14653 matches found
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd < 5.1.2 - Authenticated Stored Cross Site Scripting (XSS)
Authenticated stored cross-site scripting issues in some of the plugin settings, requiring high privileges. PoC Affected fields are in the settings of the plugin and will be triggered when the common soon page is displayed either the preview or normal one: Logo: x' onerror='alert/XSS/ Headlines:...
SportsPress < 2.7.2 - Authenticated Stored Cross-Site Scripting
Any user with the role of administrator or League Manager is able to store XSS payloads in the custom delimiter setting of events pages. This will then execute on all events pages on the website. PoC Video PoC: https://youtu.be/J8QZ8S6CiS8...
Iframe < 4.5 - Authenticated Stored Cross Site Scripting (XSS)
The iframe plugin before 4.5 does not sanitize a URL. PoC iframe src="javascript:alertdocument.cookie" width="100%" height="500"...
Advanced Order Export For WooCommerce < 3.1.4 - Authenticated Cross-Site Scripting (XSS)
The Advanced Order Export plugin for WooCommerce versions 3.1.4 had a reflected XSS vulnerability due to lack of input sanitization on the woeposttype parameter. This allowed arbitrary HTML and JavaScript injection and execution in the context of the logged in user. PoC On a WooCommerce...
LifterLMS < 3.37.15 - Arbitrary File Writing
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress WordPress plugin was affected by an Arbitrary File Writing security vulnerability...
Newsletter < 6.5.4 - CSV Injection
A CSV Injection vulnerability was discovered in Wordpress Newsletter plugin. It allows a user with low level privileges or no privileges to inject a command in subscription form that will be included in the exported CSV file, leading to possible code execution...
Import Export WordPress Users < 1.3.9 - Authenticated Arbitrary User Creation
"The flaw allowed anybody with subscriber-level access or above to import new users via a CSV file, including administrative-level users" providing subscriber-level users and above with the ability to escalate their privileges. PoC POST /wp-admin/admin-ajax.php?importpage=wordpresshfusercsv=3...
WP Security Audit Log < 4.0.2 - Broken Access Control in First-Time Install Wizard
Broken access control vulnerability affecting version 4.0.1 and below that could lead to privilege escalation, sensitive data exposure and insecure deserialisation. To exploit the vulnerability, the wizard must not have been completed, otherwise it won’t work...
GistPress < 3.0.2 - Authenticated Stored XSS
XSS vulnerability that could be exploited by untrusted contributors on multi-author sites...
Elementor Page Builder < 2.8.4 - Cross-Site Scripting (XSS)
Elementor Page Builder before 2.8.4 does not sanitise data when creating a new template, which could lead to Cross-Site Scripting issues...
Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)
IDOR issues allowing change of other users' profiles and cover photos...
Ultimate FAQ < 1.8.30 - Unauthenticated Reflected XSS
The HTML code generated by the FAQ shortcode does not sanitise the DisplayFAQ GET parameter, leading to an unauthenticated reflected Cross-Site Scripting issue on pages where such shortcode is used. PoC Append the following payload on a page where a FAQ is embedded: ?DisplayFAQ=...
301 Redirects - Easy Redirect Manager <= 2.40 - Authenticated Arbitrary Redirect Injection and Modification, XSS, and CSRF
The weaknesses allow for any authenticated user, even subscribers, to modify, delete, and inject redirect rules that could potentially result in a loss of site availability, in addition to XSS and CSRF. PoC...
Zoho CRM Lead Magnet Plugin - Authenticated Cross Site Scripting (XSS)
The version affected was version 1.6.9.1 The plugin was removed from the WordPress plugin directory on October 15th 2019...
WordPress <= 5.2.3 - Stored XSS in Style Tags
...
Download Plugins and Themes from Dashboard <= 1.5.0 - Unauthenticated Stored XSS
NinTechNet discovered a multiple security issues within the Download Plugins and Themes from Dashboard WordPress plugin. The plugin's setting update request did not check for authorisation, allowing an unauthenticated user to inject malicious JavaScript, which would be stored in the backend...
WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews
Description According to the WordPress release notes: "Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting XSS in shortcode previews."...
Bold Page Builder < 2.3.2 - Missing Access Controls
The vulnerability allows any unauthenticated user to perform actions that only an administrator should be allowed to do e.g., modifying settings and importing data...
WP Social Feed Gallery < 2.4.8 - CSRF & Missing Authorisation Checks
The lack of CSRF and Authorisations checks in some AJAX methods, such as qliggdismissnotice and qliggformitemdelete could allow attacker to perform unauthorised actions via actions when logged in as a low privilege user, or via CSRF attacks...
ND Booking < 2.5 - Unauthenticated Options Change
The Hotel Booking WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...
WPS Child Themes Generator <= 1.1 - Path Traversal
The WPS Child Theme Generator WordPress plugin was affected by a Path Traversal security vulnerability...
Adaptive Images for WordPress <= 0.6.66 - Local File Inclusion & Deletion
The Adaptive Images for WordPress WordPress plugin was affected by a Local File Inclusion & Deletion security vulnerability...
Everest Forms <= 1.4.9 - SQL Injection
The Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms WordPress plugin was affected by a SQL Injection security vulnerability...
Web Librarian < 3.5.5 - SQL Injection
The WebLibrarian WordPress plugin was affected by a SQL Injection security vulnerability...
Rencontre – Dating Site <= 3.1.2 - SQLi & XSS
SQL injection & XSS vulnerability in Rencontre – Dating Site Plugin For WordPress...
Form Maker by 10Web < 1.13.5 - Cross-Site Request Forgery (CSRF) to LFI
Form Maker by WD plugin suffers from a CSRF issue that could lead to an LFI attack...
Contact Form Email <= 1.2.65 - Multiple Cross-Site Scripting (XSS) & CSRF
The Contact Form Email WordPress plugin was affected by a Multiple Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=cpcontactformtoemail=1=1='"...
Instagram Feed <= 1.11.3 - Unspecified Issues
The Smash Balloon Social Photo Feed WordPress plugin was affected by an Unspecified Issues security vulnerability...
WP Ultimate Exporter < 1.4.2 - CSRF
The Export WordPress Data with Advanced Filters WordPress plugin was affected by a CSRF security vulnerability...
Slideshow Gallery <= 1.6.8 - XSS and SQLi
The Slideshow Gallery WordPress plugin was affected by a XSS and SQLi security vulnerability...
Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting (XSS)
The Import any XML or CSV File to WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
BuddyBoss Media <= 3.2.3 - Stored XSS
The album description does not perform input / output validation. According to the researcher: No reply from vendor. Issue not patched. Vulnerability can be exploited by any user. Form not vulnerable to CSRF. PoC '"...
SrbTransLatin <= 1.46 - Stored XSS & CSRF
The SrbTransLatin – Serbian Latinisation WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...
Dbox 3D Slider Lite <= 1.2.2 - Multiple Authenticated SQL injection
During the security analysis, ThunderScan discovered SQL injection vulnerabilities in Dbox 3D Slider Lite WordPress plugin. The easiest way to reproduce the vulnerabilities is to modify the POST request for the slider rename or reorder and append parts of the SQL query to the currentsliderid...
Football Pool < 2.6.5 - Multiple XSS
The Football Pool WordPress plugin was affected by a Multiple XSS security vulnerability...
Z-URL Preview <= 1.6.2 - Cross-Site Scripting (XSS)
The Z-URL Preview WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WP Mailster <= 1.5.4 - Unauthenticated Cross-Site Scripting (XSS)
The WP Mailster WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability...
UserPro <= 4.9.17 - Authentication Bypass
The userpro plugin has the ability to bypass login authentication for the user 'admin'. If the site does not use the standard username 'admin' it is not affected. PoC 1 - Google Dork inurl:/plugins/userpro 2 - Browse to a site that has the userpro plugin installed. 3 - Append ?upautolog=true to t...
Contact Form for WordPress – Ultimate Form Builder Lite <= 1.3.6 - SQL Injection
The Contact Form for WordPress – Ultimate Form Builder Lite WordPress plugin was affected by a SQL Injection security vulnerability...
Student Result or Employee Database <= 1.6.3 - Auth Bypass
The Student Result or Employee Database WordPress plugin was affected by an Auth Bypass security vulnerability. PoC curl -i -s -k -X 'POST' -H 'User-Agent: Mozilla/5.0' -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H 'X-Requested-With: XMLHttpRequest' -H 'Referer:...
Smush Image Compression and Optimization <= 2.7.5 - File Transversal
The Smush – Lazy Load Images, Optimize & Compress Images WordPress plugin was affected by a File Transversal security vulnerability...
Liveforms < 3.4.0 - XSS
The Live Forms – Easy Drag and Drop Form Builder Plugin for WordPress WordPress plugin was affected by a XSS security vulnerability...
FormCraft - Premium WordPress Form Builder <= v3.2.31 - Authenticated Stored XSS
WordPress FormCraft Premium WordPress Form Builder versions 3.2.31 and below suffer from a persistent Cross-Site Scripting XSS vulnerability. PoC Authenticated Stored XSS: New Form Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed...
Popup Maker <= 1.6.4 - Authenticated Cross-Site Scripting (XSS)
The Popup Maker – Popup Forms, Opt-ins & More WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
EELV Newsletter < 4.6.1 - CSRF & XSS
The EELV Newsletter WordPress plugin was affected by a CSRF & XSS security vulnerability...
Easy WP Smtp < 1.2.5 - XSS
The Easy WP SMTP WordPress plugin was affected by a XSS security vulnerability...
Slideshow Gallery <= 1.6.5 - Multiple Authenticated Cross-Site Scripting (XSS)
The Slideshow Gallery WordPress plugin was affected by a Multiple Authenticated Cross-Site Scripting XSS security vulnerability. PoC http://vulnerablesite.com/wp-admin/admin.php?page=slideshowgalleries=view=1%5C%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...
Invite Anyone <= 1.3.14 - Change of Email Invitation Content
The Invite Anyone WordPress plugin was affected by a Change of Email Invitation Content security vulnerability...