14623 matches found
Ninja Forms < 3.4.28 - Stored Cross-Site Scripting
The plugin did not escape HTML content of fields in the submissions table, which could lead to Cross-Site Scripting issues...
Advanced Access Manager < 6.6.2 - Authenticated Information Disclosure
The plugin’s aam/v1/authenticate and aam/v2/authenticate REST endpoints were set to respond to a successful login with a json-encoded copy of all metadata about the user, potentially exposing users’ information to an attacker or low-privileged user. This included items like the user’s hashed...
KingComposer < 2.9.5 - Unauthenticated Reflected Cross-Site Scripting
A reflected Cross-Site Scripting XSS Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an installonlinepreset AJAX request containing base64-encoded JavaScript in the kc-online-preset-data POST parameter that is executed...
bbPress < 2.6.5 - Authenticated Stored Cross-Site Scripting via the forums list table
binit discovered a stored XSS issue via the forums list table. The payload is put and can only be triggered by accounts with the Keymaster bbPress role...
Paytium < 3.1.2 - Stored Cross-Site Scripting (XSS)
Both authenticated and unauthenticated stored XSS issues via fields in the payment details...
GTranslate < 2.8.52 - Unauthenticated Reflected Cross Site Scripting (XSS)
The GTranslate plugin before 2.8.52 for WordPress was vulnerable to an Unauthenticated Reflected XSS vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option. The vulnerability was due to outputting the WordPress addqueryarg...
Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS
This flaw allowed any authenticated user with subscriber-level and above permissions the ability to import a new accordion and inject malicious Javascript as part of the accordion. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Accept: / X-Requested-With: XMLHttpRequest User-Agent:...
LearnDash < 3.1.6 - Unauthenticated SQL Injection
The sfwd-lms WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
LifterLMS < 3.37.15 - Arbitrary File Writing
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress WordPress plugin was affected by an Arbitrary File Writing security vulnerability...
Newsletter < 6.5.4 - CSV Injection
A CSV Injection vulnerability was discovered in Wordpress Newsletter plugin. It allows a user with low level privileges or no privileges to inject a command in subscription form that will be included in the exported CSV file, leading to possible code execution...
WordPress File Upload < 4.13.0 - Directory Traversal to RCE
WordPress File Upload plugin directory traversal. It's possible to use the directory traversal to gain RCE by uploading a file doesn't matter the extension inside the /lib directory of the plugin. More details here https://github.com/beerpwn/CVE/tree/master/WP-File-Uploaddisclosurereport...
Pricing Table by Supsystic < 1.8.2 - Insecure Permissions on AJAX Actions
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or...
ThemeREX Addons - Remote Code Execution
"This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts." Note WPScanTeam: There are major version inconsistencies in the trxaddons shipped with the affected themes. As a result, a...
Fruitful Theme < 3.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Fruitful WordPress theme, version 3.8 and possibly below, was affected by an unauthenticated Reflected Cross-Site Scripting XSS vulnerability. The vulnerability was patched in version 3.8.1 of the Theme, although the changelog file only mentions: "Bug fix: Fixed issues on comment form" PoC Ad...
GistPress < 3.0.2 - Authenticated Stored XSS
XSS vulnerability that could be exploited by untrusted contributors on multi-author sites...
WP Intercom Slack <= 1.2.2 - Slack Access Token Disclosure
The Intercom plugin through 1.2.2 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
Popup-Maker < 1.8.12 - Multiple Vulnerabilities
An attacker can partially control the arguments of the doaction, during the initialization of the PUMSite . Because of this, an attacker can call any method which contains an action starting from popmake or pum . This will lead to successful execution of functions which do not require arguments...
WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews
Description According to the WordPress release notes: "Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting XSS in shortcode previews."...
Sina Extension For Elementor <= 2.2.0 - LFI
The Sina Extension for Elementor WordPress plugin was affected by a LFI security vulnerability...
Slick Popup <= 1.7.1 - Privilege Escalation
Subscriber users are able to create an administrator account with hardcoded login credentials. PoC Hardcoded username "slickpopupteam" and its password is OmakPass13...
Option Tree < 2.7.0 - PHP Object Injection
The OptionTree WordPress plugin was affected by a PHP Object Injection security vulnerability...
article2pdf - Multiple Vulnerabilities
The article2pdf WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
Better Search 2.2.2 - Unauthenticated SQL Injection
The Better Search WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
Import users from CSV with meta <= 1.14.0.2 - XSS and CSRF
The Import and export users and customers WordPress plugin was affected by a XSS and CSRF security vulnerability...
LoginPress <= 1.1.15 - Authenticated Blind SQL Injection
Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...
Social Sharing Plugin – Kiwi <= 2.0.10 - Update Any Option
The Social Sharing Plugin – Kiwi WordPress plugin was affected by an Update Any Option security vulnerability...
WPML <= 3.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
The sitepress-multilingual-cms WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability. PoC POST /wp-admin/admin.php?page=sitepress-multilingual-cms-3.6.3%2Fmenu%2Ftheme-localization.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Windows NT...
Contact Form 7 <= 5.0.3 - register_post_type() Privilege Escalation
According to the official release: "A privilege escalation vulnerability has been found in Contact Form 7 5.0.3 and older versions. Utilizing this vulnerability, a logged-in user in the Contributor role can potentially edit contact forms, which only Administrator and Editor-role users are allowed...
Chained Quiz <= 1.0.8 - Unauthenticated SQL Injection
WordPress Plugin Plugin Chained Quiz before 1.0.9 allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters. Technical details: Chained Quiz appears to be vulnerable to time-based SQL-Injection. The issue lies on the "$answer" backend variable...
Geo Mashup <= 1.10.3 - Unspecified Cross-Site Scripting (XSS)
The Geo Mashup WordPress plugin was affected by an Unspecified Cross-Site Scripting XSS security vulnerability...
wpForo Forum <= 1.4.11 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Version 1.4.11, and below, of the wpForo Forum WordPress Plugin were found to be vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability was due to the Plugin using the $SERVER'REQUESTURI' PHP variable to create a URL string that was later output within HTML without any output encodin...
Tagregator <= 0.6 - Stored XSS
The Tagregator WordPress plugin was affected by a Stored XSS security vulnerability...
Form Maker by WD < 1.12.24 - CSV Injection
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin was affected by a CSV Injection security vulnerability...
PropertyHive <= 1.4.14 - Cross-Site Scripting (XSS)
The PropertyHive WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Max Mega Menu <= 2.3.8 - Authenticated XSS
The Max Mega Menu WordPress plugin was affected by an Authenticated XSS security vulnerability...
2kb Amazon Affiliates Store <= 2.1.0 - Authenticated Cross-Site Scripting (XSS)
Description The 2kb Amazon Affiliates Store WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
BackupGuard < 1.1.47 - Authenticated Cross-Site Scripting (XSS)
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Updraftplus < 1.13.5 - XSS
The UpdraftPlus WordPress Backup Plugin WordPress plugin was affected by a XSS security vulnerability...
rk-responsive-contact-form 1.0 - Authenticated Blind SQL Injection
The rk-responsive-contact-form WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
wordpress-gallery-transformation 1.0 - Blind SQL Injection
The wordpress-gallery-transformation WordPress plugin was affected by a Blind SQL Injection security vulnerability...
Download Manager <= 2.9.50 - Open Redirect
The WordPress Download Manager WordPress plugin was affected by an Open Redirect security vulnerability...
WP Jobs <= 1.4 - Authenticated SQL Injection
The WP Jobs WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
Delightful Downloads <= 1.6.6 - Unauthenticated Path Traversal
Since no authentication or authorisation checks for direct access to the jqueryFileTree.php are made, the vulnerability allows for browsing the file system on a host out of an unauthenticated context. Even though no file content can be exfiltrated this way, "hidden" files e.g. in the web...
Nelio Ab Testing < 4.6.4 - CSRF
The Nelio AB Testing WordPress plugin was affected by a CSRF security vulnerability...
Mobile App Native <= 3.0 - Remote File Upload
The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. PoC $ curl -F "file=@/var/www/shell.php"...
Kama Click Counter <= 3.4.9 - Authenticated Blind SQL Injection
The Kama Click Counter WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=kama-clic-counterby=linkname=ASC%2cselectfromselectsleep30a=1...
Democracy Poll < 5.4 - CSRF & XSS
The Democracy Poll WordPress plugin was affected by a CSRF & XSS security vulnerability...
Time Sheets < 1.5.2 - Multiple XSS
The Time Sheets WordPress plugin was affected by a Multiple XSS security vulnerability...