14652 matches found
JSmol2WP <= 1.07 - Unauthenticated Cross-Site Scripting (XSS)
The jsmol2wp WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://localhost:8080/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true=saveFile=%3Cscript%3Ealert/xss/%3C/script%3E=text/html;%20charset=utf-8...
WordPress <= 5.0 - Authenticated File Delete
Description According to WordPress: "Karim El Ouerghemmi discovered that authors could alter meta data to delete files that they weren’t authorized to."...
Geo Mashup <= 1.10.3 - Unspecified Cross-Site Scripting (XSS)
The Geo Mashup WordPress plugin was affected by an Unspecified Cross-Site Scripting XSS security vulnerability...
Booking Calendar <= 2.2.2 - Parameters Tampering Allowing Arbitrary Prices Change
Note: It is unclear whether or not this issue has been remediated...
PixelYourSite < 5.3.0 - XSS
The PixelYourSite – Your smart PIXEL TAG Manager WordPress plugin was affected by a XSS security vulnerability...
WP Background Takeover <= 4.1.4 - Directory Traversal
Allows for an attacker to browse files via the download.php file PoC http://target.com/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php...
PropertyHive <= 1.4.14 - Cross-Site Scripting (XSS)
The PropertyHive WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Read and Understood <= 2.1 - Authenticated Stored XSS & CSRF
The Read and Understood WordPress plugin was affected by an Authenticated Stored XSS & CSRF security vulnerability...
WordPress 4.3.0-4.9 - HTML Language Attribute Escaping
...
TablePress <= 1.8 - Authenticated XML External Entity (XXE)
The TablePress WordPress plugin was affected by an Authenticated XML External Entity XXE security vulnerability...
Max Mega Menu <= 2.3.8 - Authenticated XSS
The Max Mega Menu WordPress plugin was affected by an Authenticated XSS security vulnerability...
Simple Login Log <= 1.1.0 - Authenticated SQL Injection
The Simple Login Log WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
2kb Amazon Affiliates Store <= 2.1.0 - Authenticated Cross-Site Scripting (XSS)
Description The 2kb Amazon Affiliates Store WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Mailchimp For WP < 4.1.8 - XSS
The MC4WP: Mailchimp for WordPress WordPress plugin was affected by a XSS security vulnerability...
Updraftplus < 1.13.5 - XSS
The UpdraftPlus WordPress Backup Plugin WordPress plugin was affected by a XSS security vulnerability...
Nelio Ab Testing < 4.6.4 - CSRF
The Nelio AB Testing WordPress plugin was affected by a CSRF security vulnerability...
Calendar by WD <= 1.5.51 - Authenticated Blind SQL Injection
The SpiderCalendar WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
Kama Click Counter <= 3.4.9 - Authenticated Blind SQL Injection
The Kama Click Counter WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=kama-clic-counterby=linkname=ASC%2cselectfromselectsleep30a=1...
WordPress 2.8-4.6 - Path Traversal in Upgrade Package Uploader
...
Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting (XSS)
The changelog reads: "Fixes a stored XSS issue in the Yoast SEO metabox. Thanks Hammad Shamsi for reporting and responsibly disclosing this issue."...
Ninja Forms 2.9.36 to 2.9.42 - Multiple Vulnerabilities
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
anti-plagiarism <= 3.60 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The anti-plagiarism WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/anti-plagiarism/js.php?m=""...
S3 Video Plugin <= 0.983 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The s3-video WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/s3-video/views/video-management/previewvideo.php?media=""...
Support Ticket System <= 1.2 - Unauthenticated SQL Injection
The Support Ticket System WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
Navis DocumentCloud 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The navis-documentcloud WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
WP Fastest Cache < 0.8.3.5 - Multiple CSRF
The WP Fastest Cache WordPress plugin was affected by a Multiple CSRF security vulnerability...
WooCommerce <= 2.2.10 - Cross-Site Scripting (XSS)
The WooCommerce WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Feed Them Social < 1.7.0 - XSS & Arbitrary Shortcode Execution
The Feed Them Social – for Twitter feed, Youtube, Pinterest and more WordPress plugin was affected by a XSS & Arbitrary Shortcode Execution security vulnerability...
CP Polls < 1.0.1 - XSS
The Polls CP WordPress plugin was affected by a XSS security vulnerability...
VideoWhisper Video Presentation 3.25 - vp/c_login.php room_name Parameter Reflected XSS
The VideoWhisper Video Presentation WordPress plugin was affected by a vp/clogin.php roomname Parameter Reflected XSS security vulnerability...
Disqus <= 2.75 - Cross-Site Scripting (XSS) & CSRF
The Disqus Comment System WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...
wpcb 2.4.8 - facture.php id Parameter Reflected XSS
The wpcb WordPress plugin was affected by a facture.php id Parameter Reflected XSS security vulnerability...
bib2html 0.9.3 - /OSBiB/create/index.php styleShortName Parameter XSS
The bib2html WordPress plugin was affected by a /OSBiB/create/index.php styleShortName Parameter XSS security vulnerability...
Lazyest Gallery <= 1.1.20 - EXIF Script Insertion
The Lazyest Gallery WordPress plugin was affected by an EXIF Script Insertion security vulnerability...
Simple Retail Menus 4.0.1 - includes/mode-edit.php targetmenu Parameter SQL Injection
The Simple Retail Menus WordPress plugin was affected by an includes/mode-edit.php targetmenu Parameter SQL Injection security vulnerability...
JS MultiHotel 2.2.1 - refreshDate.php roomid Parameter Reflected XSS
The js-multihotel WordPress plugin was affected by a refreshDate.php roomid Parameter Reflected XSS security vulnerability...
Cart66 Lite - admin.php cart66-products Page Multiple Field Stored XSS
The cart66-lite WordPress plugin was affected by an admin.php cart66-products Page Multiple Field Stored XSS security vulnerability...
uk-cookie - Cross-Site Request Forgery (CSRF)
The uk-cookie WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...
jaspreetchahals-coupons-lite <= 2.1 - XSS in ZeroClipboard
The JC Coupon WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Mingle Forum 1.0.33.3 - wpf.class.php Multiple Parameter SQL Injection
The mingle-forum WordPress plugin was affected by a wpf.class.php Multiple Parameter SQL Injection security vulnerability...
WP Forum Server 1.6.5 - feed.php topic Parameter SQL Injection
The WP Forum Server WordPress plugin was affected by a feed.php topic Parameter SQL Injection security vulnerability...
WP Symposium 13.02 - Cross-Site Scripting (XSS)
The wp-symposium WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Login With Ajax - Cross-Site Request Forgery
The Login With Ajax WordPress plugin was affected by a Cross-Site Request Forgery security vulnerability...
Social Discussions - Multiple Path Disclosure
The Social Discussions WordPress plugin was affected by a Multiple Path Disclosure security vulnerability...
VideoWhisper Live Streaming Integration 4.29.6 - videowhisper_streaming.php Multiple Parameter XSS
The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP WordPress plugin was affected by a videowhisperstreaming.php Multiple Parameter XSS security vulnerability...
portable-phpMyAdmin < 1.3.1 - Authentication Bypass
The portable-phpmyadmin WordPress plugin was affected by an Authentication Bypass security vulnerability...
wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload
The wpstorecart WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
Wordpress 3.4 - 3.5.1 /wp-admin/users.php Malformed s Parameter Path Disclosure
...