Hostel Plugin <= 1.1.3 - Unauthenticated Stored XSS

This vulnerability allows any user can inject Javascript code and the code will be executed on the admin side when he visits the Bookings Page Authentication Required:No Affected Version: 1.1.3 or possibly below Fixed version:1.1.4...

FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection

Changelog states: "Security - fix for SQL injection vulnerability in email subscription"...

Option Tree < 2.7.0 - PHP Object Injection

The OptionTree WordPress plugin was affected by a PHP Object Injection security vulnerability...

Better Search 2.2.2 - Unauthenticated SQL Injection

The Better Search WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

Booking < 8.4.5.15 - SQL Injection

The Booking Calendar WordPress plugin was affected by a SQL Injection security vulnerability...

WP Live Chat Support < 8.0.18 - Cross-Site Scripting (XSS)

The 3CX Live Chat WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Google XML Sitemaps <= 4.0.9 - Authenticated Cross-Site Scripting (XSS)

According to the changelog: 4.1.0 2018-12-18 - Fixed security issue related to escaping external URLs - Fixed security issue related to option tags in forms...

WP Payeezy Pay < 2.98 - Local File Inclusion

The WP Payeezy Pay WordPress plugin was affected by a Local File Inclusion security vulnerability...

LoginPress <= 1.1.15 - Authenticated Blind SQL Injection

Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...

Contact Form 7 <= 5.0.3 - register_post_type() Privilege Escalation

According to the official release: "A privilege escalation vulnerability has been found in Contact Form 7 5.0.3 and older versions. Utilizing this vulnerability, a logged-in user in the Contributor role can potentially edit contact forms, which only Administrator and Editor-role users are allowed...

JS Support Ticket < 2.0.6 - CSRF

The JS Help Desk – Best Help Desk & Support Plugin WordPress plugin was affected by a CSRF security vulnerability...

JS Job <= 1.0.6 - CSRF

The JS Job Manager WordPress plugin was affected by a CSRF security vulnerability...

WordPress File Upload <= 4.3.3 - Cross-Site Scripting (XSS)

The WordPress File Upload WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

PropertyHive <= 1.4.14 - Cross-Site Scripting (XSS)

The PropertyHive WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

GD Rating System 2.3 - Multiple Vulnerabilities

The GD Rating System WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

Smart Google Code Inserter <= 3.4 - Unauthenticated Cross-Site Scripting (XSS)

The Smart Google Code Inserter WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability...

UserPro <= 4.9.17 - Authentication Bypass

The userpro plugin has the ability to bypass login authentication for the user 'admin'. If the site does not use the standard username 'admin' it is not affected. PoC 1 - Google Dork inurl:/plugins/userpro 2 - Browse to a site that has the userpro plugin installed. 3 - Append ?upautolog=true to t...

PopCash.Net Code Integration Tool <= 1.0 - Cross-Site Scripting (XSS)

The PopCash Code Integration Tool WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Content Audit <= 1.9.1 - Cross-Site Scripting (XSS) & CSRF

The Content Audit WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...

WordPress 4.4-4.8.1 - Path Traversal in Customizer

Description A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team...

Download Manager <= 2.9.50 - Open Redirect

The WordPress Download Manager WordPress plugin was affected by an Open Redirect security vulnerability...

Shortcodes Ultimate <= 4.9.9 - Authenticated Directory Traversal

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin was affected by an Authenticated Directory Traversal security vulnerability...

Invite Anyone <= 1.3.14 - Change of Email Invitation Content

The Invite Anyone WordPress plugin was affected by a Change of Email Invitation Content security vulnerability...

Membership Simplified <= 1.58 - Unauthenticated Arbitrary File Download

The plugin is still affected and has been closed...

Dtracker <= 1.5 - Unauthorised Contract Creation

Plugin is still affected and has been closed...

Wp2android 1.1.4 - Unauthenticated File Upload

Plugin is still affected and has been closed...

Kama Click Counter <= 3.4.9 - Authenticated Blind SQL Injection

The Kama Click Counter WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=kama-clic-counterby=linkname=ASC%2cselectfromselectsleep30a=1...

Podlove Podcast Publisher <= 2.3.15 - Multiple SQLi & XSS

The Podlove Podcast Publisher WordPress plugin was affected by a Multiple SQLi & XSS security vulnerability...

Nelio AB Testing <= 4.5.8 - Server Side Request Forgery (SSRF)

The Nelio AB Testing WordPress plugin was affected by a Server Side Request Forgery SSRF security vulnerability...

Photoxhibit <= 2.1.8 - Reflected XSS Issues

Plugin is still affected and has been closed...

Neosense Theme < 1.8 - Unrestricted File Upload

Neosense is a commercial WordPress theme by dynamicpress. Version 1.7 and possibly earlier includes in its theme directory a copy of the "qquploader" ajax file uploader, which does not verify user authorization. Using this uploader, an attacker can upload any file to the site. The uploaded file i...

Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting (XSS)

The changelog reads: "Fixes a stored XSS issue in the Yoast SEO metabox. Thanks Hammad Shamsi for reporting and responsibly disclosing this issue."...

WP Database Backup < 4.3.1 - CSRF & XSS

The WP Database Backup WordPress plugin was affected by a CSRF & XSS security vulnerability...

ColorWay < 3.4.2 - Cross-Site Scripting (XSS)

The ColorWay WordPress theme was affected by a Cross-Site Scripting XSS security vulnerability...

Total Security < 3.4.1 - XSS & Settings Change

The Total Security WordPress plugin was affected by a XSS & Settings Change security vulnerability...

Profile Builder < 2.4.2 - Reflected Cross-Site Scripting (XSS)

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

Activity Log <= 2.3.1 - Stored Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

PeepSo <= 1.6.0 - Authenticated Privilege Escalation

Unfiltered input allows a logged in user to escalate their permissions to that of an Administrator...

Fluid Responsive Slideshow < 2.2.7 - CSRF & XSS

The Fluid Responsive Slideshow WordPress plugin was affected by a CSRF & XSS security vulnerability...

WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The WPSOLR - Elasticsearch and Solr search WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC...

neuvoo-jobroll <= 2.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The neuvoo-jobroll WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

Pie-Register <= 2.0.18 - Authenticated Blind SQL Injection

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Pie-Register <= 2.0.18 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

CP Reservation Calendar <= 1.1.6 - Unauthenticated SQL Injection

The CP Reservation Calendar WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

Postmatic <= 1.4.5 - Cross-Site Scripting (XSS)

The Replyable – Subscribe to Comments and Reply by Email WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WP Limit Login Attempts <= 2.0.0 - Unauthenticated SQL Injection

The WP Limit Login Attempts WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

NextGen Gallery < 2.1.15 - Path Traversal

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a Path Traversal security vulnerability...

Anti-Spam by CleanTalk < 5.22 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

WP Ultimate Csv Importer < 3.8.1 - XSS

The Import and Export WordPress Data as CSV or XML WordPress plugin was affected by a XSS security vulnerability...

Dynamic Widgets <= 1.5.10 - Authenticated Cross-Site Scripting (XSS) & CSRF

The Dynamic Widgets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS & CSRF security vulnerability...