W3 Total Cache < 0.9.7.3 - Cryptographic Signature Bypass

The return value of opensslverify is not properly validated, which allows to bypass the cryptographic check...

Booking < 8.4.5.15 - SQL Injection

The Booking Calendar WordPress plugin was affected by a SQL Injection security vulnerability...

Google XML Sitemaps <= 4.0.9 - Authenticated Cross-Site Scripting (XSS)

According to the changelog: 4.1.0 2018-12-18 - Fixed security issue related to escaping external URLs - Fixed security issue related to option tags in forms...

WP Payeezy Pay < 2.98 - Local File Inclusion

The WP Payeezy Pay WordPress plugin was affected by a Local File Inclusion security vulnerability...

LoginPress <= 1.1.13 - Unauthorized Blind SQL Injection

The Custom Login Page Customizer | LoginPress WordPress plugin was affected by an Unauthorized Blind SQL Injection security vulnerability...

Slideshow Gallery <= 1.6.8 - XSS and SQLi

The Slideshow Gallery WordPress plugin was affected by a XSS and SQLi security vulnerability...

WP GDPR Compliance <= 1.4.2 - Unauthenticated Call Any Action or Update Any Option

The plugin WP GDPR Compliance allows unauthenticated users to execute any action and to update any database value. If the request data form is available for unauthenticated users, even unauthenticated users are able to do this. See references for discussion of the issue. The problem is in the fil...

Media File Manager <= 1.4.2 - Authenticated Multiple Vulnerabilities

Following the PoC you can combine the vulnerabilities to obtain PHP code execution and read sensitive file. By default the File Manager can only be used by Administrator users, however, any user role can be configured to use it. PoC Diretory Trasversal: POST /wordpress/wp-admin/admin-ajax.php...

wpForo < 1.5.2 - Privilege Escalation

The wpForo Forum WordPress plugin was affected by a Privilege Escalation security vulnerability...

Open Graph for Facebook, Google+ and Twitter Card Tags <= 2.2.4 - Authenticated Reflected XSS

There is a reflected XSS vulnerability caused by "Open Graph for Facebook, Google+ and Twitter Card Tags" in the wdfbogerror parameter on a GET request when editing a post. This can be exploited by tricking an authenticated Wordpress administrator into clicking a malicious link. This vulnerabilit...

JS Job <= 1.0.6 - CSRF

The JS Job Manager WordPress plugin was affected by a CSRF security vulnerability...

WordPress 3.7-4.9.4 - Escape Version in Generator Tag

Description Make sure the version string is correctly escaped for use in generator tags...

NextGEN Gallery <= 2.2.46 - Galley Paths Not Secured

The changelog states: "Secured: Gallery paths and the ability to manage tags Kudos: ElevenPaths Telefonica cibersecurity Unit"...

WP Retina 2x <= 5.2.0 - Cross-Site Scripting (XSS)

The WP Retina 2x WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

GD Rating System 2.3 - Multiple Vulnerabilities

The GD Rating System WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

Contact Form for WordPress – Ultimate Form Builder Lite <= 1.3.6 - SQL Injection

The Contact Form for WordPress – Ultimate Form Builder Lite WordPress plugin was affected by a SQL Injection security vulnerability...

Qards - Stored Cross-Site Scripting (XSS)

Google Dork: inurl:"plugins/qards" Qards provides you easy option to drag and edit every part and element of your site in the front-end, you will never have to write any code to change the layout or to change any part of the site like the traditional WordPress way. PoC The vulnerable script...

Content Timeline <= 4.4.2 - Multiple Blind SQL Injection

Multiple Blind SQL injections in the premium 'Content Timeline' Plugin. One unauthenticated and two authenticated injections. Contacted the author twice without any response. History: 09-16-2017 Contacted the author 09-16-2017 Requested CVE-ID 09-18-2017 CVE-ID Received 09-18-2017 Contacted the...

WP Live Chat Support < 7.1.05 - Cross-Site Scripting (XSS)

WP Live Chat Support is vulnerable by sending XSS payloads through chat. PoC...

FormCraft - Premium WordPress Form Builder <= v3.2.31 - Authenticated Stored XSS

WordPress FormCraft Premium WordPress Form Builder versions 3.2.31 and below suffer from a persistent Cross-Site Scripting XSS vulnerability. PoC Authenticated Stored XSS: New Form Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed...

Simple Job Board <= 2.4.3 - Reflected XSS

The Simple Job Board WordPress plugin was affected by a Reflected XSS security vulnerability...

Twitter Cards Meta <= 2.4.5 - CSRF and XSS

The Twitter Cards Meta – Best Twitter Card Plugin for WordPress WordPress plugin was affected by a CSRF and XSS security vulnerability...

WP Markdown Editor 2.3.0 - Authenticated "Self" Cross-Site Scripting (XSS)

An Author user could be exploited by use of "self" XSS. This usually requires social engineering and user interaction...

mobile-friendly-app-builder-by-easytouch 3.0 - Unauthenticated File Upload

Plugin is still affected and has been closed...

WordPress 4.7.0-4.7.2 - Authenticated Unintended File Deletion in Plugin Delete

...

WassUp Real Time Analytics <= 1.9 - Cross Site Scripting

The WassUp Real Time Analytics WordPress plugin was affected by a Cross Site Scripting security vulnerability...

Activity Log <= 2.3.2 - Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting (XSS)

The changelog reads: "Fixes a stored XSS issue in the Yoast SEO metabox. Thanks Hammad Shamsi for reporting and responsibly disclosing this issue."...

Profile Builder < 2.4.2 - Reflected Cross-Site Scripting (XSS)

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

WP Live Chat Support < 6.2.02 - Stored Cross-Site Scripting

The 3CX Live Chat WordPress plugin was affected by a Stored Cross-Site Scripting security vulnerability...

Gnucommerce < 0.5.7-beta - XSS

The GNUCommerce WordPress plugin was affected by a XSS security vulnerability...

Tweet Wheel <= 1.0.3.2 - Reflected Cross-Site Scripting (XSS)

The Tweet Wheel WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

Pondol Form to Mail <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The pondol-formmail WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

NextGen Gallery < 2.1.15 - Path Traversal

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a Path Traversal security vulnerability...

Tag Miner <= 1.1.2 - Cross-Site Request Forgery (CSRF) & XSS

The Tag Miner Automatic Tag Extraction WordPress plugin was affected by a Cross-Site Request Forgery CSRF & XSS security vulnerability...

Unite Gallery Lite <= 1.4.6 - CSRF & Authenticated SQL Injection

The Unite Gallery Lite WordPress plugin was affected by a CSRF & Authenticated SQL Injection security vulnerability...

Paid Memberships Pro 1.8.4.2 - Cross-Site Scripting (XSS)

The Paid Memberships Pro WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nspsearch.php’ several variables from the $GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger ...

RobotCPA Plugin V5 - Unauthenticated Local File Inclusion

The robotcpa WordPress plugin was affected by an Unauthenticated Local File Inclusion security vulnerability. PoC This issue has been seen exploited in the wild with the following payload: http://www.example.com/wp-content/plugins/robotcpa/f.php?l=..%2F..%2F..%2Fwp-config.php...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

WP Membership <= 1.2.3 - Multiple Vulnerabilities

The wp-membership WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

Encrypted Contact Form <= 1.0.4 - CSRF & XSS

The Encrypted Contact Form WordPress plugin was affected by a CSRF & XSS security vulnerability...

All In One WP Security And Firewall < 3.9.5 - XSS

The All In One WP Security & Firewall WordPress plugin was affected by a XSS security vulnerability...

Jetpack 3.0-3.4.2 - Cross-Site Scripting (XSS)

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Image Metadata Cruncher - Multiple Cross-Site Scripting (XSS)

The image-metadata-cruncher WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

Holding Pattern Theme <= 0.6 - Arbitrary File Upload

An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation. Disclosure timeline: 2015-01-14 Vendor Alerted via email. 2015-01-14 Fix Requested via email. 2015-01-14...

Banner Effect Header <= 1.2.7 - Cross-Site Scripting (XSS)

The Banner Effect Header WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

CM Download Manager < 2.0.7 - CSRF to Cross-Site Scripting

The lack of CSRF check and sanitisation could allow attackers to perform CSRF attacks against logged in administrators, and set a Cross-Site Scripting payload via addonstitle parameter in the CMDMadminsettings page...

Cforms & CformsII <= 14.7 - Remote Code Execution via Unauthorised File Upload

...

W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)

The plugin does not validate the 'wpnonce' anti-CSRF token. This issue can be used to perform many actions. The most significant action with the biggest impact is the ability to redirect users to malicious websites. Functionality exists where specific user agent strings can be configured to be...