14608 matches found
Newsletters Lite < 4.6.8.6 - PHP Object Injection
The Newsletters WordPress plugin was affected by a PHP Object Injection security vulnerability...
Ninja Forms < 3.2.15 - Parameter Tampering
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Parameter Tampering security vulnerability...
PropertyHive <= 1.4.14 - Cross-Site Scripting (XSS)
The PropertyHive WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Soundy Background Music <= 3.9 - Cross-Site Scripting (XSS)
The last time it was checked the plugin was still affected and had been closed...
Social Media Widget by Acurax <= 3.2.5 - Stored XSS & CSRF
The Social Media Widget by Acurax WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...
Smart Google Code Inserter <= 3.4 - Unauthenticated Cross-Site Scripting (XSS)
The Smart Google Code Inserter WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability...
WordPress 4.4-4.8.1 - Path Traversal in Customizer
Description A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team...
Responsive Image Gallery, Gallery Album <= 1.2.0 - Authenticated SQL Injection
The Responsive Image Gallery, Gallery Album WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
BackupGuard < 1.1.47 - Authenticated Cross-Site Scripting (XSS)
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Updraftplus < 1.13.5 - XSS
The UpdraftPlus WordPress Backup Plugin WordPress plugin was affected by a XSS security vulnerability...
Download Manager <= 2.9.50 - Open Redirect
The WordPress Download Manager WordPress plugin was affected by an Open Redirect security vulnerability...
Shortcodes Ultimate <= 4.9.9 - Authenticated Directory Traversal
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin was affected by an Authenticated Directory Traversal security vulnerability...
WP Jobs <= 1.4 - Authenticated SQL Injection
The WP Jobs WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF
...
Nelio Ab Testing < 4.6.4 - CSRF
The Nelio AB Testing WordPress plugin was affected by a CSRF security vulnerability...
Calendar by WD <= 1.5.51 - Authenticated Blind SQL Injection
The SpiderCalendar WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
Invite Anyone <= 1.3.14 - Change of Email Invitation Content
The Invite Anyone WordPress plugin was affected by a Change of Email Invitation Content security vulnerability...
Membership Simplified <= 1.58 - Unauthenticated Arbitrary File Download
The plugin is still affected and has been closed...
Dtracker <= 1.5 - Unauthorised Contract Creation
Plugin is still affected and has been closed...
Wp2android 1.1.4 - Unauthenticated File Upload
Plugin is still affected and has been closed...
Kama Click Counter <= 3.4.9 - Authenticated Blind SQL Injection
The Kama Click Counter WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=kama-clic-counterby=linkname=ASC%2cselectfromselectsleep30a=1...
Democracy Poll < 5.4 - CSRF & XSS
The Democracy Poll WordPress plugin was affected by a CSRF & XSS security vulnerability...
Time Sheets < 1.5.2 - Multiple XSS
The Time Sheets WordPress plugin was affected by a Multiple XSS security vulnerability...
Neosense Theme < 1.8 - Unrestricted File Upload
Neosense is a commercial WordPress theme by dynamicpress. Version 1.7 and possibly earlier includes in its theme directory a copy of the "qquploader" ajax file uploader, which does not verify user authorization. Using this uploader, an attacker can upload any file to the site. The uploaded file i...
Total Security < 3.4.1 - XSS & Settings Change
The Total Security WordPress plugin was affected by a XSS & Settings Change security vulnerability...
PeepSo <= 1.6.0 - Authenticated Privilege Escalation
Unfiltered input allows a logged in user to escalate their permissions to that of an Administrator...
WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure
...
Echosign <= 1.1 - Reflected Cross-Site Scripting (XSS)
The Echo Sign WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
GoCodes <= 1.3.5 - Authenticated XSS & Blind SQL Injection
The gocodes WordPress plugin was affected by an Authenticated XSS & Blind SQL Injection security vulnerability...
404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
Description The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
Payment Form for PayPal Pro <= 1.0.1 - Multiple Reflected Cross-Site Scripting (XSS)
The Payment Form for PayPal Pro WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS security vulnerability...
CP Reservation Calendar <= 1.1.6 - Unauthenticated SQL Injection
The CP Reservation Calendar WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
Postmatic <= 1.4.5 - Cross-Site Scripting (XSS)
The Replyable – Subscribe to Comments and Reply by Email WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Anti-Spam by CleanTalk < 5.22 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
Googmonify <= 0.5.1 - CSRF & XSS
The Googmonify WordPress plugin was affected by a CSRF & XSS security vulnerability...
Ultimate Member < 1.3.18 - Cross-Site Scripting (XSS)
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
NEX-Forms <= 4.0 - Unauthenticated Blind SQL Injection
The NEX-Forms – Ultimate Form Builder – Contact forms and much more WordPress plugin was affected by an Unauthenticated Blind SQL Injection security vulnerability...
ZoomSounds <= 2.0 - Remote File Upload
The dzs-zoomsounds WordPress plugin was affected by a Remote File Upload security vulnerability...
WP Smiley <= 1.4.1 - CSRF & Cross-Site Scripting (XSS)
Cross-Site scripting XSS in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php...
Showbiz Pro <= 1.7.1 - Shell Upload
The showbizpro WordPress plugin was affected by a Shell Upload security vulnerability...
Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection
Title: Gravity Forms 1.8 = 1.9.3.5 - Blind SQL Injection CVE-2015-2260 Version/s Tested: 1.9.3.1 Description: Gravity Forms is one of the most popular WordPress plugins gravityforms used to create forms for WordPress sites. The latest version at the time of writing 1.9.3.5 contains an authenticat...
Wordpress Video Gallery <= 2.7 - SQL Injection
The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability. PoC http://example.com/wp-admin/admin-ajax.php?action=rss=video=SQLi...
Banner Effect Header 1.2.6 - XSS & CSRF
The Banner Effect Header WordPress plugin was affected by a XSS & CSRF security vulnerability...
Lightbox Photo Gallery 1.0 - CSRF/XSS
The lightbox-photo-gallery WordPress plugin was affected by a CSRF/XSS security vulnerability...
XCloner - Backup and Restore < 3.1.2 - Multiple Vulnerabilities (RCE & LFI)
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin was affected by a Backup and Restore 3.1.2 - Multiple Vulnerabilities RCE & LFI security vulnerability...
Contus Video Gallery 2.3.1.0.1 - SQL Injection
The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability...
W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read
The W3 Total Cache WordPress plugin was affected by an Unauthenticated Arbitrary File Read security vulnerability...
LayerSlider 4.6.1 - Style Editing CSRF
The LayerSlider WordPress plugin was affected by a Style Editing CSRF security vulnerability...
JS MultiHotel 2.2.1 - includes/delete_img.php path Parameter Reflected XSS
The js-multihotel WordPress plugin was affected by an includes/deleteimg.php path Parameter Reflected XSS security vulnerability...