14608 matches found
Formidable Forms < 6.2 - Unauthenticated PHP Object Injection
The plugin unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present. PoC To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup : void die"Arbitrary deserialization"; 1. Active this...
GTM4WP < 1.15.2 - Admin+ Stored Cross-Site Scripting
The plugin does not properly escape the Content Element ID settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfilteredhtml is disallowed for example multisite setups...
Multiple Easy Digital Downloads Plugins - Cross-Site Scripting Issue
Some of the extension were also vulnerable, but could not determine their slug/fixed version, such as the edd-amazon-s3 fixed in ??...
WPBakery Visual Composer < 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute
Description The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title tag attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor...
Multiple YITH WooCommerce plugins - Cross-Site Scripting via shortcode ajax
Multiple plugins from YITH does not protect its ajax actions against CSRF attacks, allowing an attacker to trick a logged in user to perform actions on their behalf by submitting a crafted request...
WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache
Description WordPress' Object Cache that caches data from the database did not validate or encode the cache key. If an attacker managed to inject a malicious cache key that was then output in a third party plugin, it could lead to XSS...
Redirection for Contact Form 7 < 3.0.0 - Missing Authorization
Description The Redirection for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportcurrentfilteredview function hooked via admininit in versions up to, and including, 2.9.2. This makes it possible for unauthenticated...
WP Google Map Plugin < 4.1.0 - CSRF to Unauthenticated PHP Object Injection
The WP Google Map Plugin WordPress plugin was affected by a CSRF to Unauthenticated PHP Object Injection security vulnerability...
WordPress 3.0-4.8.1 - Path Traversal in Unzipping
Description A path traversal vulnerability was discovered in the file unzipping code...
RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS
The plugin does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfilteredhtml capability is disallowed. PoC Vulnerable parameters: =, =, =, =, =, =. PoC 1 |...
Wordfence 3.8.1 - wp-admin/admin.php whois Parameter Stored XSS
The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a wp-admin/admin.php whois Parameter Stored XSS security vulnerability...
Essential Addons For Elementor < 5.8.2 - Unauthenticated MailChimp API Key Disclosure
Description The plugin discloses the MailChimp API key in pages with the MailChimp block, allowing unauthenticated users to obtain such key...
Betheme < 26.6.3 - Subscriber+ Unauthorised Action
The plugin does not have authorisation in some areas, which could allow any authenticated users, such as subscriber to perform unauthorised action...
WP Super Cache 1.3 - trunk/wp-cache.php wp_nonce_url Function URI XSS
The WP Super Cache WordPress plugin was affected by a trunk/wp-cache.php wpnonceurl Function URI XSS security vulnerability...
Contest Gallery Pro < 19.1.5 - Admin+ SQL Injection
The plugin does not escape the wpuserid GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges i.e. on multisite WordPress configurations to leak sensitive information from the site's database. PoC POST...
Folders Disclosure via Outdated jQueryFileTree Library
The plugins are using the admin-page-framework framework which is shipped with the outdated and no longer maintained library jQueryFileTree known to be affected by a path traversal issue, allowing unauthenticated attackers to disclose the folder structure of the web server PoC curl...
LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS
The plugin does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then ...
Loginizer < 1.6.4 - Unauthenticated SQL Injection
The Loginizer WordPress plugin was found to be affected by an Unauthenticated SQL Injection vulnerability found by the security researcher mslavco. The vulnerability was triggered within the brute force protection functionality, which was enabled by default when the plugin was first installed. Wh...
WP Super Cache 1.3 - trunk/plugins/wptouch.php URI XSS
The WP Super Cache WordPress plugin was affected by a trunk/plugins/wptouch.php URI XSS security vulnerability...
Element Pack Pro <= 7.7.4 - Authenticated (Contributor+) Arbitrary File Read and PHAR Deserialization
Description The Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.7.4. This makes it possible for authenticated attackers, with contributor-level access and above, to read the...
Gravity Forms < 2.7.5 - Reflected XSS
The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin. PoC Make a logged in admin open the following URL:...
Insert Pages < 3.7.5 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit:...
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
The plugin does not sanitise and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue PoC...
Contact Form Email < 1.3.25 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the /trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This only affects multi-site...
Qi Addons For Elementor < 1.6.4 - Authenticated (Contributor+) Local File Inclusion
Description The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowi...
Smart Slider 3 < 3.5.1.11 - PHP Object Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injection issues when a user import intentionally or not a malicious file, and a suitable gadget chain is present on the site. PoC To simulate a gadget chain, put the following code in a plugin class Evil publ...
SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure
The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink PoC...
Unauthorised AJAX Calls via Freemius
Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...
WooCommerce < 4.2.1 - Potential Cross-Site Scripting (XSS) via SelectWoo
A DOM based Cross-Site Scripting XSS vulnerability was found to affect the SelectWoo dependency that WooCommerce used. SelectWoo replaces the standard box in web browsers...
WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
Description According to the WordPress release notes: "Props to Soroush Dalili @irsdl from NCC Group for disclosing an issue with URL sanitization that can lead to cross-site scripting XSS attacks." PoC Thanks to @irsdl's Hacker1 disclosure: JS - Numerical Entities JS - Hex Entities...
Photo-Gallery <= 1.2.41 - UploadHandler.php File Upload CSRF
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by an UploadHandler.php File Upload CSRF security vulnerability...
Nexter < 2.0.4 - Missing Authorization
Description The Nexter theme for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions such as nexterextraextactiveajax, nexterextraextdeactivateajax, nexterextwpreplaceurlsettingsajax, nexterextwpduplicatepostsettingsajax,...
Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload
The plugin does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE. PoC 1. Install and activate WooCommerce dependency, no setup required 2. Create a local file containing the payload on /tmp/payload.php 3...
Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF
The LikeBtn WordPress plugin was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery SSRF. On line 7493 in likebtnlikebutton.php a hook is set to allow unauthenticated ajax calls which will call the function likebtnprx. As the name suggests, this function works as a proxy and can ...
Elegant Themes (Divi 3.0 - 4.5.2, Extra 2.0 - 4.5.2, Divi Builder 2.0 - 4.5.2) - Authenticated Arbitrary File Upload
Description This flaw gave authenticated attackers, with contributor-level or above capabilities, the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. PoC Usage: php poc.php url username password filetoupload Once the file is...
Ultimate Addons for Elementor < 1.20.1 - Authentication Bypass
A vulnerability affecting the Ultimate Addons for Elementor WordPress plugin allows malicious users to authenticate as any other user due to the lack of checks when logging in via Facebook or Google...
Multiple Plugins - jQueryFileTree - Unauthenticated Path Traversal
Since no authentication or authorisation checks for direct access to the jqueryFileTree.php are made, the vulnerability allows for browsing the file system on a host out of an unauthenticated context. Even though no file content can be exfiltrated this way, "hidden" files e.g. in the web...
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. PoC 1. Visit WP Fastest Cache Settings. Ensure "Cache System" is enabled, and "Logged-in Users" is disabled. Click "Submit"...
Mega Addons For WPBakery Page Builder < 4.3.0 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC vctestimonial link='target:"...
YITH WooCommerce Gift Cards < 3.20.0 - Unauthenticated Arbitrary File Upload
The plugin does not validate files to be uploaded, allowing unauthenticated attackers to upload arbitrary files, such as PHP...
Font Awesome 4 Menus <= 4.7.0 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC Put the following payload in the "A custom...
Yoast SEO 1.2.0-11.5 - Authenticated Stored XSS
The vendor's description, reference included below: "Yoast SEO 11.6 also fixes a security issue regarding term pages in WordPress. Unfiltered code was allowed in some fields. This, however, does not pose a problem for single user sites. In specific cases, on multisite installs, this might become ...
Salient Theme <= 4.9 - DOM Cross-Site Scripting (XSS)
The Salient theme comes budled with a vulnerable version of PrettyPhoto which can be found in http://www.example.com/wp-content/themes/salient/js/prettyPhoto.js...
WP Forum < 2.4 - Multiple SQL Injection
The wp-forum WordPress plugin was affected by a Multiple SQL Injection security vulnerability...
Slider Revolution < 6.7.0 - Missing Authorization
Description The Slider Revolution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the initrestapi function in versions up to 6.7.0. This makes it possible for unauthenticated attackers to update slider data...
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
The plugin does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild. PoC POST /register/ HTTP/1.1 Host: wpscan-vulnerability-test-bench.ddev.site...
Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation
The plugin allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. Note: This only affects membership from the plugin, not the WordPress role PoC The request contains the levelidentifier parameter with the md52 value, where 2 is...
Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting
The plugin does not sanitise and escape user input appended to the DOM via malicious Lightbox settings, resulting in a DOM Cross-Site Scripting issue PoC...
Ultimate GDPR & CCPA Compliance Toolkit < 2.5 - Unauthenticated Plugin Settings Export and Import
The plugin used the isadmin method as an authorisation check, which does not check if the user is a an administrator. This could allow unauthenticated attackers to import arbitrary plugin’s settings and redirect all traffic to an external malicious website for example. Even though proper capabili...
WordPress < 5.5.2 - Cross-Site Scripting (XSS) via Global Variables
Description The release notes state: "Thanks to Marc Montas from Sucuri for reporting an issue that could lead to XSS from global variables."...