Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities

The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

There are several endpoints in the plugin that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages. PoC The PoC will be displayed once the issue has been remediated...

Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)

The settings page of the plugin did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/options-general.php?page=moove-redirect-settings=" onMouseOver="alert1;...

Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)

The plugin did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue PoC /wp-admin/admin.php?page=popup-wp-supsystic="onmouseover=alert1//...

Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSS

The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Flip Box” widget accepts a “fronttitlehtmltag” parameter. Although the element...

Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS

The theme does not sanitise the keywords and startdate GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue. PoC Payload:...

Patreon WordPress < 1.7.2 - Reflected XSS on Login Form

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the plugin. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind...

Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain

The runaction function of the plugin deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution. PoC Step 1: Use the nonce...

WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)

During a quick security auditing of the plugin, in the default configuration a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...

Photo Gallery by 10web < 1.5.69 - Reflected Cross-Site Scripting (XSS)

The plugin did not properly sanitise the bwgsearchX GET parameter, available in a frontend gallery when the Show Search Box setting is enabled disabled by default, leading to a reflected Cross-Site Scripting issue PoC Append the below payload in a page with an embedded gallery and the Show Search...

Post SMTP Mailer/Email Log < 2.0.21 - CSRF Nonce Bypass

A user could bypass the nonce check associated with Export mail to CSV handleCsvExport function PoC Submit a request w/o the post-smtp-log-nonce parameter...

iThemes Security < 7.7.0 - New-Password Requirements Not Enforced Until second Login

The plugin did not enforce new-password requirements for existing accounts until the second login occurred, which could leave an account configured with a potentially weak password until the user changes it...

Post Grid < 2.0.73 & Team Showcase < 1.22.16 - Authenticated Stored Cross-Site Scripting (XSS)

Ram Gall from Wordfence discovered an authenticated subscriber+ Stored Cross-Site Scripting XSS vulnerability in the Post Grid and Team Showcase WordPress plugins...

ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

The ActiveCampaign 8.0.1 plugin is lacking CSRF check on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account. PoC When a logged-in administrator accesses an HTML page embedded below content, the plugin's setting will be...

Advanced Access Manager < 6.6.2 - Authenticated Information Disclosure

The plugin’s aam/v1/authenticate and aam/v2/authenticate REST endpoints were set to respond to a successful login with a json-encoded copy of all metadata about the user, potentially exposing users’ information to an attacker or low-privileged user. This included items like the user’s hashed...

Coming Soon Page, Under Construction & Maintenance Mode by SeedProd < 5.1.2 - Authenticated Stored Cross Site Scripting (XSS)

Authenticated stored cross-site scripting issues in some of the plugin settings, requiring high privileges. PoC Affected fields are in the settings of the plugin and will be triggered when the common soon page is displayed either the preview or normal one: Logo: x' onerror='alert/XSS/ Headlines:...

AdRotate < 5.8.4 - Authenticated SQL Injection

Authenticated SQL injection in the AdRotate 5.8.3.1 exists via param "id". However, this requires an admin privileged user. NOTE: The plugin author mistook this SQLi bug for XSS but the remedy remains OK. PoC Param "id" is vulneable to SQL Injeciton. Example 1:...

Iframe < 4.5 - Authenticated Stored Cross Site Scripting (XSS)

The iframe plugin before 4.5 does not sanitize a URL. PoC iframe src="javascript:alertdocument.cookie" width="100%" height="500"...

Advanced Order Export For WooCommerce < 3.1.4 - Authenticated Cross-Site Scripting (XSS)

The Advanced Order Export plugin for WooCommerce versions 3.1.4 had a reflected XSS vulnerability due to lack of input sanitization on the woeposttype parameter. This allowed arbitrary HTML and JavaScript injection and execution in the context of the logged in user. PoC On a WooCommerce...

LearnDash < 3.1.6 - Unauthenticated SQL Injection

The sfwd-lms WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

Cookiebot < 3.6.1 - Authenticated Reflected Cross-Site Scripting (XSS)

Versions prior to 3.6.1 are susceptible to this attack, which allows hackers to exploit the vulnerability found on administrative pages...

ThemeREX Addons - Remote Code Execution

"This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts." Note WPScanTeam: There are major version inconsistencies in the trxaddons shipped with the affected themes. As a result, a...

Elementor < 2.7.5 - Authenticated Arbitrary File Upload

The Elementor plugin version 2.7.4 and below was found to be vulnerable to an arbitrary file upload. Due to the application not handling zip files with directories properly an attacker could upload php files which were executable, this allowed any user able to import templates WordPress role...

Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)

IDOR issues allowing change of other users' profiles and cover photos...

EasyBook < 1.2.2 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'EasyBook – Directory & Listing WordPress Theme', tested version — v1.2.1: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR December 27th, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January ??th, 2020 -...

WP Intercom Slack <= 1.2.2 - Slack Access Token Disclosure

The Intercom plugin through 1.2.2 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

WordPress <= 5.2.3 - Stored XSS in Style Tags

...

LifterLMS <= 3.34.5 - Unauthenticated Options Import

Unauthenticated Options Import, which could lead to - Website Redirection - Administrator Account Creation - Content Injection - Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional input sanitisation and filtering...

Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion

The adminInit function of the admin/includes/class.actions.snippets.php file, registered as an admininit hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog PoC...

Everest Forms <= 1.4.9 - SQL Injection

The Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms WordPress plugin was affected by a SQL Injection security vulnerability...

Import users from CSV with meta <= 1.14.1.3 - CSRF leading to attachment deletion & Path Traversal

CSRF leading to attachment deletion via the acuideleteattachment AJAX function...

Sina Extension For Elementor <= 2.2.0 - LFI

The Sina Extension for Elementor WordPress plugin was affected by a LFI security vulnerability...

WP-Members <= 3.2.7 - Cross-Site Request Forgery (CSRF)

No CSRF Protection on Add new Fields. Can also Edit and Delete fields the same way. PoC 1.Download csrfwp-members.html 2.Change URL in html file.FORM ACTION. 3.Submit Request. Video POC : https://drive.google.com/file/d/1TuJK0NjxznjTDmoJF5wbGu2vMAXXikw/view?usp=sharing HTMLFILE :...

ConvertPlus <= 3.4.4 - Multiple Issues

According to the changelog: 3.4.5 - Security: User with none role gets created on form submission by curl request for variants. 3.4.4 - Improved sanitization, escaping and other security improvements...

Zoho SalesIQ <= 1.0.8 - XSS & CSRF

The Zoho SalesIQ WordPress plugin was affected by a XSS & CSRF security vulnerability...

SAML SP Single Sign On <= 4.8.72 - Cross-Site Scripting (XSS)

The SAML Single Sign On – SSO Login WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Hostel Plugin <= 1.1.3 - Unauthenticated Stored XSS

This vulnerability allows any user can inject Javascript code and the code will be executed on the admin side when he visits the Bookings Page Authentication Required:No Affected Version: 1.1.3 or possibly below Fixed version:1.1.4...

FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS

The vulnerable function is exposed to unauthenticated users over wpajaxnoprivfvwpflowplayeremailsignup ajax hook. It saves anything that user provides in email POST parameter. PoC Send POST request to wp-admin/admin-ajax.php with body content: "[email protected]" The...

Option Tree < 2.7.0 - PHP Object Injection

The OptionTree WordPress plugin was affected by a PHP Object Injection security vulnerability...

Ninja Forms File Uploads Extension <= 3.0.22 - Unauthenticated Arbitrary File Upload

The ninja-forms-uploads WordPress plugin was affected by an Unauthenticated Arbitrary File Upload security vulnerability...

Form Maker by 10Web < 1.13.5 - Cross-Site Request Forgery (CSRF) to LFI

Form Maker by WD plugin suffers from a CSRF issue that could lead to an LFI attack...

article2pdf - Multiple Vulnerabilities

The article2pdf WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

Import users from CSV with meta <= 1.14.0.2 - XSS and CSRF

The Import and export users and customers WordPress plugin was affected by a XSS and CSRF security vulnerability...

WP Live Chat Support < 8.0.18 - Cross-Site Scripting (XSS)

The 3CX Live Chat WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins

Description According to WordPress: "Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances. WordPress itself was not affected, but plugins could be in some situations."...

Booking Calendar <= 2.2.2 - Parameters Tampering Allowing Arbitrary Prices Change

Note: It is unclear whether or not this issue has been remediated...

Tagregator <= 0.6 - Stored XSS

The Tagregator WordPress plugin was affected by a Stored XSS security vulnerability...

Form Maker by WD < 1.12.24 - CSV Injection

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin was affected by a CSV Injection security vulnerability...

WordPress File Upload <= 4.3.3 - Cross-Site Scripting (XSS)

The WordPress File Upload WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WP Background Takeover <= 4.1.4 - Directory Traversal

Allows for an attacker to browse files via the download.php file PoC http://target.com/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php...