14608 matches found
All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSS
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method. The “Content Carousel” widget accepts “customheadertag” and...
Video Downloader for TikTok < 1.4 - Server Side Request Forgery (SSRF) & Local File Inclusion (LFI)
The plugin is vulnerable to SSRF or LFI attacks via the njt-tk-download-video parameter sent by the user not being properly sanitized before used in code...
Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update
The plugin suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status from pending to completed to example PoC Add a listing, don't complete payment status will be pending...
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
In the plugin, the image box widget includes/widgets/image-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript ...
wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion
The plugin has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through idkey and idval parameters. By exploiting this issue an attacker is...
VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue. PoC The PoC will be displayed once the issue has been remediated...
Ninja Forms < 3.4.34 - Administrator Open Redirect
The wpajaxnfoauthconnect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. PoC http://mysite.com/wp-admin/admin-ajax.php?clientid=1=https://google.com=nfoauthconnect...
All In One WP Security & Firewall < 4.4.6 - Authenticated Cross-Site Scripting (XSS)
The plugin did not escape the banned user agents in its settings before output, which may allow administrators to enter malicious UA with XSS payloads under certain conditions. Note: We were not able to reproduce the issue...
Digital Publications by Supsystic < 1.6.12 - Authenticated Path Traversal
The "Folder" tab under "Publications" is vulnerable to path traversal and exposes limited information, for example, the user can gain information regarding images stored in outside of the WordPress blog, ie, home directories. PoC Enter the following payload into the "Folder" input field of a...
Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection
The plugin did not sanitise the mecpostid POST parameter in the mecfesform AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue. If the Frontend Event Submission form is embed in a public page, then it could lead to any authenticated user, like subscribers to...
Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the 'Singular Label' field parameter. It is recommended that the Pods WordPress plugin be updated to at least version 2.7.27, which fixes the vulnerability...
Ultimate Category Excluder < 1.2 - Cross-Site Request Forgery
The plugin did not check for CSRF nonce in its options page, allowing attacker to perform CSRF attacks against logged in users...
Welcart e-Commerce < 1.9.36 - Authenticated PHP Object Injection
The plugin unserialises via uscesunserialize the content of the uscescookie cookie, which could lead to a PHP Object Injection issue...
Email Subscribers & Newsletters < 4.5.6 - Unauthenticated email forgery/spoofing
It allows a remote unauthenticated attacker to send forged emails to all recipients from the available lists of contacts or subscribers, with complete control over the content and subject of the email. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: example.com Content-Type:...
WP Floating Menu < 1.4.1 - Authenticated Reflected Cross-Site Scripting
The id GET parameter used by WP Floating menu does not correctly sanitise user input before reflecting the parameter back to the user, resulting in a reflected XSS vulnerability. Other sanitisation have been added to prevent other XSS issues as well as potential SQL injections. PoC...
ACF to REST API < 3.3.0 - Unauthenticated Arbitrary wp_options Disclosure
The plugin does not properly check for authorisation and allowed options to be retrieved from the wp-json/acf/v3/options/ endpoint. This could allow unauthenticated attacker to retrieve arbitrary values from the wpoptions table, such as a list of active plugins. PoC List all active plugins of the...
SportsPress < 2.7.2 - Authenticated Stored Cross-Site Scripting
Any user with the role of administrator or League Manager is able to store XSS payloads in the custom delimiter setting of events pages. This will then execute on all events pages on the website. PoC Video PoC: https://youtu.be/J8QZ8S6CiS8...
LearnPress < 3.2.6.7 - Privilege Escalation
Any authenticated user can change its role to an instructor/teacher and gain access to otherwise restricted data...
Import Export WordPress Users < 1.3.9 - Authenticated Arbitrary User Creation
"The flaw allowed anybody with subscriber-level access or above to import new users via a CSV file, including administrative-level users" providing subscriber-level users and above with the ability to escalate their privileges. PoC POST /wp-admin/admin-ajax.php?importpage=wordpresshfusercsv=3...
Pricing Table by Supsystic < 1.8.2 - Insecure Permissions on AJAX Actions
An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or...
Fruitful Theme < 3.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Fruitful WordPress theme, version 3.8 and possibly below, was affected by an unauthenticated Reflected Cross-Site Scripting XSS vulnerability. The vulnerability was patched in version 3.8.1 of the Theme, although the changelog file only mentions: "Bug fix: Fixed issues on comment form" PoC Ad...
Elementor Page Builder < 2.8.4 - Cross-Site Scripting (XSS)
Elementor Page Builder before 2.8.4 does not sanitise data when creating a new template, which could lead to Cross-Site Scripting issues...
InfiniteWP Client < 1.9.4.5 - Authentication Bypass
As per agreement between the researcher and developer, details will be released on January 14th. PoC It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwpmmbsetrequest which is located in the init.php file. This checks ...
Ultimate FAQ < 1.8.30 - Unauthenticated Reflected XSS
The HTML code generated by the FAQ shortcode does not sanitise the DisplayFAQ GET parameter, leading to an unauthenticated reflected Cross-Site Scripting issue on pages where such shortcode is used. PoC Append the following payload on a page where a FAQ is embedded: ?DisplayFAQ=...
301 Redirects - Easy Redirect Manager <= 2.40 - Authenticated Arbitrary Redirect Injection and Modification, XSS, and CSRF
The weaknesses allow for any authenticated user, even subscribers, to modify, delete, and inject redirect rules that could potentially result in a loss of site availability, in addition to XSS and CSRF. PoC...
ListingPro < 2.0.14.5 - Reflected & Persistent Cross-Site Scripting
Reflected & Persistent XSS was discovered in the 'ListingPro - WordPress Directory Theme'. Current version is 2.0.14.2 August 9th 2019. Edit WPScanTeam: November 29th, 2019 - Envato Informed November 29th, 2019 - Envato Investigating December 4th, 2019 - v2.0.14.3 Released, fixing the reflected X...
Motors Car Dealer & Classified Ads < 1.4.1 - Multiple Issues
- Unauthenticated plugin's settings import/export leading to stored XSS - Authenticated settings import - Unsanitised inputs - Authenticated options change...
Login Or Logout Menu Item <= 1.1.1 - Unauthenticated Options Change
The Login or Logout Menu Item WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...
WPS Child Themes Generator <= 1.1 - Path Traversal
The WPS Child Theme Generator WordPress plugin was affected by a Path Traversal security vulnerability...
WP Code Highlight.js < 0.6.3 - CSRF to Stored XSS
Lack of CSRF checks could allow attackers to make a logged in admin create XSS payloads. PoC...
Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin was affected by an Authenticated Remote Code Execution security vulnerability. PoC The nonce aicheck in the final request can be obtained by querying the homepage with the AIWPDEBUGGING cookie set to 2. Then, use an account with a role a...
Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)
It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. PoC POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac ...
CP Contact Form with Paypal <= 1.3.01 - Multiple XSS
The CP Contact Form with PayPal WordPress plugin was affected by a Multiple XSS security vulnerability. PoC Version =1 fixed in 1.2.98...
Easy Pdf Restaurant Menu Upload < 1.2 - XSS
The Easy PDF Restaurant Menu Upload WordPress plugin was affected by a XSS security vulnerability...
Easy Digital Downloads <= 2.9.15 - Stored XSS
Stored XSS Cross Site Scripting via the IP addresses in logs...
FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection
Changelog states: "Security - fix for SQL injection vulnerability in email subscription"...
WPGraphQL <= 0.2.3 - Multiple Vulnerabilities
Without authorisation, weak access controls allow us to: Create administrative users Post comments on articles bypassing article restrictions and global moderation Retrieve content of password-protected posts/articles/pages Retrieve full list of registered users in the platform Retrieve full list...
Contact Form Email <= 1.2.65 - Multiple Cross-Site Scripting (XSS) & CSRF
The Contact Form Email WordPress plugin was affected by a Multiple Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=cpcontactformtoemail=1=1='"...
WP Ultimate Exporter < 1.4.2 - CSRF
The Export WordPress Data with Advanced Filters WordPress plugin was affected by a CSRF security vulnerability...
Google XML Sitemaps <= 4.0.9 - Authenticated Cross-Site Scripting (XSS)
According to the changelog: 4.1.0 2018-12-18 - Fixed security issue related to escaping external URLs - Fixed security issue related to option tags in forms...
WordPress <= 5.0 - Authenticated Post Type Bypass
Description According to WordPress: "Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input."...
Arigato Autoresponder and Newsletter <= 2.5.1.8 - Authenticated Blind SQL Injection & Multiple XSS
The Arigato Autoresponder and Newsletter WordPress plugin was affected by an Authenticated Blind SQL Injection & Multiple XSS security vulnerability...
Multi Step Form <= 1.2.5 - Cross-Site Scripting (XSS)
The Multi Step Form WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WooCommerce <= 3.4.5 - Authenticated File Deletion to Privilege Escalation
Attackers in control of a user with the shop manager role can delete certain files on the server and then take over any victim account...
WooCommerce <= 3.4.4 - Potential Object Injection
According to WooCommerce: "Versions 3.4.4 and earlier are affected by an issue where a function that updates attributes could lead to object injection. This is related to the WordPress 4.8.3 security release. This issue can only be exploited by users who can edit attributes and should not be...
JS Job <= 1.0.6 - CSRF
The JS Job Manager WordPress plugin was affected by a CSRF security vulnerability...
Membermouse < 2.2.9 - Blind SQL Injection
Note: It seems like the affected plugin is the premium version from https://membermouse.com, the free one has been closed as of v1.2.0...
Caldera Forms <= 1.5.9.1 - Multiple Cross-Site Scripting (XSS)
The Caldera Forms – More Than Contact Forms WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...