14653 matches found
WooCommerce <= 2.6.8 - Authenticated Tax-Rate CSV XSS
The WooCommerce WordPress plugin was affected by an Authenticated Tax-Rate CSV XSS security vulnerability...
WassUp Real Time Analytics <= 1.9 - Cross Site Scripting
The WassUp Real Time Analytics WordPress plugin was affected by a Cross Site Scripting security vulnerability...
Photoxhibit <= 2.1.8 - Reflected XSS Issues
Plugin is still affected and has been closed...
Zotpress < 6.1.3 - SQL Injection
The Zotpress WordPress plugin was affected by a SQL Injection security vulnerability...
Total Security < 3.4.1 - XSS & Settings Change
The Total Security WordPress plugin was affected by a XSS & Settings Change security vulnerability...
Dwnldr 1.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
User agent strings are logged when requesting downloads that are processed by dwnldr and displayed back to the admin with no encoding, allowing for scripts to be stored and executed. PoC curl -A "User-Agent: " -O http:///?attachmentid=...
Profile Builder < 2.4.2 - Reflected Cross-Site Scripting (XSS)
The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Search Everything < 8.1.6 - SQL Injection
The Search Everything WordPress plugin was affected by a SQL Injection security vulnerability...
enhanced-tooltipglossary <= 3.3.4 - XSS
The CM Tooltip Glossary WordPress plugin was affected by a XSS security vulnerability...
WordPress 4.2-4.5.1 - MediaElement.js Reflected Cross-Site Scripting (XSS)
...
WP Customer Reviews < 3.0.9 - CSRF & XSS
The WP Customer Reviews WordPress plugin was affected by a CSRF & XSS security vulnerability...
wp-championship <= 5.8 - Authenticated Blind SQL Injection
The wp-championship WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC $ sqlmap -u 'http://www.example.com/wp-admin/wp-championship/csadminusers.php=' --data="isadmin=1" --cookie=AUTHCOOKIEHERE --level=5 --risk=3...
Limit Attempts < 1.1.1 - SQL Injection
The Limit Attempts by BestWebSoft WordPress plugin was affected by a SQL Injection security vulnerability...
Easy2Map <= 1.2.9 - Reflected Cross-Site Scripting (XSS)
The Easy2Map WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
Postmatic <= 1.4.5 - Cross-Site Scripting (XSS)
The Replyable – Subscribe to Comments and Reply by Email WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WP Limit Login Attempts <= 2.0.0 - Unauthenticated SQL Injection
The WP Limit Login Attempts WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...
Easy Media Gallery <= 1.3.47 - Cross Site Scripting (XSS)
The Gallery – Photo Albums Plugin WordPress plugin was affected by a Cross Site Scripting XSS security vulnerability...
NextGen Gallery < 2.1.15 - Path Traversal
The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a Path Traversal security vulnerability...
Alpine PhotoTile for Instagram <= 1.2.7.5 - Authenticated Cross-Site Scripting (XSS)
The alpine-photo-tile-for-instagram WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
WP Symposium <= 15.5.1 - Unauthenticated SQL Injection
Wordpress plugin wp-symposium version 15.5.1 and probably all existing previous versions suffers from an unauthenticated SQL Injection in getalbumitem.php, parameter 'size'. The issue is exploitable even if the plugin is deactivated. PoC PoC URL :...
WordPress <= 4.2.3 - Widgets Title Cross-Site Scripting (XSS)
...
Job Manager <= 0.7.22 - Unauthenticated Stored Cross-Site Scripting (XSS)
The Job Manager WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability. PoC Go to the job listings page /index.php/jobs/apply/, then click on "send through your résumé", add the payload '" to the email field. The JavaScript will be executed on t...
Paid Memberships Pro 1.8.4.2 - Cross-Site Scripting (XSS)
The Paid Memberships Pro WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
CP Contact Form with Paypal <= 1.1.5 - Multiple Vulnerabilities
The CP Contact Form with PayPal WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...
Awesome Filterable Portfolio <= 1.8.6 - Authenticated Blind SQL Injection
The Awesome Filterable Portfolio WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
StageShow <= 5.0.8 - Open Redirect
The StageShow WordPress plugin was affected by an Open Redirect security vulnerability. PoC http://www.example.com/wp-content/plugins/stageshow/stageshowredirect.php?url=http%3A%2F%2F2buntu.com...
WordPress Landing Pages <= 1.8.7 - Unspecified Cross-Site Scripting (XSS)
The WordPress Landing Pages WordPress plugin was affected by an Unspecified Cross-Site Scripting XSS security vulnerability...
Codestyling Localization <= 1.99.30 - Multiple CSRF
Plugin is still affected and has been closed...
WP Smiley <= 1.4.1 - CSRF & Cross-Site Scripting (XSS)
Cross-Site scripting XSS in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php...
Ad Inserter 1.5.2 - CSRF & XSS
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin was affected by a CSRF & XSS security vulnerability...
Exquisite Ultimate Newspaper Theme <= 1.3.3 - DOM Cross-Site Scripting (XSS)
The exquisite-wp WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/...
Jetpack 3.0-3.4.2 - Cross-Site Scripting (XSS)
The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
VideoWhisper Video Conference Integration 4.91.8 - Remote File Upload
Vendor marked as won't fix. See references...
Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection
Title: Gravity Forms 1.8 = 1.9.3.5 - Blind SQL Injection CVE-2015-2260 Version/s Tested: 1.9.3.1 Description: Gravity Forms is one of the most popular WordPress plugins gravityforms used to create forms for WordPress sites. The latest version at the time of writing 1.9.3.5 contains an authenticat...
Huge IT Slider <= 2.6.8 - SQL Injection
The slider-image WordPress plugin was affected by a SQL Injection security vulnerability...
CM Download Manager < 2.0.7 - CSRF to Cross-Site Scripting
The lack of CSRF check and sanitisation could allow attackers to perform CSRF attacks against logged in administrators, and set a Cross-Site Scripting payload via addonstitle parameter in the CMDMadminsettings page...
O2tweet <= 0.0.4 - Multiple CSRF
Plugin is still affected and has been closed...
Google Analytics by Yoast <= 5.1.2 Cross-Site Scripting (XSS)
The value of the input field "manualuacodefield" Analytics Settings is saved without any validation. Malicious JavaScript code can be injected. Screenshots: http://imgur.com/4TA6sSe,DFUlAy51 http://imgur.com/4TA6sSe,DFUlAy50...
MaxButtons 1.26.0 - Cross Site Scripting (XSS)
The WordPress Button Plugin MaxButtons WordPress plugin was affected by a Cross Site Scripting XSS security vulnerability...
Login Widget With Shortcode 3.1.1 - CSRF/XSS
The Login Widget With Shortcode WordPress plugin was affected by a CSRF/XSS security vulnerability...
W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated Arbitrary File Read
The W3 Total Cache WordPress plugin was affected by an Unauthenticated Arbitrary File Read security vulnerability...
WordPress 3.4.2 - 3.9.2 Does Not Invalidate Sessions Upon Logout
...
WordPress 3.9 & 3.9.1 Unlikely Code Execution
...
Twitget 3.3.1 - twitget.php Twitter Setting Manipulation CSRF
The Twitget WordPress plugin was affected by a twitget.php Twitter Setting Manipulation CSRF security vulnerability...
JS MultiHotel 2.2.1 - includes/delete_img.php path Parameter Reflected XSS
The js-multihotel WordPress plugin was affected by an includes/deleteimg.php path Parameter Reflected XSS security vulnerability...
AskApache Firefox Adsense 3.0 - Unspecified CSRF
The askapache-firefox-adsense WordPress plugin was affected by an Unspecified CSRF security vulnerability...
Polldaddy Polls & Rating 2.0.24 - polldaddy-org.php unique_id Ratings Shortcode XSS
The Crowdsignal Polls & Ratings WordPress plugin was affected by a polldaddy-org.php uniqueid Ratings Shortcode XSS security vulnerability...
WP Clone by WP Academy <= 2.1.1 - XSS in ZeroClipboard
The Clone WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Cardoza WordPress Poll <= 34.05 - Multiple External Function Remote Poll Manipulation
The WordPress Poll WordPress plugin was affected by a Multiple External Function Remote Poll Manipulation security vulnerability...