BackWPup <= 3.4.1 - Backup File Download

The BackWPup – WordPress Backup Plugin WordPress plugin was affected by a Backup File Download security vulnerability...

WP Live Chat Support < 7.1.05 - Cross-Site Scripting (XSS)

WP Live Chat Support is vulnerable by sending XSS payloads through chat. PoC...

EELV Newsletter < 4.6.1 - CSRF & XSS

The EELV Newsletter WordPress plugin was affected by a CSRF & XSS security vulnerability...

WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF

...

Simple Job Board <= 2.4.3 - Reflected XSS

The Simple Job Board WordPress plugin was affected by a Reflected XSS security vulnerability...

Twitter Cards Meta <= 2.4.5 - CSRF and XSS

The Twitter Cards Meta – Best Twitter Card Plugin for WordPress WordPress plugin was affected by a CSRF and XSS security vulnerability...

Invite Anyone < 1.3.16 - Multiple Issues

The Invite Anyone WordPress plugin was affected by a Multiple Issues security vulnerability...

WP Markdown Editor 2.3.0 - Authenticated "Self" Cross-Site Scripting (XSS)

An Author user could be exploited by use of "self" XSS. This usually requires social engineering and user interaction...

WordPress 4.0-4.7.2 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds

Description This can be exploited by unauthenticated users in versions 4.7 and 4.7.1 by leveraging this vulnerability https://wpvulndb.com/vulnerabilities/8734...

mobile-friendly-app-builder-by-easytouch 3.0 - Unauthenticated File Upload

Plugin is still affected and has been closed...

Relevanssi Premium <= 1.14.4 - SQL Injection & PHP Object Injection

The relevanssi-premium WordPress plugin was affected by a SQL Injection & PHP Object Injection security vulnerability...

WassUp Real Time Analytics <= 1.9 - Cross Site Scripting

The WassUp Real Time Analytics WordPress plugin was affected by a Cross Site Scripting security vulnerability...

Activity Log <= 2.3.2 - Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Estatik < 2.3.1 - Arbitrary File Upload

The Estatik Real Estate Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure

...

Jetpack 2.0-4.0.2 - Shortcode Stored Cross-Site Scripting (XSS)

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Shortcode Stored Cross-Site Scripting XSS security vulnerability...

OptionTree <= 2.5.5 - Authenticated Cross-Site Scripting (XSS)

The OptionTree WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WP-Stats-Dashboard <= 2.9.4 - Authenticated Blind SQL Injection

The wp-stats-dashboard WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Payment Form for PayPal Pro <= 1.0.1 - Multiple Reflected Cross-Site Scripting (XSS)

The Payment Form for PayPal Pro WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS security vulnerability...

Unite Gallery Lite <= 1.4.6 - CSRF & Authenticated SQL Injection

The Unite Gallery Lite WordPress plugin was affected by a CSRF & Authenticated SQL Injection security vulnerability...

NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nspsearch.php’ several variables from the $GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger ...

ACF Frontend Display <= 2.0.6 - Arbitrary File Upload

The last time it was checked the plugin was still affected and had been closed...

WordPress Landing Pages <= 1.8.7 - Unspecified Cross-Site Scripting (XSS)

The WordPress Landing Pages WordPress plugin was affected by an Unspecified Cross-Site Scripting XSS security vulnerability...

RobotCPA Plugin V5 - Unauthenticated Local File Inclusion

The robotcpa WordPress plugin was affected by an Unauthenticated Local File Inclusion security vulnerability. PoC This issue has been seen exploited in the wild with the following payload: http://www.example.com/wp-content/plugins/robotcpa/f.php?l=..%2F..%2F..%2Fwp-config.php...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

Codestyling Localization <= 1.99.30 - Multiple CSRF

Plugin is still affected and has been closed...

Ad Inserter 1.5.2 - CSRF & XSS

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin was affected by a CSRF & XSS security vulnerability...

Exquisite Ultimate Newspaper Theme <= 1.3.3 - DOM Cross-Site Scripting (XSS)

The exquisite-wp WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/...

Jetpack 3.0-3.4.2 - Cross-Site Scripting (XSS)

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Import any XML or CSV File to WordPress <= 3.2.4 - Multiple Vulnerabilities

Multiple issues were fixed, such as Authenticated SQL Injection, Authenticated Reflected XSS and Unauthorised access to some methods...

Image Metadata Cruncher - Multiple Cross-Site Scripting (XSS)

The image-metadata-cruncher WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

Wordpress Video Gallery <= 2.7 - SQL Injection

The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability. PoC http://example.com/wp-admin/admin-ajax.php?action=rss=video=SQLi...

Pixabay Images <= 2.3 - Multiple Vulnerabilities (RCE, XSS, ...)

1 Authentication bypass The plugin does not correctly check if the user is logged in. Certain code can be called without authentication 2 Arbitrary file upload The plugin code does not validate the host in the provided download URL, which allows to upload malicious files, including PHP code. 3 Pa...

Banner Effect Header <= 1.2.7 - Cross-Site Scripting (XSS)

The Banner Effect Header WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Pie Register <= 2.0.13 - Privilege escalation

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a Privilege escalation security vulnerability...

Cforms & CformsII <= 14.7 - Remote Code Execution via Unauthorised File Upload

...

O2tweet <= 0.0.4 - Multiple CSRF

Plugin is still affected and has been closed...

Lightbox Photo Gallery 1.0 - CSRF/XSS

The lightbox-photo-gallery WordPress plugin was affected by a CSRF/XSS security vulnerability...

Ninja Forms <= 2.8.9 - Unspecified Issue Affecting Admin Users

This version includes a fix for a potential security vulnerability for admin users...

Google Analytics by Yoast <= 5.1.2 Cross-Site Scripting (XSS)

The value of the input field "manualuacodefield" Analytics Settings is saved without any validation. Malicious JavaScript code can be injected. Screenshots: http://imgur.com/4TA6sSe,DFUlAy51 http://imgur.com/4TA6sSe,DFUlAy50...

Google Document Embedder <= 2.5.14 - SQL Injection

The Google Doc Embedder WordPress plugin was affected by a SQL Injection security vulnerability...

WP Google Maps 6.0.26 - Cross Site Scripting (XSS)

The WP Google Maps WordPress plugin was affected by a Cross Site Scripting XSS security vulnerability...

BulletProof Security <= .50.8 - Script Insertion

The BulletProof Security WordPress plugin was affected by a Script Insertion security vulnerability...

DZS Video Gallery Plugin - RCE & More

The dzs-videogallery WordPress plugin was affected by a RCE & More security vulnerability...

All In One WP Security plugin 3.8.2 - 2xSQL Injections

The All In One WP Security & Firewall WordPress plugin was affected by a 2xSQL Injections security vulnerability...

Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an IPTraf.php URI Request Stored XSS security vulnerability...

Disqus <= 2.75 - Cross-Site Scripting (XSS) & CSRF

The Disqus Comment System WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...

Pinboard 1.0.6 - includes/theme-options.php tab Parameter XSS

The Pinboard WordPress theme was affected by an includes/theme-options.php tab Parameter XSS security vulnerability...

scarlet <= 1.1.3 - XSS in ZeroClipboard.swf

The scarlet WordPress theme was affected by a XSS in ZeroClipboard.swf security vulnerability...

JW Player 2.1.2 - wp-admin/admin.php Player Deletion CSRF

The jw-player-plugin-for-wordpress WordPress plugin was affected by a wp-admin/admin.php Player Deletion CSRF security vulnerability...