14629 matches found
Shortcodes Ultimate < 5.12.1 - Stored XSS via CSRF
The plugin does not have CSRF check when adding a Preset, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads in a Preset created via a CSRF attack...
WP OAuth2 Server <= 1.0.1 - Authentication Bypass
The plugin does not properly check for authentication, which could allow attackers to bypass it...
GiveWP < 2.21.0 - Manager+ Arbitrary File Creation via Export
The plugin does not validate the exported file, which could allow high privilege users such as Managers to create arbitrary files...
WP Cerber Security, Anti-spam & Malware Scan < 8.9.6 - Unauthenticated Stored Cross-Site Scripting
The plugin does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability. PoC POST /"/onmouseover=alert1;// HTTP/1.1 Host: 127.0.0.1 Content-Type:...
All In One SEO < 4.1.5.3 - Authenticated SQL Injection
The plugin is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed passwords...
Avada < 6.2.3 - Missing Permission Checks leading to Arbitrary Post Creation, Edition, Deletion and Stored XSS
Description NinTechNet disclosed multiple security vulnerabilities affecting the premium Avada WordPress theme on their blog after responsibly disclosing the security vulnerabilities to Avada. These vulnerabilities included: - Content Injection & Stored XSS - Arbitrary Post Deletion - Arbitrary...
RegistrationMagic – Custom Registration Forms and User Login < 4.6.0.4 - Multiple Critical Issues
These allowed an attacker with subscriber-level permissions to elevate their account’s privileges to those of an administrator and to export every form on the site, including all the data that had been submitted to them in the past. Additionally, through a number of unprotected AJAX actions, an...
WordPress <= 5.0 - PHP Object Injection via Meta Data
Description According to WordPress: "Sam Thomas discovered that contributors could craft meta data in a way that resulted in PHP object injection."...
Avada Theme <= 5.1.4 - Stored Cross-Site Scripting (XSS) & CSRF
Description The Avada WordPress theme was affected by a Stored Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://cdn.wphutte.com/Avada/5.1.4/xss.html http://cdn.wphutte.com/Avada/5.1.4/csrf.html...
Ebook Download < 1.2 - Directory Traversal
The Zedna eBook download WordPress plugin was affected by a Directory Traversal security vulnerability...
WordPress <= 4.2.2 - Authenticated Stored Cross-Site Scripting (XSS)
Description Authenticated Cross-Site Scripting XSS in post/page text editor mode. Editor user and up. PoC link...
Meta Slider <= 2.5 - Cross-Site Scripting (XSS)
The Responsive Slider by MetaSlider – Slider and Carousel Plugin for WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Elementor Pro < 3.19.3 - Authenticated (Contributor+) Information Exposure
Description The Elementor Website Builder Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.19.2 . This makes it possible for authenticated attackers, with contributor-level access and above, to extract arbitrary user meta values...
Login Lockdown < 2.07 - Admin+ SQLi
Description The plugin does not properly sanitise and escape the iDisplayStart parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
Store Locator WordPress < 1.4.15 - Admin+ Arbitrary File Deletion
Description The plugin is vulnerable to Directory Traversal, allowing authenticated attackers, with administrator access and above, to delete arbitrary files...
WP < 6.0.3 - Stored XSS via Comment Editing
Description WordPress does not properly escape comments, which could lead to Stored Cross-Site Scripting issues...
SEO Redirection < 9.1 - 404 Error & History Deletion via CSRF
The plugin does not have CSRF check when deleting 404 errors and history, which could allow attackers to make logged in admins delete them via CSRF attacks...
WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting
Description Post authors are able to bypass KSES restrictions in WordPress = 5.9 and or Gutenberg = 9.8.0 due to the order filters are executed, which could allow them to perform to Stored Cross-Site Scripting attacks PoC As a user without the UNFILTEREDHTML capability, create a post containing t...
Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
The plugin does not sanitise and escape some parameters before using them in SQL statements via AJAX actions available to unauthenticated users, leading to SQL Injections PoC order and columns parameters are affected curl 'https://example.com/wp-admin/admin-ajax.php' --data...
W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)
The plugin was vulnerable to a reflected Cross-Site Scripting XSS security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a...
Comments - wpDiscuz 7.0.0 - 7.0.4 - Unauthenticated Arbitrary File Upload
This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Content-Length: 774 Accept: / X-Requested-With: XMLHttpRequest User-Agent:...
WPBakery Page Builder < 4.7.4 - Multiple Unspecified Cross-Site Scripting (XSS)
The jscomposer WordPress plugin was affected by a Multiple Unspecified Cross-Site Scripting XSS security vulnerability...
WooCommerce 2.3 - 2.3.5 - SQL Injection
The WooCommerce WordPress plugin was affected by a 2.3.5 - SQL Injection security vulnerability...
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...
WP < 6.0.3 - Stored XSS via wp-mail.php
Description WordPress does not properly sanitize some parameters when receiving a post by email, which could lead to Stored Cross-Site Scripting issue...
PHP Everywhere < 3.0.0 - Contributor+ RCE via Gutenberg Block
The plugin allows any users with a role as low as contributor to execute PHP via the Gutenberg Block of the plugin in posts...
Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting
The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. PoC As unauthenticated: wget "https://example.com/?wpamid=1"...
Name Directory < 1.18 - Cross-Site Request Forgery (CSRF)
The plugin was affected by CSRF issues, allowing attackers to make a logged in administrator perform unwanted actions...
WordPress 2.8.6-4.9 - Authenticated JavaScript File Upload
...
Email Before Download < 4.0 - SQL Injection
Email Before Download https://wordpress.org/plugins/email-before-download/ before version 4.0 was vulnerable to several SQL injections. An SQL escaping function was used but the escaped value was not between quotes so the attack payload does not have to use quotes and thus no escaping is done...
Multiple iThemes plugins, themes and add-ons - XSS via add_query_arg() and remove_query_arg()
...
Forminator < 1.29.0 - Unauthenticated Arbitrary File Upload
Description The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.28.1. This makes it possible for unauthenticated attackers to upload arbitrary fil...
Post Views Counter < 1.4.5 - Cross-Site Request Forgery via save_bulk_post_views()
Description The plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the savebulkpostviews function. This makes it possible for unauthenticated attackers to save bulk post views via a forged request...
My Calendar < 3.4.22 - Unauthenticated SQL Injection
Description The My Calendar plugin for WordPress is vulnerable to blind|generic|time-based SQL Injection via the 'from' and 'to' parameters of the '/my-calendar/v1/events' rest route in all versions up to, and including, 3.4.21 due to insufficient escaping on the user supplied parameter and lack ...
Decorator - WooCommerce Email Customizer < 1.2.8 - Cross-Site Request Forgery
Description The Decorator – WooCommerce Email Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing nonce validation on several functions such as ajaxreset, wtdecoratorbuttontext, wtdecoratorsetasdefault, an...
Charitable < 1.7.0.14 - Authenticated(Contributor+) Stored Cross-Site Scripting
Description The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.7.0.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
The plugin does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users. PoC 1. Add the following shortcode to ...
WCFM Frontend Manager < 6.6.1 - Subscriber+ Unauthorised AJAX Calls
The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscriber to call them and modify knowledge bases/notices/payments, manage vendors etc...
Ultimate Member < 2.5.1 - Subscriber+ RCE
The plugin does not validate user input passed to calluserfunc via the populatedropdownoptions function, which could allow any authenticated users, such as subscriber to call arbitrary functions without argument ie phpinfo...
Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users Contributor to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation Edit WPScanTeam: The https://wordpress.org/plugins/themify-portfolio-post/ plugin...
JoomSport <= 3.3 - SQL Injection
The JoomSport – for Sports: Team & League, Football, Hockey & more WordPress plugin was affected by a SQL Injection security vulnerability...
Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update
Description The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options PoC As any authenticated user: Enable new user registrations:...
WP Show Posts < 1.1.6 - Improper Authorization to Information Exposure
Description The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view...
LiteSpeed Cache < 5.7.0.1 - Unauthenticated Stored XSS
Description The plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nameservers' and 'msg' parameters due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...
Bricks < 1.9.6.1 - Unauthenticated Remote Code Execution
Description The Bricks theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.6. This makes it possible for unauthenticated attackers to execute code on the server...
Bamboo Columns <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Bamboo Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...
Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure
The plugin leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files. PoC - Create a password protected package containing one or more files. - Navigate to the download page of the package e.g. /download/package1 -...
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
The plugin does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server PoC 1. Install and activate woocommerce dependency, no setup required 2. Install and active the vulnerable plugin n-media-woocommerce-checkout-fields...
MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRF
The plugin has an AJAX action that allows any logged in users such as subscriber to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example PoC As any logged in user:...