WP Smiley <= 1.4.1 - CSRF & Cross-Site Scripting (XSS)

Cross-Site scripting XSS in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php...

CP Polls < 1.0.5 - XSS

The Polls CP WordPress plugin was affected by a XSS security vulnerability...

Quota < 1.2.5 - Unspecified XSS

The quota WordPress theme was affected by an Unspecified XSS security vulnerability...

VideoWhisper Video Conference Integration 4.91.8 - Remote File Upload

Vendor marked as won't fix. See references...

Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection

Title: Gravity Forms 1.8 = 1.9.3.5 - Blind SQL Injection CVE-2015-2260 Version/s Tested: 1.9.3.1 Description: Gravity Forms is one of the most popular WordPress plugins gravityforms used to create forms for WordPress sites. The latest version at the time of writing 1.9.3.5 contains an authenticat...

Feed Them Social < 1.7.0 - XSS & Arbitrary Shortcode Execution

The Feed Them Social – for Twitter feed, Youtube, Pinterest and more WordPress plugin was affected by a XSS & Arbitrary Shortcode Execution security vulnerability...

CM Download Manager < 2.0.7 - CSRF to Cross-Site Scripting

The lack of CSRF check and sanitisation could allow attackers to perform CSRF attacks against logged in administrators, and set a Cross-Site Scripting payload via addonstitle parameter in the CMDMadminsettings page...

Banner Effect Header 1.2.6 - XSS & CSRF

The Banner Effect Header WordPress plugin was affected by a XSS & CSRF security vulnerability...

CP Polls < 1.0.1 - XSS

The Polls CP WordPress plugin was affected by a XSS security vulnerability...

Another WordPress Classifieds Plugin < 3.0 - SQLi & XSS

The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds WordPress plugin was affected by a SQLi & XSS security vulnerability...

Google Calendar Events < 2.0.4 - XSS

The Simple Calendar – Google Calendar Plugin WordPress plugin was affected by a XSS security vulnerability...

Enfold < 3.0.1 - Unspecified Issue

The enfold WordPress theme was affected by an Unspecified Issue security vulnerability...

Contus Video Gallery 2.3.1.0.1 - SQL Injection

The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability...

W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read

The W3 Total Cache WordPress plugin was affected by an Unauthenticated Arbitrary File Read security vulnerability...

WordPress 3.0 - 3.9.1 Authenticated Cross-Site Scripting (XSS) in Multisite

...

Twitget 3.3.1 - twitget.php Twitter Setting Manipulation CSRF

The Twitget WordPress plugin was affected by a twitget.php Twitter Setting Manipulation CSRF security vulnerability...

LayerSlider 4.6.1 - Style Editing CSRF

The LayerSlider WordPress plugin was affected by a Style Editing CSRF security vulnerability...

ShareThis 7.0.3 - Setting Manipulation CSRF

The share-this WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...

platinum_seo_pack.php - s Parameter Reflected XSS

The Platinum SEO WordPress plugin was affected by a s Parameter Reflected XSS security vulnerability...

ed2k-link-selector <= 1.1.7 - XSS in ZeroClipboard

The ed2k-link-selector WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

q2w3-inc-manager <= 2.3.1 - XSS in ZeroClipboard

The Code Insert Manager Q2W3 Inc Manager WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

WP Clone by WP Academy <= 2.1.1 - XSS in ZeroClipboard

The Clone WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

Zopim Live Chat <= 1.2.5 - XSS in ZeroClipboard

The Zendesk Chat WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

Marekkis Watermark 0.9.2 - wp-admin/options-general.php pfad Parameter XSS

The Marekkis Watermark-Plugin WordPress plugin was affected by a wp-admin/options-general.php pfad Parameter XSS security vulnerability...

WP-PostViews 1.62 - Setting Manipulation CSRF

The WP-PostViews WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...

WP Super Cache 1.3 - trunk/plugins/awaitingmoderation.php URI XSS

The WP Super Cache WordPress plugin was affected by a trunk/plugins/awaitingmoderation.php URI XSS security vulnerability...

Pretty Link Lite <= 1.6.2 - XSS in SWF

The Pretty Links – Link Management, Branding, Tracking & Sharing Plugin WordPress plugin was affected by a XSS in SWF security vulnerability...

TinyMCE Color Picker 1.1 - tinymce-colorpicker.php Color Saving CSRF

The TinyMCE Color Picker WordPress plugin was affected by a tinymce-colorpicker.php Color Saving CSRF security vulnerability...

Zingiri Web Shop < 2.4.0 - Multiple Unspecified Issues

The zingiri-web-shop WordPress plugin was affected by a Multiple Unspecified Issues security vulnerability...

WP < 6.8.3 - Author+ DOM Stored XSS

Description WordPress does not escape some data when writting in into the DOM of a page, which could allow users with a role of Author and perform to perform Stored XSS attacks...

Shariff Wrapper < 4.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius',...

WP Docs < 2.1.4 - Reflected Cross-Site Scripting

Description The WP Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Simple Sitemap < 3.5.14 - Cross-Site Request Forgery via admin_notices

Description The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'adminnotices' hook found in class-settings.php. This makes ...

Rife Free < 2.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Rife Free theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve...

BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness

Description The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

PowerPack Pro for Elementor < 2.10.18 - Authenticated (Contributor+) Privilege Escalation

Description The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for...

WP Flow Plus < 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WP Flow Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Pagerank Tools <= 1.1.5 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC https://example.com/wp-admin/tools.php?page=pagepageranks="...

Frontend Checklist <= 2.3.2 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to frontend-checklist admin...

Themesflat Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags

Description The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

LearnPress – WordPress LMS Plugin < 4.2.6.8.1 - Basic Information Disclosure via JSON API

Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of getitemspermissionscheck function. This makes it possible for unauthenticated attackers to extrac...

tagDiv Composer < 4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode

Description The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button shortcode in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

SEOPress < 7.8 - Contributor+ Open Redirect

Description The plugin does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post PoC As a contributor, create a new Post, at the bottom of the page put the following payload in the...

Testimonial Carousel For Elementor < 10.2.1 - Missing Authorization to Limited Setting Update

Description The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savetestimonialsoptioncallback' function in versions up to, and including, 10.2.0. This makes it possible for unauthenticated...

Spectra – WordPress Gutenberg Blocks < 2.12.9 - Contributor+ Stored XSS via Testimonial Block

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial and Image Gallery blocks due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and...

WP Photo Album Plus < 8.7.00.004 - Unauthenticated Arbitrary Shortcode Execution

Description The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to the plugin allowing unauthenticated users to execute an action that does not properly validate a value before running doshortcod...

ShopLentor < 2.8.8 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user...

WP Job Manager < 2.3.0 - Unauthenticated Information Exposure

Description The WP Job Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data...

Testimonial Carousel For Elementor < 10.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'showlinetext ' and 'slidebuttonhoveranimation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes i...

Better Elementor Addons < 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above...