14623 matches found
Mailchimp For WP < 4.1.8 - XSS
The MC4WP: Mailchimp for WordPress WordPress plugin was affected by a XSS security vulnerability...
MailChimp for WordPress <= 4.1.6 - Authenticated Cross-Site Scripting (XSS)
Usage of the output of addqueryarg without escaping in various places in the WordPress Backend leads to reflected XSS vulnerability. PoC URL/wp-admin/admin.php?page=mailchimp-for-wp-integrations&"...
Photo Gallery by WD <= 1.3.50 - Authenticated SQL Injection
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
WordPress 3.3-4.7.4 - Large File Upload Error XSS
...
Cforms & CformsII < 14.13 - SQL Injection
...
WordPress 4.2-4.7.2 - Press This CSRF DoS
...
WordPress 4.3.0-4.7.1 - Cross-Site Scripting (XSS) in posts list table
...
Icegram <= 1.9.18 - Cross-Site Request Forgery (CSRF) & XSS
The Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram WordPress plugin was affected by a Cross-Site Request Forgery CSRF & XSS security vulnerability...
WordPress 4.2-4.5.2 - Authenticated Attachment Name Stored XSS
...
WordPress 4.5.2 - Redirect Bypass
...
S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The s3-video WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/s3-video/views/video-management/previewvideo.php?media=""...
Music Store <= 1.0.41 - Cross-Site Scripting (XSS)
The Music Store – WordPress eCommerce WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WordPress 3.7-4.4 - Authenticated Cross-Site Scripting (XSS)
PoC http://www.example.com/wp-admin/customize.php?theme= source: https://twitter.com/brutelogic/status/685105483397619713...
Captain Slider 1.0.6 - Cross-Site Scripting (XSS)
The captain-slider WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
GigPress <= 2.3.10 - Authenticated XSS & Blind SQLi
The GigPress WordPress plugin was affected by an Authenticated XSS & Blind SQLi security vulnerability...
S3Bubble Amazon S3 Video And Audio Streaming With Analytics <= 2.0 - Arbitrary File Download
The s3bubble-amazon-s3-audio-streaming WordPress plugin was affected by an Arbitrary File Download security vulnerability...
S3Bubble <= 0.7 - Directory Traversal leading to Arbitrary File Access
The last time it was checked the plugin was still affected and had been closed...
Nextend Facebook Connect <= 1.5.4 - Reflected Cross-Site Scripting (XSS)
The Nextend Social Login and Register WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Nextend Twitter Connect <= 1.5.1 - Reflected Cross-Site Scripting (XSS)
The nextend-twitter-connect WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Easy2Map <= 1.24 - SQL Injection
The Function.php file uses sprintf to format queries being sent to the database, this doesn't provide proper sanitisation of user input or properly parameterises the query. PoC $ sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname"...
WordPress <= 4.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
...
Digital Store < 1.3.3 - Unspecified XSS
The digital-store WordPress theme was affected by an Unspecified XSS security vulnerability...
Simple Ads Manager <= 2.5.94 - Arbitrary File Upload & SQL Injection
The simple-ads-manager WordPress plugin was affected by an Arbitrary File Upload & SQL Injection security vulnerability...
Backupbuddy - importbuddy.php step Parameter Remote PHP Information Disclosure
The backupbuddy WordPress plugin was affected by an importbuddy.php step Parameter Remote PHP Information Disclosure security vulnerability...
Google Doc Embedder <= 2.5.18 - Cross-Site Scripting (XSS)
The Google Doc Embedder WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Photo Gallery <= 1.2.5 - Unrestricted File Upload
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an Unrestricted File Upload security vulnerability...
Ad Manager <= 1.1.2 - Open Redirection
The wordpress-admanager WordPress plugin was affected by an Open Redirection security vulnerability...
VideoWhisper Video Presentation 3.25 - vp/c_login.php room_name Parameter Reflected XSS
The VideoWhisper Video Presentation WordPress plugin was affected by a vp/clogin.php roomname Parameter Reflected XSS security vulnerability...
JS MultiHotel 2.2.1 - refreshDate.php roomid Parameter Reflected XSS
The js-multihotel WordPress plugin was affected by a refreshDate.php roomid Parameter Reflected XSS security vulnerability...
php-analytics - ofc_upload_image.php Arbitrary File Upload
The php-analytics WordPress plugin was affected by an ofcuploadimage.php Arbitrary File Upload security vulnerability...
seo-spy-google - ofc_upload_image.php Arbitrary File Upload
The seo-spy-google-wordpress-plugin WordPress plugin was affected by an ofcuploadimage.php Arbitrary File Upload security vulnerability...
geshi-source-colorer <= 0.13 - XSS in ZeroClipboard
The geshi-source-colorer WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
GD Star Rating 1.9.22 - SQL Injection
The gd-star-rating WordPress plugin was affected by a SQL Injection security vulnerability...
WP Forum Server 1.6.5 - feed.php topic Parameter SQL Injection
The WP Forum Server WordPress plugin was affected by a feed.php topic Parameter SQL Injection security vulnerability...
bbPress - forum.php page Parameter SQL Injection
The bbPress WordPress plugin was affected by a forum.php page Parameter SQL Injection security vulnerability...
Login Rebuilder < 1.2.0 - Cross Site Request Forgery
The Login rebuilder WordPress plugin was affected by a Cross Site Request Forgery security vulnerability...
VideoWhisper Live Streaming Integration 4.29.6 - videowhisper_streaming.php Multiple Parameter XSS
The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP WordPress plugin was affected by a videowhisperstreaming.php Multiple Parameter XSS security vulnerability...
WordPress 3.6 - SWF/EXE File Upload Cross-Site Scripting (XSS)
...
WordPress <= 3.3.2 - Cross-Site Scripting (XSS) in wp-includes/default-filters.php
...
st_newsletter - (stnl_iframe.php) SQL Injection
The stnewsletter WordPress plugin was affected by a stnliframe.php SQL Injection security vulnerability...
Wordpress 3.4 - 3.5.1 /wp-admin/users.php Malformed s Parameter Path Disclosure
...
Backupbuddy - importbuddy.php Restore Operation Persistence Weakness
The backupbuddy WordPress plugin was affected by an importbuddy.php Restore Operation Persistence Weakness security vulnerability...
Sodahead Polls < 2.0.4 - XSS
The SodaHead Polls WordPress plugin was affected by a XSS security vulnerability...
Cforms <= 13.1 - 'lib_ajax.php' Cross-Site Scripting (XSS)
The cforms plugin has a XSS vulnerability in file libajax.php with rs and rsargs parameters. It is fixed in version 13.2. The cforms2 fork was forked at 14.6, so it is not affected...
Tubepress < 1.6.5 - XSS
The TubePress WordPress plugin was affected by a XSS security vulnerability...
LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Description The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...
Cooked – Recipe Management <= Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Cooked – Recipe Management recipe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipesettingsposttitle parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows...
Integrate Google Drive < 1.3.94 - Missing Authorization
Description The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and includin...
Contact Form Plugin by Fluent Forms < 5.1.17 - Contributor+ Stored XSS
Description The plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an...
gee Search Plus, improved WordPress search <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The gee Search Plus, improved WordPress search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...