14653 matches found
YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF
The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...
W3 Total Cache < 2.1.3 - Authenticated Stored XSS
The plugin did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue PoC Vulnerable parameters: cnames= 1, cdncnames= 2, cdncnames= 3. CDN Type:...
Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities
The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...
Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS)
The plugin did not escape the backuprecipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue. PoC POST /wp-admin/tools.php?page=wp-db-backup HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Content-Type:...
Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting XSS vulnerability within the "Default Skin" field. PoC Step1: Install and activate the plugin. Step2: Go to the plugin setting. Step3: Enter the following payload in the field "Default Skin" xss"...
WP Fastest Cache < 0.9.1.7 - Authenticated Arbitrary File Deletion via Path Traversal
The plugin did not validate a path parameter, allowing administrators to delete arbitrary files on the server via a path traversal attack...
Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)
There are several endpoints in the plugin that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages. PoC The PoC will be displayed once the issue has been remediated...
Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)
The plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. Due to the lack of sanitisation, this could also lead to a Stored...
Image Hover Effects - Elementor Addon < 1.3.4 - Contributor+ Stored XSS
The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Image Hover Effects” widget accepts a "eihetag" parameter. Although the eleme...
JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSS
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Animated Box” widget accepts "titlehtmltag" and "subtitlehtmltag" parameters...
Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE
The Imagements WordPress plugin, versions = 1.2.5, allowed images to be uploaded in comments, however, only checked for the Content-Type HTTP header for validation, which can be tampered with. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type head...
WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update
An AJAX action registered by the plugin did not have capability checks, allowing low privilege users, such as subscribers, to update the license options key, email. PoC When logged in as a user with Subcriber role or greater, submit a request to wp-admin/admin-ajax.php with action =...
Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
The Jetpack Scan team identified a Local File Disclosure vulnerability in the plugin that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in t...
Patreon WordPress < 1.7.2 - Reflected XSS on Login Form
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the plugin. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind...
WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)
The editor of the plugin allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side...
JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The plugin doesn't sanitise the referer and path of 404 pages, when they are output in the dashboard, which leads to executing arbitrary JavaScript code in the WordPress dashboard. PoC curl 'https://example.com/non-existing-page"' -e '"'...
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
The REST API endpoint getusers in the plugin returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information. PoC Usage: php poc.php auth...
Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP plugin and retrieve the clientsecret key needed to...
Pricing Table by Supsystic < 1.8.9 - Authenticated SQL Injections
The GET parameter sidx and sord are used in a SQL statement without being sanitised when searching for pricing tables in the dashboard, leading to an authenticated SQL Injection issues. PoC...
Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection
The plugin did not sanitise the mecpostid POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue. If the Frontend Event Submission form is embed in a public page, then it could lead to any authenticated user, like subscribers to...
WooCommerce < 4.7.0 - Arbitrary Order Status Disclosure via IDOR
"The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the orderid parameter in a fetchorderstatus action." PoC https://example.com/wp-admin/admin-ajax.php?action=fetchorderstatusid=XX...
Post Grid < 2.0.73 & Team Showcase < 1.22.16 - Authenticated Stored Cross-Site Scripting (XSS)
Ram Gall from Wordfence discovered an authenticated subscriber+ Stored Cross-Site Scripting XSS vulnerability in the Post Grid and Team Showcase WordPress plugins...
YITH WooCommerce Ajax Product Filter < 3.11.1 - Authenticated Reflected Cross-Site Scripting (XSS)
The YITH WooCommerce Ajax Product Filter WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS vulnerability in an admin form. The vulnerability was fixed in version 3.11.1 of the plugin...
Chopslider <= 3.4 - Unauthenticated Blind SQL Injection
The id parameter of the getscript/index.php page is not sanitised when used in a SQL statement, leading to an unauthenticated blind SQL Injection issue. Vendor was contacted by researcher, on March 3rd, 2020 but no reply was received. PoC The PoC will be displayed once the issue has been remediat...
Cookiebot < 3.6.1 - Authenticated Reflected Cross-Site Scripting (XSS)
Versions prior to 3.6.1 are susceptible to this attack, which allows hackers to exploit the vulnerability found on administrative pages...
Hero Maps Premium < 2.2.3 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hmapsprem WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC...
Pricing Table by Supsystic < 1.8.2 - Insecure Permissions on AJAX Actions
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or...
Houzez < 1.8.4 - Unauthenticated Cross-Site Scripting (XSS)
Two Reflected XSS vulnerability were discovered in the «Houzez - Real Estate WordPress Theme», tested version — v1.8.3.1 Edit WPScanTeam: January 11th, 2020 - Report received & Envato Contacted January 12th, 2020 - Envato Investigating January 27th, 2020 - v1.8.4 released, fixing the issue. PoC...
Events Manager < 5.9.6 - Authenticated Stored Cross-Site Scripting (XSS)
The Events Manager WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...
WordPress <= 5.2.3 - Stored XSS in Customizer
...
Motors Car Dealer & Classified Ads < 1.4.1 - Multiple Issues
- Unauthenticated plugin's settings import/export leading to stored XSS - Authenticated settings import - Unsanitised inputs - Authenticated options change...
LifterLMS <= 3.34.5 - Unauthenticated Options Import
Unauthenticated Options Import, which could lead to - Website Redirection - Administrator Account Creation - Content Injection - Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional input sanitisation and filtering...
Event Tickets <= 4.10.7.1 - CSV Injection
The Event Tickets WordPress plugin was affected by a CSV Injection security vulnerability...
WP Fastest Cache <= 0.8.9.5 - Directory Traversal
The WP Fastest Cache WordPress plugin was affected by a Directory Traversal security vulnerability...
WPS Hide Login <= 1.5.2.2 - Multiples Issues
Protection Bypasses...
Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin was affected by an Authenticated Remote Code Execution security vulnerability. PoC The nonce aicheck in the final request can be obtained by querying the homepage with the AIWPDEBUGGING cookie set to 2. Then, use an account with a role a...
CP Contact Form with Paypal <= 1.3.01 - Multiple XSS
The CP Contact Form with PayPal WordPress plugin was affected by a Multiple XSS security vulnerability. PoC Version =1 fixed in 1.2.98...
Sina Extension For Elementor <= 2.2.0 - LFI
The Sina Extension for Elementor WordPress plugin was affected by a LFI security vulnerability...
Insert or Embed Articulate Content into WordPress <= 4.2998 - Authenticated RCE
Original issue fixed in 4.2998. However, it was also be possible to upload via articulateuploadajaxfile AJAX method which was lacking authorisation checks and has been fixed in 4.2999...
FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection
Changelog states: "Security - fix for SQL injection vulnerability in email subscription"...
Form Maker by 10Web < 1.13.3 - Authenticated SQL Injection
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
WPGraphQL <= 0.2.3 - Multiple Vulnerabilities
Without authorisation, weak access controls allow us to: Create administrative users Post comments on articles bypassing article restrictions and global moderation Retrieve content of password-protected posts/articles/pages Retrieve full list of registered users in the platform Retrieve full list...
WooCommerce Checkout Manager <= 4.2.6 - Arbitrary File Upload
The Checkout Manager for WooCommerce WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
Contact Form Builder <= 1.0.68 - CSRF to LFI
The WDContactFormBuilder WordPress plugin was affected by a CSRF to LFI security vulnerability...
WP Database Backup < 5.1.2 - XSS
The WP Database Backup WordPress plugin was affected by a XSS security vulnerability...
Ninja Forms File Uploads Extension <= 3.0.22 - Unauthenticated Arbitrary File Upload
The ninja-forms-uploads WordPress plugin was affected by an Unauthenticated Arbitrary File Upload security vulnerability...
WP Google Maps 7.11.00-7.11.17 - Unauthenticated SQL Injection
The includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement, leading to an unauthenticated SQL injection issue. PoC curl -k --silent "http://example.com/index.php?restroute=3D/wpgmza/v1/markers/=3D%7B%7D&=fields=3D+from+wpusers+--+-"...
Google XML Sitemaps <= 4.0.9 - Authenticated Cross-Site Scripting (XSS)
According to the changelog: 4.1.0 2018-12-18 - Fixed security issue related to escaping external URLs - Fixed security issue related to option tags in forms...
WP Payeezy Pay < 2.98 - Local File Inclusion
The WP Payeezy Pay WordPress plugin was affected by a Local File Inclusion security vulnerability...
LoginPress <= 1.1.15 - Authenticated Blind SQL Injection
Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...