14608 matches found
Pie Register <= 2.0.13 - Privilege escalation
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a Privilege escalation security vulnerability...
CM Download Manager < 2.0.7 - CSRF to Cross-Site Scripting
The lack of CSRF check and sanitisation could allow attackers to perform CSRF attacks against logged in administrators, and set a Cross-Site Scripting payload via addonstitle parameter in the CMDMadminsettings page...
O2tweet <= 0.0.4 - Multiple CSRF
Plugin is still affected and has been closed...
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)
The plugin does not validate the 'wpnonce' anti-CSRF token. This issue can be used to perform many actions. The most significant action with the biggest impact is the ability to redirect users to malicious websites. Functionality exists where specific user agent strings can be configured to be...
Ninja Forms <= 2.8.9 - Unspecified Issue Affecting Admin Users
This version includes a fix for a potential security vulnerability for admin users...
DukaPress <= 2.5.3 - Unauthenticated Path Traversal
The DukaPress WordPress plugin was affected by an Unauthenticated Path Traversal security vulnerability...
WP Support Plus Responsive Ticket System < 4.2 - Multiple Issues
The WP Support Plus Responsive Ticket System WordPress plugin was affected by a Multiple Issues security vulnerability...
BulletProof Security <= .51 - Multiple Vulnerabilities (XSS & SSRF)
The BulletProof Security WordPress plugin was affected by a Multiple Vulnerabilities XSS & SSRF security vulnerability...
Quartz Plugin 1.01.1 - SQL Injection
The quartz WordPress plugin was affected by a SQL Injection security vulnerability...
All In One WP Security plugin 3.8.2 - 2xSQL Injections
The All In One WP Security & Firewall WordPress plugin was affected by a 2xSQL Injections security vulnerability...
I Recommend This < 3.7.3 - SQL Injection
The I Recommend This WordPress plugin was affected by a SQL Injection security vulnerability...
Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS
The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an IPTraf.php URI Request Stored XSS security vulnerability...
Login Widget With Shortcode 3.1.1 - CSRF/XSS
The Login Widget With Shortcode WordPress plugin was affected by a CSRF/XSS security vulnerability...
Improved User Search in Backend < 1.2.6 - CSRF & XSS
The Improved user search in backend WordPress plugin was affected by a CSRF & XSS security vulnerability...
All Video Gallery 1.1 - config.php Multiple Parameter SQL Injection
The all-video-gallery WordPress plugin was affected by a config.php Multiple Parameter SQL Injection security vulnerability...
WP-Ban < 1.64 BlackList Bypass
The WP-Ban WordPress plugin was affected by security vulnerability...
Disqus <= 2.75 - Cross-Site Scripting (XSS) & CSRF
The Disqus Comment System WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...
DejaVu 2.4 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download
The dejavu WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...
scarlet <= 1.1.3 - XSS in ZeroClipboard.swf
The scarlet WordPress theme was affected by a XSS in ZeroClipboard.swf security vulnerability...
Member Approval 131109 - wp-admin/options-general.php Option Manipulation CSRF
The member-approval WordPress plugin was affected by a wp-admin/options-general.php Option Manipulation CSRF security vulnerability...
AskApache Firefox Adsense 3.0 - Unspecified CSRF
The askapache-firefox-adsense WordPress plugin was affected by an Unspecified CSRF security vulnerability...
platinum_seo_pack.php - s Parameter Reflected XSS
The Platinum SEO WordPress plugin was affected by a s Parameter Reflected XSS security vulnerability...
Yoast SEO < 1.4.7 - Reset Settings Feature Access Restriction Bypass
The Yoast SEO WordPress plugin was affected by a Reset Settings Feature Access Restriction Bypass security vulnerability...
Digg Digg 5.3.4 - Setting Manipulation CSRF
The digg-digg WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
open-flash-chart-core - ofc_upload_image.php Arbitrary File Upload
The open-flash-chart-core WordPress plugin was affected by an ofcuploadimage.php Arbitrary File Upload security vulnerability...
cleeng <= 2.3.2 - XSS in ZeroClipboard
The cleeng WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
bp-code-snippets <= 2.0 - XSS in ZeroClipboard
The bp-code-snippets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
WP Clone by WP Academy <= 2.1.1 - XSS in ZeroClipboard
The Clone WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
RLSWordPressSearch - register.php agentid Parameter SQL Injection
The RLSWordPressSearch WordPress plugin was affected by a register.php agentid Parameter SQL Injection security vulnerability...
Gallery - "load" Remote File Inclusion
The wordpress-gallery WordPress plugin was affected by a "load" Remote File Inclusion security vulnerability...
Vitamin 1.0 - minify.php path Parameter Traversal Arbitrary File Access
The vitamin WordPress plugin was affected by a minify.php path Parameter Traversal Arbitrary File Access security vulnerability...
WP-PostViews 1.62 - Setting Manipulation CSRF
The WP-PostViews WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
GRAND Flash Album Gallery 0.55 - admin/news.php want2Read Parameter Traversal Arbitrary File Access
The Album and Image Gallery with Lightbox – Flagallery Photo Portfolio WordPress plugin was affected by an admin/news.php want2Read Parameter Traversal Arbitrary File Access security vulnerability...
Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)
The BuddyPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
WordPress <= 3.0.5 wp-admin/press-this.php Privilege Escalation
...
WordPress 2.9 - Failure to Restrict URL Access
Description When WordPress implemented the new Trash feature they failed to change the permissions granted when the post is in the trash. This means that an unauthenticated user cannot see the post, however an authenticated user can, no matter what privileges they have, even ‘subscriber’. See...
adminimize 1.7.21 - 'page' Parameter Cross Site Scripting
The Adminimize WordPress plugin was affected by a 'page' Parameter Cross Site Scripting security vulnerability...
R&om Banner 1.1.2.1 - Cross-Site Scripting (XSS)
The Random Banner WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Oleggo Livestream <= 0.2.6 - XSS
Plugin is still affected and has been closed...
Prostore < 1.1.3 - Open Redirection
The prostore WordPress theme was affected by an Open Redirection security vulnerability. PoC /wp-content/themes/prostore/go.php?https://example.com...
TinyMCE Color Picker 1.1 - tinymce-colorpicker.php Missing edit_others_posts Capability Check
The TinyMCE Color Picker WordPress plugin was affected by a tinymce-colorpicker.php Missing editothersposts Capability Check security vulnerability...
Contact Form 3.34 - contact_form.php cntctfrm_contact_message Parameter XSS
The Contact Form by BestWebSoft WordPress plugin was affected by a contactform.php cntctfrmcontactmessage Parameter XSS security vulnerability...
Backupbuddy - importbuddy.php Direct Request Remote Backup File Disclosure
The backupbuddy WordPress plugin was affected by an importbuddy.php Direct Request Remote Backup File Disclosure security vulnerability...
AllWebMenus 1.1.3 - Remote File Inclusion
The AllWebMenus WordPress Menu Plugin WordPress plugin was affected by a Remote File Inclusion security vulnerability...
WP Recaptcha < 3.0 - Multiple CSRF
The wp-recaptcha WordPress plugin was affected by a Multiple CSRF security vulnerability...
Google Analyticator < 5.2.1 - XSS
The Google Analyticator WordPress plugin was affected by a XSS security vulnerability...
WordPress <= 1.5.1.2 - Email Spoofing
...
WordPress 0.7 - SQL Injection
...
Music Store - WordPress eCommerce < 1.1.14 - Authenticated (Admin+) SQL Injection
Description The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render
Description The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...