14653 matches found
Hero Maps Pro <= 2.1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hero-maps-pro WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/hero-maps-pro/views/dashboard/index.php?v=""...
HDW WordPress Video Gallery <= 1.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The hdw-tube WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/hdw-tube/playlist.php?playlist=""...
MiniMax <= 2.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The page-layout-builder WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layoutsettingsid=""...
Tidio Gallery <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The tidio-gallery WordPress plugin was affected by a Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/tidio-gallery/popup-insert-help.php?galleryId=""...
OptionTree <= 2.5.5 - Authenticated Cross-Site Scripting (XSS)
The OptionTree WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
NextGEN Gallery < 2.1.15 - Unrestricted File Upload
The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by an Unrestricted File Upload security vulnerability...
Cool Video Gallery <= 1.9 - Authenticated Comm& Injection
The Cool Video Gallery WordPress plugin was affected by an Authenticated Comm& Injection security vulnerability...
WP-Stats-Dashboard <= 2.9.4 - Authenticated Blind SQL Injection
The wp-stats-dashboard WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
Websimon Tables <= 1.3.4 - Authenticated Reflected Cross-Site Scripting (XSS)
The websimon-tables WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...
Pie-Register <= 2.0.18 - Authenticated Blind SQL Injection
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
Pie-Register <= 2.0.18 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...
Simple Fields <= 1.4.10 - Authenticated Reflected Cross-Site Scripting (XSS)
The Simple Fields WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...
Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS)
The Google Analyticator WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
Unite Gallery Lite <= 1.4.6 - CSRF & Authenticated SQL Injection
The Unite Gallery Lite WordPress plugin was affected by a CSRF & Authenticated SQL Injection security vulnerability...
Candidate Application Form <= 1.3 - Unauthenticated Arbitrary File Download
Plugin is still affected and has been closed. The code in downloadpdffile.php does not do any sanity checks, allowing a remote attacker to download sensitive system files. PoC $ curl...
Sell Downloads < 1.0.8 - Insufficient Restrictions when Brute-Force Purchase IDs
The Sell Downloads WordPress plugin was affected by an Insufficient Restrictions when Brute-Force Purchase IDs security vulnerability...
Simple Share Buttons Adder <= 6.0.0 - Reflected Cross-Site Scripting (XSS)
A reflected XSS in "Simple Share Buttons Adder" before version 6.0.1 lead to a reflected cross-site scripting vulnerability on all pages where the "Simple Share Buttons Adder" was added usually all blog posts. Exploitation required that the browser did not encode the parameters sent to the server...
Estrutura-Basica - Local File Download
The estrutura-basica WordPress theme was affected by a Local File Download security vulnerability...
Events Manager < 5.5.7 - Multiple Cross-Site Scripting (XSS)
The Events Manager WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
All In One WP Security And Firewall < 3.9.5 - XSS
The All In One WP Security & Firewall WordPress plugin was affected by a XSS security vulnerability...
Contact Form Plugin < 3.96 - XSS
The Contact Form by BestWebSoft WordPress plugin was affected by a XSS security vulnerability...
All in One SEO Pack <= 2.2.5.1 - Information Disclosure
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code...
Captcha <= 4.0.6 - Captcha Bypass
The captcha WordPress plugin was affected by a Captcha Bypass security vulnerability...
Pixabay Images <= 2.3 - Multiple Vulnerabilities (RCE, XSS, ...)
1 Authentication bypass The plugin does not correctly check if the user is logged in. Certain code can be called without authentication 2 Arbitrary file upload The plugin code does not validate the host in the provided download URL, which allows to upload malicious files, including PHP code. 3 Pa...
Banner Effect Header 1.2.6 - XSS & CSRF
The Banner Effect Header WordPress plugin was affected by a XSS & CSRF security vulnerability...
Cforms & CformsII <= 14.7 - Remote Code Execution via Unauthorised File Upload
...
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)
The plugin does not validate the 'wpnonce' anti-CSRF token. This issue can be used to perform many actions. The most significant action with the biggest impact is the ability to redirect users to malicious websites. Functionality exists where specific user agent strings can be configured to be...
DukaPress <= 2.5.3 - Unauthenticated Path Traversal
The DukaPress WordPress plugin was affected by an Unauthenticated Path Traversal security vulnerability...
WP Support Plus Responsive Ticket System < 4.2 - Multiple Issues
The WP Support Plus Responsive Ticket System WordPress plugin was affected by a Multiple Issues security vulnerability...
WP Support Plus Responsive Ticket System < 4.1 - XSS
The WP Support Plus Responsive Ticket System WordPress plugin was affected by a XSS security vulnerability...
CP Multi View Event Calendar <= 1.0.1 - SQL Injection
The Calendar Event Multi View WordPress plugin was affected by a SQL Injection security vulnerability...
WP Google Maps 6.0.26 - Cross Site Scripting (XSS)
The WP Google Maps WordPress plugin was affected by a Cross Site Scripting XSS security vulnerability...
Cforms < 10.5 - XSS
The cforms WordPress plugin was affected by a XSS security vulnerability...
Google Calendar Events < 2.0.4 - XSS
The Simple Calendar – Google Calendar Plugin WordPress plugin was affected by a XSS security vulnerability...
Advanced Access Manager 2.8.2 - Admin User File Read/Write
The Advanced Access Manager WordPress plugin was affected by an Admin User File Read/Write security vulnerability...
DZS Video Gallery Plugin - RCE & More
The dzs-videogallery WordPress plugin was affected by a RCE & More security vulnerability...
All Video Gallery 1.2 - SQL Injection
The all-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability...
I Recommend This < 3.7.3 - SQL Injection
The I Recommend This WordPress plugin was affected by a SQL Injection security vulnerability...
WP-Ban < 1.64 BlackList Bypass
The WP-Ban WordPress plugin was affected by security vulnerability...
WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting (XSS)
The WooCommerce WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
WP Content Source Control <= 3.0.0 - Path Traversal
The WP Source Control WordPress plugin was affected by a Path Traversal security vulnerability...
scarlet <= 1.1.3 - XSS in ZeroClipboard.swf
The scarlet WordPress theme was affected by a XSS in ZeroClipboard.swf security vulnerability...
Pinboard 1.0.6 - includes/theme-options.php tab Parameter XSS
The Pinboard WordPress theme was affected by an includes/theme-options.php tab Parameter XSS security vulnerability...
Verification Code for Comments 2.1.0 - vcc.js.php Multiple Parameter Reflected XSS
The verification-code-for-comments WordPress plugin was affected by a vcc.js.php Multiple Parameter Reflected XSS security vulnerability...
JW Player 2.1.2 - wp-admin/admin.php Player Deletion CSRF
The jw-player-plugin-for-wordpress WordPress plugin was affected by a wp-admin/admin.php Player Deletion CSRF security vulnerability...
Yahoo Updates < 1.0 - XSS vulnerabilities in yupdates_application.php
The yahoo-updates-for-wordpress WordPress plugin was affected by a XSS vulnerabilities in yupdatesapplication.php security vulnerability...
mTouch Quiz 3.0.6 - question.php quiz Parameter SQL Injection
The mTouch Quiz WordPress plugin was affected by a question.php quiz Parameter SQL Injection security vulnerability...
LayerSlider 4.6.1 - Style Editing CSRF
The LayerSlider WordPress plugin was affected by a Style Editing CSRF security vulnerability...