RegistrationMagic – Custom Registration Forms and User Login < 4.6.0.4 - Multiple Critical Issues

These allowed an attacker with subscriber-level permissions to elevate their account’s privileges to those of an administrator and to export every form on the site, including all the data that had been submitted to them in the past. Additionally, through a number of unprotected AJAX actions, an...

GravityForms < 2.4.9 - Hashed Password Leakage

The gravityforms WordPress plugin was affected by a Hashed Password Leakage security vulnerability...

Email Before Download < 4.0 - SQL Injection

Email Before Download https://wordpress.org/plugins/email-before-download/ before version 4.0 was vulnerable to several SQL injections. An SQL escaping function was used but the escaped value was not between quotes so the attack payload does not have to use quotes and thus no escaping is done...

WordPress <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)

Description WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site...

Meta Slider <= 2.5 - Cross-Site Scripting (XSS)

The Responsive Slider by MetaSlider – Slider and Carousel Plugin for WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Divi < 5.12.0 - Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint

Description The theme is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force...

WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block

Description Gutenberg does not restrict a block attribute used as an HTML tag name, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the Gutenberg plugin and,...

Salient Shortcodes < 1.5.4 - Authenticated (Contributor+) Local File Inclusion via Shortcode

Description The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon' shortcode 'image' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...

Max Mega Menu < 3.3.1 - Missing Authorization

Description The Max Mega Menu plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sandbox function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger the...

WP Migrate Pro < 2.6.11 - Unauthenticated PHP Object Injection

Description The WP Migrate Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.10 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerab...

Login Lockdown < 2.07 - Admin+ SQLi

Description The plugin does not properly sanitise and escape the iDisplayStart parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

WP Category Post List Widget <= 2.0.3 - Cross-Site Request Forgery via gen_set_page

Description The WP Category Post List Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on the 'gensetpage' function. This makes it possible for unauthenticated attackers to modify...

Elementor Pro < 3.11.7 - Subscriber+ Arbitrary Options Update

The plugin does not have authorisation in an AJAX action relying only on a nonce, which is available to any authenticated users, and does not validate the options to be updated. This allows any authenticated users, such as subscriber to update arbitrary blog options, such as the defaultrole, when...

Media Library Assistant < 3.06 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. PoC POST /wp-admin/tools.php?page=insertfixit-tools HTTP/1.1...

WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting

Description Post authors are able to bypass KSES restrictions in WordPress = 5.9 and or Gutenberg = 9.8.0 due to the order filters are executed, which could allow them to perform to Stored Cross-Site Scripting attacks PoC As a user without the UNFILTEREDHTML capability, create a post containing t...

Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi

The plugin does not sanitise and escape some parameters before using them in SQL statements via AJAX actions available to unauthenticated users, leading to SQL Injections PoC order and columns parameters are affected curl 'https://example.com/wp-admin/admin-ajax.php' --data...

WP Reset Pro < 5.99 - Database Reset via CSRF

The plugin does not have CSRF check when resetting the database, which could allow attacker to make logged in users reset it Note: This affect only the pro version of the plugin, however both the free and pro have the same slug...

W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)

The plugin was vulnerable to a reflected Cross-Site Scripting XSS security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a...

WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)

Description An application Denial of Service DoS was found to affect WordPress versions 4.9.4 and below. We are not aware of a patch for this issue...

Ebook Download < 1.2 - Directory Traversal

The Zedna eBook download WordPress plugin was affected by a Directory Traversal security vulnerability...

WP Ultimate Email Marketer - Multiple Vulnerabilities

The wp-ultimate-email-marketer WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

WP < 7.1.3 - Unauthenticated Private Post Comment Disclosure via RSS Feed

Description WordPress does not properly restrict access to the comments associated with private and unpublished posts in some cases, which could allow unauthenticated users to read those comments through a feed...

Spiffy Calendar < 4.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Spiffy Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to 4.9.6 exclusive due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting

Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...

PDF.js Viewer < 2.1.8 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC pdfjs-viewer viewerheight='"...

WP < 6.0.3 - Stored XSS via wp-mail.php

Description WordPress does not properly sanitize some parameters when receiving a post by email, which could lead to Stored Cross-Site Scripting issue...

WP OAuth2 Server <= 1.0.1 - Authentication Bypass

The plugin does not properly check for authentication, which could allow attackers to bypass it...

GiveWP < 2.21.0 - Manager+ Arbitrary File Creation via Export

The plugin does not validate the exported file, which could allow high privilege users such as Managers to create arbitrary files...

WP Championship < 9.3 - Multiple CSRF

The plugin is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site...

Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting

Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users Contributor to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation Edit WPScanTeam: The https://wordpress.org/plugins/themify-portfolio-post/ plugin...

WordPress 5.2.2 - Cross-Site Scripting (XSS) in Stored Comments

Description From the WordPress version release notes: "Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored...

WPBakery Page Builder < 4.7.4 - Multiple Unspecified Cross-Site Scripting (XSS)

The jscomposer WordPress plugin was affected by a Multiple Unspecified Cross-Site Scripting XSS security vulnerability...

WordPress <= 4.2.2 - Authenticated Stored Cross-Site Scripting (XSS)

Description Authenticated Cross-Site Scripting XSS in post/page text editor mode. Editor user and up. PoC link...

WooCommerce 2.3 - 2.3.5 - SQL Injection

The WooCommerce WordPress plugin was affected by a 2.3.5 - SQL Injection security vulnerability...

Prime Slider < 3.14.2 - Contributor+ Stored XSS via Pagepiling Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

WP Show Posts < 1.1.6 - Improper Authorization to Information Exposure

Description The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view...

Elementor Pro < 3.19.3 - Authenticated (Contributor+) Information Exposure

Description The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.19.2 . This makes it possible for authenticated attackers, with contributor-level access and above, to extract arbitrary user meta values...

Oxygen Builder < 4.4 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

The plugin does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users. PoC 1. Add the following shortcode to ...

Shortcodes Ultimate < 5.12.1 - Stored XSS via CSRF

The plugin does not have CSRF check when adding a Preset, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads in a Preset created via a CSRF attack...

Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

The plugin does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection PoC curl https://example.com/wp-admin/admin-ajax.php --data...

Conversios.io < 4.6.2 - Subscriber+ SQL Injection

The plugin does not sanitise, validate and escape the syncprogressivedata parameter for the tvcajaxproductsyncbantchwise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks. Note: The vendor was notified multiple times since November 6t...

WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFS

The plugin, used by the WorkScout Theme did not sanitise the chat messages sent via the workscoutsendmessagechat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues PoC Payloads: " POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type:...

Rank Math 0.9~1.0.42.1 - Missing Access Controls to Disable Competitor Plugins

Missing access controls on the GET requests to deactivate competitors' plugins. This could allow any authenticated users such as subscribers to deactivate the SEO and Sitemap plugins from competitors. The attack could also be performed via CSRF. PoC...

Art-Picture-Gallery <= 1.2.9 - Unauthenticated Arbitrary File Upload

Edit WPScanTeam: March 26th, 2020 - Report Received & Vendor Contacted March 30th, 2020 - Escalated to WP Plugins team as no response from vendor March 31st, 2020 - WP Plugins team investigating & Plugin closed April 2nd, 2020 - Disclosure PoC The PoC will be displayed once the issue has been...

WordPress <= 5.0 - PHP Object Injection via Meta Data

Description According to WordPress: "Sam Thomas discovered that contributors could craft meta data in a way that resulted in PHP object injection."...

Xorbin Analog Flash Clock 1.0 - Flash-based XSS

The Xorbin Analog Flash Clock WordPress plugin was affected by a Flash-based XSS security vulnerability...

WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure

Description WordPress does not correctly filter post types in some cases when guessing a permalink, which could allow unauthenticated users to discover the slugs of content excluded from search...

Unyson < 2.7.31 - Cross-Site Request Forgery

Description The Unyson plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.30. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action...

Store Locator WordPress < 1.4.15 - Admin+ Arbitrary File Deletion

Description The plugin is vulnerable to Directory Traversal, allowing authenticated attackers, with administrator access and above, to delete arbitrary files...