14623 matches found
Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS
The theme does not sanitise the keywords and startdate GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue. PoC Payload:...
All Thrive Themes and Plugins - Unauthenticated Option Update
The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...
WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)
The editor of the plugin allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side...
Pricing Table by Supsystic < 1.8.9 - Authenticated SQL Injections
The GET parameter sidx and sord are used in a SQL statement without being sanitised when searching for pricing tables in the dashboard, leading to an authenticated SQL Injection issues. PoC...
WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection
The Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user admin+. Edit WPScanTeam: September 8th, 2020 - Confirmed & Escalated to WP plugins team September 8th, 2020 - WP plugins team investigating November 25th, 2020 - No updates,...
File Manager < 6.5 - Backup File Directory Listing
The File Manager WordPress plugin could expose backup files if the web server had Directory Listing enabled. The File Manager WordPress plugin, version 6.4 and lower, failed to restrict external access to the fmbackups directory with a .htaccess file. This resulted in the ability for...
YITH WooCommerce Ajax Product Filter < 3.11.1 - Authenticated Reflected Cross-Site Scripting (XSS)
The YITH WooCommerce Ajax Product Filter WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS vulnerability in an admin form. The vulnerability was fixed in version 3.11.1 of the plugin...
Chopslider <= 3.4 - Unauthenticated Blind SQL Injection
The id parameter of the getscript/index.php page is not sanitised when used in a SQL statement, leading to an unauthenticated blind SQL Injection issue. Vendor was contacted by researcher, on March 3rd, 2020 but no reply was received. PoC The PoC will be displayed once the issue has been remediat...
LearnPress < 3.2.6.9 - Authenticated Post Creation and Status Modification
The LearnPress plugin for WordPress allows authenticated remote attackers with minimal permissions to create pages with arbitrary titles, or modify the publication status of any existing page, via the learnpresscreatepage or learnpressupdateorderstatus AJAX actions...
Modern Events Calendar Lite < 5.1.7 - Multiple Subscriber+ Stored XSS
Modern Events Calendar Lite registers a number of AJAX actions for logged-in users. Some of these actions allow low-privileged users like subscribers to manipulate settings and other stored data. When exploited in this way, the affected data can be injected with various XSS payloads...
Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hmapsprem WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC...
CityBook < 2.3.4 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'CityBook - Directory & Listing WordPress Theme', tested version — v2.3.3: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR Edit WPScanTeam: December 27h, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January...
Ultimate Member < 2.0.52 - CSRF and Stored XSS issues
A CSRF vulnerability in adding/editing user roles in Ultimate Member 2.0.49. It also lead to stored XSS. Edit WPScanTeam: July 9th, 2019 - v2.0.50 released and still affected. Escalated to WP Plugins Team July 9th, 2019 - v2.0.51 released, fixing the CSRF but not the XSS July 11th, 2019 - Escalat...
Import users from CSV with meta <= 1.14.1.3 - CSRF leading to attachment deletion & Path Traversal
CSRF leading to attachment deletion via the acuideleteattachment AJAX function...
WebP Express <= 0.14.10 - Multiple Issues
- Arbitrary File Viewing - CRSF - XSS including https://wpvulndb.com/vulnerabilities/9389 - Unauthorised Access...
ConvertPlus <= 3.4.4 - Multiple Issues
According to the changelog: 3.4.5 - Security: User with none role gets created on form submission by curl request for variants. 3.4.4 - Improved sanitization, escaping and other security improvements...
WP Live Chat Support < 8.0.27 - Unauthenticated Stored XSS
The 3CX Live Chat WordPress plugin was affected by an Unauthenticated Stored XSS security vulnerability...
WP Database Backup < 5.1.2 - XSS
The WP Database Backup WordPress plugin was affected by a XSS security vulnerability...
WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection
The includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement, leading to an unauthenticated SQL injection issue. PoC curl -k --silent "http://example.com/index.php?restroute=3D/wpgmza/v1/markers/=3D%7B%7D&=fields=3D+from+wpusers+--+-"...
JSmol2WP <= 1.07 - Unauthenticated Cross-Site Scripting (XSS)
The jsmol2wp WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://localhost:8080/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true=saveFile=%3Cscript%3Ealert/xss/%3C/script%3E=text/html;%20charset=utf-8...
WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins
Description According to WordPress: "Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances. WordPress itself was not affected, but plugins could be in some situations."...
WordPress <= 5.0 - User Activation Screen Search Engine Indexing
Description According to WordPress: "Team Yoast discovered that the user activation screen could be indexed by search engines in some uncommon configurations, leading to exposure of email addresses, and in some rare cases, default generated passwords."...
Yoast SEO <= 9.1 - Authenticated Race Condition
According to the changelog, "Race Condition which leads to command execution, by users with SEO Manager roles."...
Wechat Broadcast <= 1.2.0 - Local/Remote File Inclusion
This bug was found in the file: /wechat-broadcast/wechat/Image.php echo filegetcontentsisset$GET"url" ? $GET"url" : ''; The parameter "url" it is not sanitized allowing include local or remote files To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact...
Ajax BootModal Login <= 1.4.3 - Captcha Reuse
The Ajax BootModal Login WordPress plugin was affected by a Captcha Reuse security vulnerability...
Ninja Forms < 3.3.9 - Insufficient Restrictions during Export Personal Data requests
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by an Insufficient Restrictions during Export Personal Data requests security vulnerability...
WP Background Takeover <= 4.1.4 - Directory Traversal
Allows for an attacker to browse files via the download.php file PoC http://target.com/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php...
Ninja Forms <= 3.2.13 - Cross-Site Scripting (XSS)
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Enfold Theme < 4.2.1 - Rewrite Portfolio Permalink Structure & Information Disclosure
The changelog describes two security fixes: - fixed: security issue that would allow an attacker to export your enfold theme settings - fixed: security issue that allowed an attacker to rewrite the portfolio permalink structure...
WordPress Concours <= 1.1 - Authenticated Cross-Site Scripting (XSS)
The wp-concours WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Reflected XSS via GET parameter "to". Vulnerable Plugins: ------------------------------------------ 1. Clockwork Free and Paid SMS Notifications URL: https://wordpress.org/plugins/mediaburst-email-to-sms/ Version 2.0.3 | By Clockwork 2. Two-Factor Authentication - Clockwork SMS URL:...
WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing
...
Simple Login Log <= 1.1.0 - Authenticated SQL Injection
The Simple Login Log WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
Simple Custom CSS and JS <= 3.3 - Authenticated Cross-Site Scripting (XSS)
The Simple Custom CSS and JS WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Stop User Enumeration 1.3.5-1.3.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Stop User Enumeration WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?author=1...
WordPress 2.6.0-4.5.2 - Unauthorized Category Removal from Post
...
WordPress <= 4.5.1 - Pupload Same Origin Method Execution (SOME)
Description Affects 'wp-includes/js/plupload/plupload.flash.swf'...
Echosign <= 1.1 - Reflected Cross-Site Scripting (XSS)
The Echo Sign WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Booking Calendar Contact Form < 1.0.24 - XSS & SQL Injection
The Booking Calendar Contact Form WordPress plugin was affected by a XSS & SQL Injection security vulnerability...
Navis DocumentCloud 0.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The navis-documentcloud WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
Googmonify <= 0.5.1 - CSRF & XSS
The Googmonify WordPress plugin was affected by a CSRF & XSS security vulnerability...
Events Manager < 5.6 - Cross-Site Scripting (XSS) & Code Injection
The Events Manager WordPress plugin was affected by a Cross-Site Scripting XSS & Code Injection security vulnerability...
NewStatPress <= 1.0.4 - SQL Injection
The Search functionality is susceptible to a SQL Injection attack due to usage of user input without sanitation. In particular, at line 98 of 'includes/nspsearch.php'. Utilising a specially crafted SQL query, we can trigger disclosure of user hashes through an IMG tag as the data channel. PoC The...
Powerplay Gallery - Arbitrary File Upload & SQL Injection
The wp-powerplaygallery WordPress plugin was affected by an Arbitrary File Upload & SQL Injection security vulnerability...
Showbiz Pro <= 1.7.1 - Shell Upload
The showbizpro WordPress plugin was affected by a Shell Upload security vulnerability...
Lattice < 1.1.4 - Unspecified XSS
The lattice WordPress theme was affected by an Unspecified XSS security vulnerability...
Live Forms - Visual Form Builder 3.0.1 - Blind SQL Injection
The AJAX action ‘getreqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return...
Wpml < 3.1.9 - XSS
The wpml WordPress plugin was affected by a XSS security vulnerability...