 1.1 - Authenticated Cross-Site Scripting (XSS)
The wp-concours WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
TablePress <= 1.8 - Authenticated XML External Entity (XXE)
The TablePress WordPress plugin was affected by an Authenticated XML External Entity XXE security vulnerability...
2kb Amazon Affiliates Store <= 2.1.0 - Authenticated Cross-Site Scripting (XSS)
Description The 2kb Amazon Affiliates Store WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Mailchimp For WP < 4.1.8 - XSS
The MC4WP: Mailchimp for WordPress WordPress plugin was affected by a XSS security vulnerability...
Bridge Theme <= 11.1 - DOM Cross-Site Scripting (XSS)
The bridge WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability...
AnyVar 0.1.1 - Stored Cross-Site Scripting (XSS)
The anyvar WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
WordPress 4.5.2 - oEmbed Denial of Service (DoS)
...
Ninja Forms 2.9.36 to 2.9.42 - Multiple Vulnerabilities
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The s3-video WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/s3-video/views/video-management/previewvideo.php?media=""...
Connections <= 8.5.8 - Reflected Cross-Site Scripting (XSS)
Line 320 contains unfiltered user input for the search field being sent directly via echo back to the users browser via the ’s’ variable. In file includes/admin/pages/manage.php Line 320:...
WordPress <= 4.3 - User List Table Cross-Site Scripting (XSS)
...
CKEditor for WordPress <= 4.5.3 - Authenticated Reflected Cross-Site Scripting (XSS)
The CKEditor for WordPress WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...
WordPress <= 4.2.3 - Nav Menu Title Cross-Site Scripting (XSS)
...
S3Bubble <= 0.7 - Directory Traversal leading to Arbitrary File Access
The last time it was checked the plugin was still affected and had been closed...
Nextend Twitter Connect <= 1.5.1 - Reflected Cross-Site Scripting (XSS)
The nextend-twitter-connect WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Slideshow 2.2.8-2.2.21 - Option Value Disclosure
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function, accessible by unauthenticated users as an AJAX action, can be abused to force the disclosure of arbitrary Wordpress option values...