14652 matches found
Ninja Forms < 3.4.24.2 - CSRF to Stored XSS
Ramuel Gall of Wordfence discovered a Cross-Site Request ForgeryCSRF plugin vulnerability within the Ninja Forms WordPress plugin. By exploiting the CSRF vulnerability, an attacker could inject arbitrary malicious JavaScript via the import contact feature. This vulnerability was reportedly fixed ...
Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion
The Media Library Assistant plugin before 2.82 for WordPress suffers from a Local File Inclusion vulnerability in mlagallery link=download. PoC The LFI is restricted to the "wp-content" directory...
IMPress for IDX Broker < 2.6.2 - Authenticated Post Creation, Modification, and Deletion
This plugin registers 2 AJAX actions intended to create and delete "dynamic pages," intended to ensure that any IDX pages match the site’s style and branding. Neither of the functions called by these AJAX actions used capability checks or nonce checks. As such it was possible for an authenticated...
LearnPress < 3.2.6.7 - Privilege Escalation
Any authenticated user can change its role to an instructor/teacher and gain access to otherwise restricted data...
Popup Builder < 3.0 - SQL injection via PHP Deserialization
The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution...
Chatbot with IBM Watson < 0.8.21 - DOM Cross-Site Scripting (XSS)
Note: The issue could be qualified of Self-XSS...
InfiniteWP Client < 1.9.4.5 - Authentication Bypass
As per agreement between the researcher and developer, details will be released on January 14th. PoC It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwpmmbsetrequest which is located in the init.php file. This checks ...
ListingPro < 2.0.14.5 - Reflected & Persistent Cross-Site Scripting
Reflected & Persistent XSS was discovered in the 'ListingPro - WordPress Directory Theme'. Current version is 2.0.14.2 August 9th 2019. Edit WPScanTeam: November 29th, 2019 - Envato Informed November 29th, 2019 - Envato Investigating December 4th, 2019 - v2.0.14.3 Released, fixing the reflected X...
SlickQuiz <= 1.3.7.1 - Authenticated SQL Injection
The last time it was checked the plugin was still affected and had been closed...
Give <= 2.5.0 - SQL Injection
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php or...
PPOM for WooCommerce <= 18.3 - Authenticated Stored XSS
The PPOM for WooCommerce WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...
OneSignal Web Push Notifications - Stored XSS
The OneSignal – Web Push Notifications WordPress plugin was affected by a Stored XSS security vulnerability...
WP Code Highlight.js < 0.6.3 - CSRF to Stored XSS
Lack of CSRF checks could allow attackers to make a logged in admin create XSS payloads. PoC...
Ad Inserter <= 2.4.19 - Authenticated Path Traversal
Edit WPScanTeam: Even though the original advisory mentions that it only affect accounts with the administrator privilege, subscriber accounts and above can exploit the issue, as the nonce can be retrieved when submitting a request with a specific cookie, as described at...
Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)
It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. PoC POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac ...
WP Like Button <= 1.6.0 - Auth Bypass
Authentication Bypass vulnerability in the WP Like Button Free plugin version 1.6.0 allows unauthenticated attackers to change the settings of the plugin. The contains function in wplikebutton.php did not check if the current request is made by an authorized user, thus allowing any unauthenticate...
Breadcrumbs by menu <= 1.0.1 - Multiple Issues
XSS, CSRF leading to options update...
WP Booking System <= 1.5.1.1 - CSRF to Authenticated SQL Injection
According to the original researcher, no CSRF nonces were present and therefore could be exploited by chaining with the CSRF issue...
Ultimate Faqs < 1.8.22 - Cross-Site Scripting (XSS)
The Ultimate FAQ – WordPress Q Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Carts Guru <= 1.4.4 - Unauthenticated Object Injection
The Carts Guru WordPress plugin was affected by an Unauthenticated Object Injection security vulnerability...
W3 Total Cache < 0.9.7.3 - Cryptographic Signature Bypass
The return value of opensslverify is not properly validated, which allows to bypass the cryptographic check...
My Calendar <= 3.1.9 - Unauthenticated Cross-Site Scripting (XSS)
Triggered via unescaped usage of URL parameters in multiple locations presented in the public view of a site. PoC http://www.domain.de/?rsd=%27%3E%3Csvg%2Fonload%3Dconfirm%2FOPENBUGBOUNTY%2F%3E...
CarSpot Theme <= 2.1.6 - Authenticated Stored XSS
Bad input field data filtering has been discovered in the 'CarSpot – Automotive Car Dealer Wordpress Classified Theme'. Current version of this Premium Theme is 2.1.5. PoC Authorize on the demo website for tests: https://carspot.scriptsbundle.com/, login is [email protected] and passow...
Forminator <= 1.5.4 - Authenticated Multiple Vulnerabilities
The Forminator – Contact Form, Payment Form & Custom Form Builder WordPress plugin was affected by an Authenticated Multiple Vulnerabilities security vulnerability...
NextScripts: Social Networks Auto-Poster < 4.2.8 - Authenticated Reflected Cross-Site Scripting (XSS)
The NextScripts: Social Networks Auto-Poster WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...
WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)
Description According to WordPress: "Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability."...
WooCommerce <= 3.4.5 - Authenticated Phar Deserialization
The WooCommerce WordPress plugin was affected by an Authenticated Phar Deserialization security vulnerability...
Arigato Autoresponder and Newsletter <= 2.5.1.8 - Authenticated Blind SQL Injection & Multiple XSS
The Arigato Autoresponder and Newsletter WordPress plugin was affected by an Authenticated Blind SQL Injection & Multiple XSS security vulnerability...
WP GDPR Compliance <= 1.4.2 - Unauthenticated Call Any Action or Update Any Option
The plugin WP GDPR Compliance allows unauthenticated users to execute any action and to update any database value. If the request data form is available for unauthenticated users, even unauthenticated users are able to do this. See references for discussion of the issue. The problem is in the fil...
ARForms < 3.5.2 - Unauthenticated Arbitrary File Deletion
The arforms WordPress plugin was affected by an Unauthenticated Arbitrary File Deletion security vulnerability...
WooCommerce <= 3.4.5 - Authenticated File Deletion to Privilege Escalation
Attackers in control of a user with the shop manager role can delete certain files on the server and then take over any victim account...
Localize My Post 1.0 - Unauthenticated Local File Inclusion (LFI)
The localize-my-post WordPress plugin was affected by an Unauthenticated Local File Inclusion LFI security vulnerability. PoC http://www.example.com/wp-content/plugins/localize-my-post/ajax/include.php?file=../../../../../../../../../../etc/passwd...
File Manager < 3.1 - CSRF to Stored Cross-Site Scripting
The plugin is lacking CSRF as well as sanitisation checks, allowing attackers to perform CSRF attacks against logged in administrators and set an XSS payload in the publicpath setting. PoC...
WooCommerce <= 3.4.4 - Potential Object Injection
According to WooCommerce: "Versions 3.4.4 and earlier are affected by an issue where a function that updates attributes could lead to object injection. This is related to the WordPress 4.8.3 security release. This issue can only be exploited by users who can edit attributes and should not be...
Gift Voucher <= 4.1.1 - Unauthenticated Blind SQL Injection
The wpgvdoajaxfronttemplate AJAX action both authenticated and unauthenticated, defined in the front.php does not sanitised, validate or escape the templateid parameter before using it in a SQL statement, leading to a SQL Injection issue. This has been present since at least 1.0.5 v4.1.0 tried to...
Gwolle Guestbook <= 2.5.3 - Cross-Site Scripting (XSS)
The Gwolle Guestbook WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
All In One Favicon <= 4.6 - Multiple Stored Authenticated XSS
Authenticated Stored Cross-Site Scripting XSS in 8 parameters: backendApple-Text backendGIF-Text backendICO-Text backendPNG-Text frontendApple-Text frontendGIF-Text frontendICO-Text frontendPNG-Text PoC " "...
iThemes Security <= 7.0.2 - Authenticated SQL Injection
The iThemes Security better-wp-security plugin before 7.0.3 for WordPress allows SQL Injection by attackers with Admin privileges via the logs page. Vulnerability description: iThemes Security appears to be vulnerable to time-based SQL-Injection. Parameter orderby is vulnerable because backend...
Open Graph for Facebook, Google+ and Twitter Card Tags <= 2.2.4 - Authenticated Reflected XSS
There is a reflected XSS vulnerability caused by "Open Graph for Facebook, Google+ and Twitter Card Tags" in the wdfbogerror parameter on a GET request when editing a post. This can be exploited by tricking an authenticated Wordpress administrator into clicking a malicious link. This vulnerabilit...
Membermouse < 2.2.9 - Blind SQL Injection
Note: It seems like the affected plugin is the premium version from https://membermouse.com, the free one has been closed as of v1.2.0...
ProfileGrid – User Profiles, Groups and Communities <= 2.8.5 - Authenticated Code Execution
The plugin ProfileGrid – User Profiles, Groups and Communities versions prior to 2.8.6 is vulnerable to Arbitrary Code Execution. An authenticated user with a role as low as Subscriber can execute arbitrary PHP code on websites using the plugin. PoC Send an authenticated POST request to...
WordPress 3.7-4.9.4 - Escape Version in Generator Tag
Description Make sure the version string is correctly escaped for use in generator tags...
Relevanssi <= 4.0.4 - Cross-Site Scripting (XSS)
The Relevanssi – A Better Search WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Super Socializer <= 7.10.6 - Authentication Bypass
You can log in to the site with any user if you know the user's email address. PoC // Steps: // Fill this 3 variable var url = 'http://my-site.com/wordpress/', //website url. Closing slash required email = '[email protected]', //The admin email address to exploit nonce = 'e86377d05a'; // View...
Ultimate Member <= 2.0 - Multiple XSS
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple XSS security vulnerability...
Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download
The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by an Unauthenticated Subscriber Download security vulnerability. PoC POST /?es=export ... option=viewallsubscribers...
Soundy Background Music <= 3.9 - Cross-Site Scripting (XSS)
The last time it was checked the plugin was still affected and had been closed...
Dark Mode <= 1.6 - Stored XSS
The Dark Mode WordPress plugin was affected by a Stored XSS security vulnerability...
Pinterest Feed <= 1.1.1 - Authenticated XSS & CSRF
The Weblizar Pin Feeds WordPress plugin was affected by an Authenticated XSS & CSRF security vulnerability...
Testimonial Slider <= 1.2.4 - Authenticated SQL Injection
During the security analysis, ThunderScan discovered SQL injection vulnerability in Testimonial Slider WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugin...