14653 matches found
All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSS
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Content Carousel” widget accepts “customheadertag” and...
Podcast Importer SecondLine < 1.1.5 - Server-Side Request Forgery (SSRF)
The plugin was vulnerable to Server-side request forgery SSRF...
Video Downloader for TikTok < 1.4 - Server Side Request Forgery (SSRF) & Local File Inclusion (LFI)
The plugin is vulnerable to SSRF or LFI attacks via the njt-tk-download-video parameter sent by the user not being properly sanitized before used in code...
CM Download Manager < 2.8.0 - Authenticated Arbitrary File Deletion
The plugin may allow authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action...
WP Login Security and History <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well PoC -- Payloads: $ " $ " -- PoC 1 |...
Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)
The plugin did not escape user input when blocking requests such as matching a spam word, outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. PoC From an IP not in the Allow List...
Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR
The plugin, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the propertyid parameter. PoC GET...
WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)
During a quick security auditing of the plugin, in the default configuration a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
Photo Gallery by 10web < 1.5.69 - Reflected Cross-Site Scripting (XSS)
The plugin did not properly sanitise the bwgsearchX GET parameter, available in a frontend gallery when the Show Search Box setting is enabled disabled by default, leading to a reflected Cross-Site Scripting issue PoC Append the below payload in a page with an embedded gallery and the Show Search...
Digital Publications by Supsystic <= 1.6.11 - Authenticated Stored Cross-Site Scripting (XSS)
When creating or editing a publication, all values such as Area Width, Publication Width are vulnerable to stored XSS. It is possible to store code in all input fields as the code does not sanitize any user input. v1.6.11 attempted to fix the issue by using sanitizetextfield, however the output i...
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the 'Singular Label' field parameter. It is recommended that the Pods WordPress plugin be updated to at least version 2.7.27, which fixes the vulnerability...
iThemes Security < 7.7.0 - New-Password Requirements Not Enforced Until second Login
The plugin did not enforce new-password requirements for existing accounts until the second login occurred, which could leave an account configured with a potentially weak password until the user changes it...
Import and export users and customers < 1.16.3.6 - CSV Injection
The plugin did not validate or sanitise user data, such as first and last names from the profile, leading to a CSV injection when the data is exported by an administrator...
Welcart e-Commerce < 1.9.36 - Authenticated PHP Object Injection
The plugin unserialises via uscesunserialize the content of the uscescookie cookie, which could lead to a PHP Object Injection issue...
WooCommerce Subscriptions < 2.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)
An unauthenticated user could put XSS payload in their billing details when subscribing, which will then be executed in the admin dashboard when moused over...
Payment Form For Paypal Pro < 1.1.65 - Unauthenticated SQL Injection
The 'query' parameter allowed for any unauthenticated user to perform SQL queries with result output to a web page in JSON format. PoC https://example.com/?cffaction=getdatafromdatabase=SELECT%20%20from%20wpposts...
Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 - CSRF leading to XSS
A flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection. PoC...
Elementor Pro < 2.9.4 - Authenticated Arbitrary File Upload
According to Jerome Bruandet, from NintechNet, the vulnerability, currently exploited by attackers, allows any logged-in user to upload and execute PHP scripts on the blog. Chloe Chamberland from Wordfence also confirmed the issue and added that "This vulnerability is being used in conjunction wi...
Contact Form by WPForms < 1.5.9 - Authenticated Cross-Site Scripting (XSS)
The popular WordPress plugin, WPForms, was found to be vulnerable to Authenticated Cross-Site Scripting XSS. The Form Description and Field Description fields in the WPForms plugin’s Form Builder module was found to be vulnerable to stored XSS, as they did not sanitize user given input properly...
Easy Property Listings < 3.4 - Cross-Site Request Forgery (CSRF)
No details were provided...
ThemeREX Addons - Remote Code Execution
"This flaw allows attackers to remotely execute code on a site with the plugin installed, including the ability to execute code that can inject administrative user accounts." Note WPScanTeam: There are major version inconsistencies in the trxaddons shipped with the affected themes. As a result, a...
Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)
Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. PoC As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...
Ninja Forms < 3.4.23 - CSRF to Stored Cross-Site Scripting (XSS)
Authenticated Stored XSS vulnerabilities in recaptchasitekey, recaptchasecretkey, recaptchalang and dateformat keys, which can be performed via CSRF attacks...
GistPress < 3.0.2 - Authenticated Stored XSS
XSS vulnerability that could be exploited by untrusted contributors on multi-author sites...
Elementor < 2.7.5 - Authenticated Arbitrary File Upload
The Elementor plugin version 2.7.4 and below was found to be vulnerable to an arbitrary file upload. Due to the application not handling zip files with directories properly an attacker could upload php files which were executable, this allowed any user able to import templates WordPress role...
EasyBook < 1.2.2 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'EasyBook – Directory & Listing WordPress Theme', tested version — v1.2.1: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR December 27th, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January ??th, 2020 -...
CityBook < 2.3.4 - Multiple Vulnerabilities
Multiple vulnerabilities was discovered in the 'CityBook - Directory & Listing WordPress Theme', tested version — v2.3.3: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR Edit WPScanTeam: December 27h, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January...
Anti-Spam by CleanTalk < 5.127.4 - Cross-Site Scripting Issue
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin was affected by a Cross-Site Scripting Issue security vulnerability...
HandL UTM Grabber < 2.6.5 - Authenticated Option Change via CSRF
The HandL UTM Grabber / Tracker WordPress plugin was affected by an Authenticated Option Change via CSRF security vulnerability...
Bold Page Builder < 2.3.2 - Missing Access Controls
The vulnerability allows any unauthenticated user to perform actions that only an administrator should be allowed to do e.g., modifying settings and importing data...
Easy Property Listings < 3.4 - Cross-Site Scripting (XSS)
Changelog for 3.4 mentions: - MAJOR Security Update Release. Important to update to the latest version to protect your website. Easy Property Listings has been reviewed and approved by the WordPress plugin team. - This is a critical update to Easy Property Listings plugin that is focused on...
Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion
The adminInit function of the admin/includes/class.actions.snippets.php file, registered as an admininit hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog PoC...
Easy Forms for Mailchimp < 6.5.3 - Code Injection
The Easy Forms for Mailchimp WordPress plugin was affected by a Code Injection security vulnerability...
Easy Pdf Restaurant Menu Upload < 1.2 - XSS
The Easy PDF Restaurant Menu Upload WordPress plugin was affected by a XSS security vulnerability...
WP-Members <= 3.2.7 - Cross-Site Request Forgery (CSRF)
No CSRF Protection on Add new Fields. Can also Edit and Delete fields the same way. PoC 1.Download csrfwp-members.html 2.Change URL in html file.FORM ACTION. 3.Submit Request. Video POC : https://drive.google.com/file/d/1TuJK0NjxznjTDmoJF5wbGu2vMAXXikw/view?usp=sharing HTMLFILE :...
Zoho SalesIQ <= 1.0.8 - XSS & CSRF
The Zoho SalesIQ WordPress plugin was affected by a XSS & CSRF security vulnerability...
Slick Popup <= 1.7.1 - Privilege Escalation
Subscriber users are able to create an administrator account with hardcoded login credentials. PoC Hardcoded username "slickpopupteam" and its password is OmakPass13...
SAML SP Single Sign On <= 4.8.72 - Cross-Site Scripting (XSS)
The SAML Single Sign On – SSO Login WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Hostel Plugin <= 1.1.3 - Unauthenticated Stored XSS
This vulnerability allows any user can inject Javascript code and the code will be executed on the admin side when he visits the Bookings Page Authentication Required:No Affected Version: 1.1.3 or possibly below Fixed version:1.1.4...
WP Live Chat Support < 8.0.27 - Unauthenticated Stored XSS
The 3CX Live Chat WordPress plugin was affected by an Unauthenticated Stored XSS security vulnerability...
WP Live Chat Support Pro - File Upload Bypass
Note: The free and pro version have been merged in WP Live Chat Support 8.0.27...
Option Tree < 2.7.0 - PHP Object Injection
The OptionTree WordPress plugin was affected by a PHP Object Injection security vulnerability...
Booking < 8.4.5.15 - SQL Injection
The Booking Calendar WordPress plugin was affected by a SQL Injection security vulnerability...
Forminator <= 1.5.4 - Authenticated Multiple Vulnerabilities
The Forminator – Contact Form, Payment Form & Custom Form Builder WordPress plugin was affected by an Authenticated Multiple Vulnerabilities security vulnerability...
WordPress <= 5.0 - User Activation Screen Search Engine Indexing
Description According to WordPress: "Team Yoast discovered that the user activation screen could be indexed by search engines in some uncommon configurations, leading to exposure of email addresses, and in some rare cases, default generated passwords."...
JobCareer < 2.4.1 - User enumeration & Reset password
The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...
LoginPress <= 1.1.13 - Unauthorized Blind SQL Injection
The Custom Login Page Customizer | LoginPress WordPress plugin was affected by an Unauthorized Blind SQL Injection security vulnerability...
Contact Form 7 <= 5.0.3 - register_post_type() Privilege Escalation
According to the official release: "A privilege escalation vulnerability has been found in Contact Form 7 5.0.3 and older versions. Utilizing this vulnerability, a logged-in user in the Contributor role can potentially edit contact forms, which only Administrator and Editor-role users are allowed...