14623 matches found
WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)
An AJAX action registered by the plugin did not have capability checks nor sanitization, allowing low privilege users subscriber+ to call it and set XSS payloads, which will be triggered in all backend pages. Version 4.5.6 fixed the XSS issue with sanitization of the parameters, but did not fix t...
Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE
The plugin allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability. Note WPScanTeam: - The issue has been escalated to Envato on March 30th, 2021 and the plugin has been removed from the...
Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR
The plugin, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the propertyid parameter. PoC GET...
Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
The wpajaxsavefbesettings and wpajaxdeletefbesettings AJAX actions of the plugin were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved. PoC CSRF to XSS CSRF to Delete settings...
Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget
In the plugin, the image box widget includes/widgets/image-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘savebuilder’ request containing JavaScript ...
wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion
The plugin has Improper Access Control. A low privilege authenticated user that visits the page where the table is published can tamper the parameters to delete the data of another user that are present in the same table through idkey and idval parameters. By exploiting this issue an attacker is...
Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct
The tutormarkanswerascorrect AJAX action from the plugin was vulnerable to blind and time based SQL injections that could be exploited by students. PoC python3 sqlmap.py -r /tutortime.txt --dbms=mysql --technique=T -p answerid --dump Where tutortime.txt is POST /wp-admin/admin-ajax.php HTTP/1.1...
VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue. PoC The PoC will be displayed once the issue has been remediated...
QuadMenu < 2.0.7 - Unauthenticated RCE via compiler_save
The compilersave AJAX action, available to both authenticated and unauthenticated users did not check the extension of the imported file, and had the nonce used for CSRF check displayed in the homepage. This could allow unauthenticated users to create an arbitrary PHP file on the blog, leading to...
All In One WP Security & Firewall < 4.4.6 - Authenticated Cross-Site Scripting (XSS)
The plugin did not escape the banned user agents in its settings before output, which may allow administrators to enter malicious UA with XSS payloads under certain conditions. Note: We were not able to reproduce the issue...
Digital Publications by Supsystic < 1.6.12 - Authenticated Path Traversal
The "Folder" tab under "Publications" is vulnerable to path traversal and exposes limited information, for example, the user can gain information regarding images stored in outside of the WordPress blog, ie, home directories. PoC Enter the following payload into the "Folder" input field of a...
LiteSpeed Cache < 3.6.1 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise invalid IPs given in its Toolbox page before displaying them in an error message. PoC Submit a payload such as in the Admin IPs section of the Toolbox /wp-admin/admin.php?page=litespeed-toolbox...
Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting
The plugin does not properly sanitise the images metadata namely title before outputting them in the generated gallery. This allows privileged accounts such as editor+ to perform XSS attacks even without the unfilteredhtml capability against users visiting the gallery in the frontend. PoC As an...
Import and export users and customers < 1.16.3.6 - CSV Injection
The plugin did not validate or sanitise user data, such as first and last names from the profile, leading to a CSV injection when the data is exported by an administrator...
Child Theme Creator by Orbisius < 1.5.2 - CSRF to Arbitrary File Modification/Creation
This flaw gave attackers the ability to forge requests on behalf of an administrator in order to modify arbitrary theme files and create new PHP files, which could allow an attacker to achieve remote code execution RCE on a vulnerable site’s server. PoC The following will create hello.php in the...
WP Floating Menu < 1.4.1 - Authenticated Reflected Cross-Site Scripting
The id GET parameter used by WP Floating menu does not correctly sanitise user input before reflecting the parameter back to the user, resulting in a reflected XSS vulnerability. Other sanitisation have been added to prevent other XSS issues as well as potential SQL injections. PoC...
Sell Media < 2.4.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field. PoC https://example.com/sell-media-search/?keyword="...
RSS Feed Widget < 2.8.1 - Authenticated Cross-Site Scripting (XSS)
The RSS Feed Widget WordPress plugin version 2.8.0 and below was vulnerable to Authenticated Cross-Site Scripting XSS within the "t" GET parameter. PoC http://www.example.com/wp-admin/admin.php?page=rfwoptions=1"...
Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download
The lack of authorisation checks in the handledownloads function, hooked to admininit could allow unauthenticated users to download arbitrary files from the blog using a path traversal payload. PoC /wp-admin/admin-post.php?algwcpifdownloadfile=../../../../../wp-config.php...
Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 - CSRF leading to XSS
A flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection. PoC...
Page Builder by SiteOrigin < 2.10.16 - CSRF to Reflected Cross-Site Scripting (XSS)
Flaws in the live editor and actionbuildercontent functions of the plugin "allow attackers to forge requests on behalf of a site administrator and execute malicious code in the administrator’s browser. The attacker needs to trick a site administrator into executing an action, like clicking a link...
Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation
The Elementor WordPress plugin could allow an authenticated user to enable Safe Mode. This could allow the user to then disable plugins, which could include security plugins, which would weaken the overall security of the site...
LearnPress < 3.2.6.7 - Privilege Escalation
Any authenticated user can change its role to an instructor/teacher and gain access to otherwise restricted data...
Registration Magic < 4.6.0.3 - Multiple Cross-Site Scripting (XSS)
The plugin is affected by an unauthenticated Stored XSS on the Contact Form which could allow attacks against administrators viewing the submissions. As well as multiple reflected XSS...
Chatbot with IBM Watson < 0.8.21 - DOM Cross-Site Scripting (XSS)
Note: The issue could be qualified of Self-XSS...
InfiniteWP Client < 1.9.4.5 - Authentication Bypass
As per agreement between the researcher and developer, details will be released on January 14th. PoC It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwpmmbsetrequest which is located in the init.php file. This checks ...
Motors Car Dealer & Classified Ads < 1.4.1 - Multiple Issues
- Unauthenticated plugin's settings import/export leading to stored XSS - Authenticated settings import - Unsanitised inputs - Authenticated options change...
HandL UTM Grabber < 2.6.5 - Authenticated Option Change via CSRF
The HandL UTM Grabber / Tracker WordPress plugin was affected by an Authenticated Option Change via CSRF security vulnerability...
Login Or Logout Menu Item <= 1.1.1 - Unauthenticated Options Change
The Login or Logout Menu Item WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...
ND Booking < 2.5 - Unauthenticated Options Change
The Hotel Booking WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...
WPS Child Themes Generator <= 1.1 - Path Traversal
The WPS Child Theme Generator WordPress plugin was affected by a Path Traversal security vulnerability...
WP Code Highlight.js < 0.6.3 - CSRF to Stored XSS
Lack of CSRF checks could allow attackers to make a logged in admin create XSS payloads. PoC...
Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS
Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' PoC The payload will be triggered in all pages with a booking form...
Admin Renamer Extender <= 3.2.1 - CSRF
CSRF leading to arbitrary username change...
Easy Pdf Restaurant Menu Upload < 1.2 - XSS
The Easy PDF Restaurant Menu Upload WordPress plugin was affected by a XSS security vulnerability...
JobCareer < 2.5.1 - Authenticated Stored Cross-Site Scripting
Bad input fields data filtering has been discovered in the 'JobCareer | Job Board Responsive WordPress Theme'. PoC http://jobcareer.chimpgroup.com/candidate/asdasdasdasdasd/ Register a new account on the demo website: http://jobcareer.chimpgroup.com/ , then go to the «Resume» profile tab:...
Forminator <= 1.5.4 - Authenticated Multiple Vulnerabilities
The Forminator – Contact Form, Payment Form & Custom Form Builder WordPress plugin was affected by an Authenticated Multiple Vulnerabilities security vulnerability...
Contact Form Email <= 1.2.65 - Multiple Cross-Site Scripting (XSS) & CSRF
The Contact Form Email WordPress plugin was affected by a Multiple Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=cpcontactformtoemail=1=1='"...
WP Ultimate Exporter < 1.4.2 - CSRF
The Export WordPress Data with Advanced Filters WordPress plugin was affected by a CSRF security vulnerability...
WordPress <= 5.0 - Authenticated Post Type Bypass
Description According to WordPress: "Simon Scannell of RIPS Technologies discovered that authors could create posts of unauthorized post types with specially crafted input."...
JobCareer < 2.4.1 - User enumeration & Reset password
The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...
Arigato Autoresponder and Newsletter <= 2.5.1.8 - Authenticated Blind SQL Injection & Multiple XSS
The Arigato Autoresponder and Newsletter WordPress plugin was affected by an Authenticated Blind SQL Injection & Multiple XSS security vulnerability...
Ninja Forms <= 3.3.17 - Unauthenticated Cross-Site Scripting (XSS)
According to the changelog: "Patched a redirect XSS vulnerability using code injection on our submissions page."...
WooCommerce <= 3.4.5 - Authenticated File Deletion to Privilege Escalation
Attackers in control of a user with the shop manager role can delete certain files on the server and then take over any victim account...
File Manager < 3.1 - CSRF to Stored Cross-Site Scripting
The plugin is lacking CSRF as well as sanitisation checks, allowing attackers to perform CSRF attacks against logged in administrators and set an XSS payload in the publicpath setting. PoC...
WooCommerce <= 3.4.4 - Potential Object Injection
According to WooCommerce: "Versions 3.4.4 and earlier are affected by an issue where a function that updates attributes could lead to object injection. This is related to the WordPress 4.8.3 security release. This issue can only be exploited by users who can edit attributes and should not be...
Gift Voucher <= 4.1.1 - Unauthenticated Blind SQL Injection
The wpgvdoajaxfronttemplate AJAX action both authenticated and unauthenticated, defined in the front.php does not sanitised, validate or escape the templateid parameter before using it in a SQL statement, leading to a SQL Injection issue. This has been present since at least 1.0.5 v4.1.0 tried to...
Membermouse < 2.2.9 - Blind SQL Injection
Note: It seems like the affected plugin is the premium version from https://membermouse.com, the free one has been closed as of v1.2.0...
Caldera Forms <= 1.5.9.1 - Multiple Cross-Site Scripting (XSS)
The Caldera Forms – More Than Contact Forms WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...