14608 matches found
WooCommerce <= 3.4.4 - Potential Object Injection
According to WooCommerce: "Versions 3.4.4 and earlier are affected by an issue where a function that updates attributes could lead to object injection. This is related to the WordPress 4.8.3 security release. This issue can only be exploited by users who can edit attributes and should not be...
JS Job <= 1.0.6 - CSRF
The JS Job Manager WordPress plugin was affected by a CSRF security vulnerability...
Membermouse < 2.2.9 - Blind SQL Injection
Note: It seems like the affected plugin is the premium version from https://membermouse.com, the free one has been closed as of v1.2.0...
Caldera Forms <= 1.5.9.1 - Multiple Cross-Site Scripting (XSS)
The Caldera Forms – More Than Contact Forms WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
WordPress 3.7-4.9.4 - Escape Version in Generator Tag
Description Make sure the version string is correctly escaped for use in generator tags...
Duplicator <= 1.2.32 - Cross-Site Scripting (XSS)
The Duplicator – WordPress Migration Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
BuddyBoss Media <= 3.2.3 - Stored XSS
The album description does not perform input / output validation. According to the researcher: No reply from vendor. Issue not patched. Vulnerability can be exploited by any user. Form not vulnerable to CSRF. PoC '"...
Football Pool < 2.6.5 - Multiple XSS
The Football Pool WordPress plugin was affected by a Multiple XSS security vulnerability...
Z-URL Preview <= 1.6.2 - Cross-Site Scripting (XSS)
The Z-URL Preview WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Contact Form for WordPress – Ultimate Form Builder Lite <= 1.3.6 - SQL Injection
The Contact Form for WordPress – Ultimate Form Builder Lite WordPress plugin was affected by a SQL Injection security vulnerability...
Insert Pages < 3.2.4 - Directory Traversal
The Insert Pages WordPress plugin was affected by a Directory Traversal security vulnerability...
Content Timeline <= 4.4.2 - Multiple Blind SQL Injection
Multiple Blind SQL injections in the premium 'Content Timeline' Plugin. One unauthenticated and two authenticated injections. Contacted the author twice without any response. History: 09-16-2017 Contacted the author 09-16-2017 Requested CVE-ID 09-18-2017 CVE-ID Received 09-18-2017 Contacted the...
Smush Image Compression and Optimization <= 2.7.5 - File Transversal
The Smush – Lazy Load Images, Optimize & Compress Images WordPress plugin was affected by a File Transversal security vulnerability...
Liveforms < 3.4.0 - XSS
The Live Forms – Easy Drag and Drop Form Builder Plugin for WordPress WordPress plugin was affected by a XSS security vulnerability...
Weblibrarian < 3.4.8.6 - XSS
The WebLibrarian WordPress plugin was affected by a XSS security vulnerability...
Easy Team Manager 1.3.2 - Authenticated Blind SQL Injection
The easy-team-manager WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
eventr 1.02.2 - Blind SQL Injection
The eventr WordPress plugin was affected by a Blind SQL Injection security vulnerability...
Simple Job Board <= 2.4.3 - Reflected XSS
The Simple Job Board WordPress plugin was affected by a Reflected XSS security vulnerability...
WP Markdown Editor 2.3.0 - Authenticated "Self" Cross-Site Scripting (XSS)
An Author user could be exploited by use of "self" XSS. This usually requires social engineering and user interaction...
Webapp builder 2.0 - Unauthenticated File Upload
Plugin is still affected and has been closed...
mobile-friendly-app-builder-by-easytouch 3.0 - Unauthenticated File Upload
Plugin is still affected and has been closed...
rockhoist-badges 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS)
The rockhoist-badges WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...
WP Mail < 1.2 - XSS
The WP Mail WordPress plugin was affected by a XSS security vulnerability...
WassUp Real Time Analytics <= 1.9 - Cross Site Scripting
The WassUp Real Time Analytics WordPress plugin was affected by a Cross Site Scripting security vulnerability...
Simplified Content <= 1.0.0 - XSS
The Simplified Content WordPress plugin was affected by a XSS security vulnerability...
Activity Log <= 2.3.2 - Cross-Site Scripting (XSS)
The Activity Log WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Yoast SEO <= 3.4.0 - Authenticated Stored Cross-Site Scripting (XSS)
The changelog reads: "Fixes a stored XSS issue in the Yoast SEO metabox. Thanks Hammad Shamsi for reporting and responsibly disclosing this issue."...
Estatik < 2.3.1 - Arbitrary File Upload
The Estatik Real Estate Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
Adblock Blocker 0.0.1 - Arbitrary File Upload
The addblockblocker WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
WP Google Map Plugin < 3.1.2 - XSS
The WP Google Map Plugin WordPress plugin was affected by a XSS security vulnerability...
Profile Builder < 2.4.2 - Reflected Cross-Site Scripting (XSS)
The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
WP Live Chat Support < 6.2.02 - Stored Cross-Site Scripting
The 3CX Live Chat WordPress plugin was affected by a Stored Cross-Site Scripting security vulnerability...
WordPress 4.5.2 - Password Change via Stolen Cookie
...
Jetpack <= 4.0.3 - Multiple Vulnerabilities
Jetpack 4.0.4 fixes 3 security bugs: Private feedback form entries were made available publicly via the REST API Post By Email settings could be changed The Likes module was vulnerable to XSS...
Jetpack 2.0-4.0.2 - Shortcode Stored Cross-Site Scripting (XSS)
The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Shortcode Stored Cross-Site Scripting XSS security vulnerability...
Fluid Responsive Slideshow < 2.2.7 - CSRF & XSS
The Fluid Responsive Slideshow WordPress plugin was affected by a CSRF & XSS security vulnerability...
Ghost Plugin <= 0.5.5 - Unrestricted Export Download
The Ghost WordPress plugin was affected by an Unrestricted Export Download security vulnerability...
Gnucommerce < 0.5.7-beta - XSS
The GNUCommerce WordPress plugin was affected by a XSS security vulnerability...
Tevolution <= 2.2.7 - Unrestricted File Upload
Files 'single-upload.php' and 'singleupload.php' affected...
Users Ultra Membership Plugin <= 1.5.62 - Authenticated Stored Cross-Site Scripting (XSS) & CSRF
Both pname and pdesc are vulnerable. No nonce on form so also vulnerable to CSRF. Original researcher's PoC does not work as all parameters are needed to be submitted not just the pname parameter...
Users Ultra Membership Plugin <= 1.5.58 - Unrestricted File Upload
The Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin WordPress plugin was affected by an Unrestricted File Upload security vulnerability...
wp-championship <= 5.8 - Authenticated Blind SQL Injection
The wp-championship WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC $ sqlmap -u 'http://www.example.com/wp-admin/wp-championship/csadminusers.php=' --data="isadmin=1" --cookie=AUTHCOOKIEHERE --level=5 --risk=3...
Appointment Booking Calendar < 1.1.8 - Multiple Reflected Cross-Site Scripting (XSS) and SQL Injection
The Appointment Booking Calendar WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS and SQL Injection security vulnerability...
MDC Private Message <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS)
The mdc-private-message WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...
WP Ultimate Csv Importer < 3.8.1 - XSS
The Import and Export WordPress Data as CSV or XML WordPress plugin was affected by a XSS security vulnerability...
Tag Miner <= 1.1.2 - Cross-Site Request Forgery (CSRF) & XSS
The Tag Miner Automatic Tag Extraction WordPress plugin was affected by a Cross-Site Request Forgery CSRF & XSS security vulnerability...
Dynamic Widgets <= 1.5.10 - Authenticated Cross-Site Scripting (XSS) & CSRF
The Dynamic Widgets WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS & CSRF security vulnerability...
WordPress <= 4.2.3 - Widgets Title Cross-Site Scripting (XSS)
...