14608 matches found
The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure
The plugin does not validate the qvquery parameter of the tpgetdlpostinfoajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts PoC The following request allow an unauthenticated user to get the draft posts the nonce can be...
WP Guppy < 1.3 - Sensitive Information Disclosure
The plugin does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user PoC !/bin/bash Exploit Title:...
Preview E-mails for WooCommerce < 2.0.0 - Reflected Cross-Site Scripting
The plugin is vulnerable to reflected XSS via the searchorder parameter found in the /views/form.php file. PoC...
Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS
The plugin does not have any authorisation and CSRF checks on some of its AJAX actions available to authenticated users, which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users d...
HashThemes Demo Importer < 1.1.2 - Improper Access Control to Blog Reset
The plugin does not have capability checks in some of its AJAX action, relying on CSRF nonces for this, which are displayed for any authenticated users. As a result, a user with a role as low as subscriber could use the hdiinstalldemo AJAX action to reset the entire blog including the tables in t...
Sassy Social Share 3.3.23 - Missing Access Controls to PHP Object Injection
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wpajaxheateorsssimportconfig AJAX action due to a missing capability check in the importconfig function found in the /admin/class-sassy-social-share-admin.php file along with the implementation...
Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Add/Edit a Custom Field /wp-admin/admin.php?page=eme-formfields and put the following payload in the Field...
LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltredhtml capability is disallowed PoC When adding new courses, the following fields can have XSS payloads like "...
Dflip Lite < 1.7.10 - Contributor+ Stored Cross-Site Scripting
Description The plugin does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks PoC dflip class='"...
Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting
The plugin does not escape the Share Title settings before outputting it in the frontend pages or posts depending on the settings used, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the...
MoolaMojo <= 0.7.4.1 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the /views/button-generator.html.php file which allows attackers to inject arbitrary web scripts...
jQuery Tagline Rotator <= 0.1.5 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts...
AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting
The plugin does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Add the following payload in the Universal Button Image URL settings: " onerror=alert/XSS/ " The...
WP Upload Restriction < 2.2.5 - Missing Access Control in deleteCustomType
Missing access control in deleteCustomType function allows authenticated users, such as subscribers, to delete custom extensions...
Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting XSS vulnerability within the Forms "Add new" field. PoC Step 1: Install and activate the plugin. Step 2: Go to the Forms-- Add New...
Workreap < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
The theme's AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were...
FAQ Builder < 1.3.6 - Authenticated Blind SQL Injections
The getfaqs function in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC SQLMAP: python sqlmap.py -r r.txt -p orderby --level 5 --risk 3 --dbms MySQL...
Popup box < 2.3.4 - Authenticated Blind SQL Injections
The getayspopupboxes and getpopupcategories functions of the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC Exploit All of them with same technique...
Yada Wiki < 3.4.1 - Contributor+ Stored XSS
The plugin did not sanitise, validate or escape the anchor attribute of its shortcode, leading to a Stored Cross-Site Scripting issue PoC - Create a wiki page. If there is already a page, you can skip. The page can be a draft. - Add this shortcode to a post/page, view it and move the mouse over...
Jannah < 5.4.5 - Reflected Cross-Site Scripting (XSS)
The theme did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability. PoC POST /demo/wp-admin/admin-ajax.php HTTP/1.1 Host: jannah.tielabs.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:89.0...
JoomSport < 5.1.8 - Unauthenticated PHP Object Injection
The joomsportmdload AJAX action of the plugin, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other...
Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS
The theme did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue PoC https://smartdata.tonytemplates.com/car-repair-service-v4/car1/estimateresult/result?s==...
Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS
The plugins have a number of widgets that are vulnerable to stored Cross-Site ScriptingXSS by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “titletag” parameter. Although the element control lists a fixed set of possible html tags, it is possib...
Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)
The plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored...
Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE
The plugin does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE. PoC POST /addalisting/ HTTP/1....
Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE
The Imagements WordPress plugin, versions = 1.2.5, allowed images to be uploaded in comments, however, only checked for the Content-Type HTTP header for validation, which can be tampered with. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type head...
WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update
An AJAX action registered by the plugin did not have capability checks, allowing low privilege users, such as subscribers, to update the license options key, email. PoC When logged in as a user with Subcriber role or greater, submit a request to wp-admin/admin-ajax.php with action =...
Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the plugin, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link...
All Thrive Themes and Plugins - Unauthenticated Option Update
The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget
In the plugin, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript in...
Pricing Table by Supsystic < 1.8.9 - Authenticated SQL Injections
The GET parameter sidx and sord are used in a SQL statement without being sanitised when searching for pricing tables in the dashboard, leading to an authenticated SQL Injection issues. PoC...
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
The plugin did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. PoC https://drive.google.com/file/d/1lLEXDyPp4LcKoCOqYS7A-0YgpIQD-ND/view?usp=sharing...
WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
"The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the orderid parameter in a fetchorderstatus action." PoC https://example.com/wp-admin/admin-ajax.php?action=fetchorderstatusid=XX...
Ninja Forms < 3.4.28 - Stored Cross-Site Scripting
The plugin did not escape HTML content of fields in the submissions table, which could lead to Cross-Site Scripting issues...
YITH WooCommerce Ajax Product Filter < 3.11.1 - Authenticated Reflected Cross-Site Scripting (XSS)
The YITH WooCommerce Ajax Product Filter WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS vulnerability in an admin form. The vulnerability was fixed in version 3.11.1 of the plugin...
bbPress < 2.6.5 - Authenticated Stored Cross-Site Scripting via the forums list table
binit discovered a stored XSS issue via the forums list table. The payload is put and can only be triggered by accounts with the Keymaster bbPress role...
Chopslider <= 3.4 - Unauthenticated Blind SQL Injection
The id parameter of the getscript/index.php page is not sanitised when used in a SQL statement, leading to an unauthenticated blind SQL Injection issue. Vendor was contacted by researcher, on March 3rd, 2020 but no reply was received. PoC The PoC will be displayed once the issue has been remediat...
LearnPress < 3.2.6.9 - Authenticated Post Creation and Status Modification
The LearnPress plugin for WordPress allows authenticated remote attackers with minimal permissions to create pages with arbitrary titles, or modify the publication status of any existing page, via the learnpresscreatepage or learnpressupdateorderstatus AJAX actions...
GTranslate < 2.8.52 - Unauthenticated Reflected Cross Site Scripting (XSS)
The GTranslate plugin before 2.8.52 for WordPress was vulnerable to an Unauthenticated Reflected XSS vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option. The vulnerability was due to outputting the WordPress addqueryarg...
LifterLMS < 3.37.15 - Arbitrary File Writing
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress WordPress plugin was affected by an Arbitrary File Writing security vulnerability...
Newsletter < 6.5.4 - CSV Injection
A CSV Injection vulnerability was discovered in Wordpress Newsletter plugin. It allows a user with low level privileges or no privileges to inject a command in subscription form that will be included in the exported CSV file, leading to possible code execution...
WordPress File Upload < 4.13.0 - Directory Traversal to RCE
WordPress File Upload plugin directory traversal. It's possible to use the directory traversal to gain RCE by uploading a file doesn't matter the extension inside the /lib directory of the plugin. More details here https://github.com/beerpwn/CVE/tree/master/WP-File-Uploaddisclosurereport...
Modern Events Calendar Lite < 5.1.7 - Multiple Subscriber+ Stored XSS
Modern Events Calendar Lite registers a number of AJAX actions for logged-in users. Some of these actions allow low-privileged users like subscribers to manipulate settings and other stored data. When exploited in this way, the affected data can be injected with various XSS payloads...
Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hmapsprem WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC...
GistPress < 3.0.2 - Authenticated Stored XSS
XSS vulnerability that could be exploited by untrusted contributors on multi-author sites...
CityBook < 2.3.4 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'CityBook - Directory & Listing WordPress Theme', tested version — v2.3.3: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR Edit WPScanTeam: December 27h, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January...
Popup-Maker < 1.8.12 - Multiple Vulnerabilities
An attacker can partially control the arguments of the doaction, during the initialization of the PUMSite . Because of this, an attacker can call any method which contains an action starting from popmake or pum . This will lead to successful execution of functions which do not require arguments...
WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews
Description According to the WordPress release notes: "Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting XSS in shortcode previews."...
Slick Popup <= 1.7.1 - Privilege Escalation
Subscriber users are able to create an administrator account with hardcoded login credentials. PoC Hardcoded username "slickpopupteam" and its password is OmakPass13...