Ultimate Member <= 2.0 - Multiple XSS

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple XSS security vulnerability...

Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download

The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by an Unauthenticated Subscriber Download security vulnerability. PoC POST /?es=export ... option=viewallsubscribers...

Soundy Background Music <= 3.9 - Cross-Site Scripting (XSS)

The last time it was checked the plugin was still affected and had been closed...

Dark Mode <= 1.6 - Stored XSS

The Dark Mode WordPress plugin was affected by a Stored XSS security vulnerability...

Pinterest Feed <= 1.1.1 - Authenticated XSS & CSRF

The Weblizar Pin Feeds WordPress plugin was affected by an Authenticated XSS & CSRF security vulnerability...

Testimonial Slider <= 1.2.4 - Authenticated SQL Injection

During the security analysis, ThunderScan discovered SQL injection vulnerability in Testimonial Slider WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugin...

Social Media Widget by Acurax <= 3.2.5 - Stored XSS & CSRF

The Social Media Widget by Acurax WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...

AccessPress Anonymous Post Pro < 3.2.0 - Unauthenticated Arbitrary File Upload

Improper sanitization allows the attacker to override the settings for allowed file extensions and upload file size. This allows the attacker to upload anything they want, bypassing the filters. PoC OST /wp-admin/admin-ajax.php?action=apfileuploadactionuploadernonce=nonce=php=64000 HTTP/1.1...

Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting (XSS)

The Import any XML or CSV File to WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Loginizer <= 1.3.5 - Cross-Site Request Forgery (CSRF)

Due to insufficient security checks an attacker can remove blacklisted and whitelisted IP:s from the plugin using CSRF...

Weblibrarian < 3.4.8.6 - XSS

The WebLibrarian WordPress plugin was affected by a XSS security vulnerability...

Weblibrarian < 3.4.8.5 - XSS

The WebLibrarian WordPress plugin was affected by a XSS security vulnerability...

Postman SMTP Mailer/Email Log - Cross-Site Scripting (XSS)

The postman-smtp WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Custom Sidebars < 3.0.8.1 - CSRF

The Custom Sidebars – Dynamic Widget Area Manager WordPress plugin was affected by a CSRF security vulnerability...

WP Live Chat Support < 7.0.07 - Cross-Site Scripting (XSS)

The 3CX Live Chat WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Surveys 1.01.8 - Authenticated SQL Injection

The surveys WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF

...

Ultimate Addons for Visual Composer <= 3.16.11 - Authenticated XSS, CSRF, RCE

The UltimateVCAddons WordPress plugin was affected by an Authenticated XSS, CSRF, RCE security vulnerability...

SiteBuilder Dynamic Components <= 1.0 - Unauthenticated PHP Object Injection

The plugin sitebuilder-dynamic-components insecurely trusts serialized data submitted over AJAX requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. PoC Attack is exploitable over AJAX calls sites with the sitebuilder-dynamic-components Plugin...

flickr-picture-backup <= 0.7 - Unauthenticated File Upload

The flickr-picture-backup WordPress plugin was affected by an Unauthenticated File Upload security vulnerability...

Simple Job Board <= 2.4.3 - Reflected XSS

The Simple Job Board WordPress plugin was affected by a Reflected XSS security vulnerability...

CopySafe Web Protection <= 2.5 - Cross-Site Request Forgery (CSRF)

The CopySafe Web Protection WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

Webapp builder 2.0 - Unauthenticated File Upload

Plugin is still affected and has been closed...

WordPress 4.0-4.7.2 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds

Description This can be exploited by unauthenticated users in versions 4.7 and 4.7.1 by leveraging this vulnerability https://wpvulndb.com/vulnerabilities/8734...

mobile-friendly-app-builder-by-easytouch 3.0 - Unauthenticated File Upload

Plugin is still affected and has been closed...

WordPress 4.7.0-4.7.2 - Authenticated Unintended File Deletion in Plugin Delete

...

Magic Fields <= 1.7.1 - Authenticated Cross-Site Scripting (XSS)

The magic-fields WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Gnucommerce < 1.4.2 - XSS

The GNUCommerce WordPress plugin was affected by a XSS security vulnerability...

Kama Click Counter < 3.5.0 - XSS

The Kama Click Counter WordPress plugin was affected by a XSS security vulnerability...

Vospari Forms <= 1.3 - Cross-Site Scripting (XSS)

The Vospari Forms WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress 4.5.2 - Password Change via Stolen Cookie

...

WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure

...

OneLogin SAML SSO <= 2.1.8 - Provisioned User Hardcoded Password

The OneLogin SAML SSO WordPress plugin was affected by a Provisioned User Hardcoded Password security vulnerability...

Tera Charts 1.0 - Unauthenticated Cross-Site Scripting (XSS)

The tera-charts WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/tera-charts/charts/treemap.php?fn=";alert1;...

Truemag Theme - Unauthenticated Reflected Cross-Site Scripting (XSS)

The truemag WordPress theme was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://WP/?s="%20...

Sermon Browser < 0.45.16 - Multiple XSS

The Sermon Browser WordPress plugin was affected by a Multiple XSS security vulnerability...

Pondol Form to Mail <= 1.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The pondol-formmail WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

Indexisto WordPress Site Search <= 1.0.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The indexisto WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/indexisto/assets/js/indexisto-inject.php?indexistoindex=""...

Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS)

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Ocim MP3 Plugin - Unauthenticated Reflected Cross-Site Scripting (XSS)

Credits to : Soufiane Boussali PoC http://www.example.com/wp-content/plugins/ocim-mp3/source/pages.php?id=XSSPayload...

YAWPP <= 1.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS)

The yawpp WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability. PoC POST /wordpress-4.3/?p=4 HTTP/1.1 Host: wp.lab User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.10; rv:42.0 Gecko/20100101 Firefox/42.0 Accept:...

Cool Video Gallery <= 1.9 - Authenticated Comm& Injection

The Cool Video Gallery WordPress plugin was affected by an Authenticated Comm& Injection security vulnerability...

Users Ultra Membership Plugin <= 1.5.63 - Authenticated Blind SQL Injection

The Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Websimon Tables <= 1.3.4 - Authenticated Reflected Cross-Site Scripting (XSS)

The websimon-tables WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

WordPress File Upload <= 3.4.0 - Unauthenticated Malicious File Upload

The WordPress plugin wp-file-upload does not adequately check the filetype before allowing it to be uploaded. It also uploaded files with execute permissions, allowing malicious payloads to be uploaded. PoC 1. Install wp-file-upload on a WordPress site and activate it. 2. Create an upload form on...

Payment Form for PayPal Pro <= 1.0.1 - Multiple Reflected Cross-Site Scripting (XSS)

The Payment Form for PayPal Pro WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS security vulnerability...

xPinner Lite <= 2.2 - Cross-Site Scripting (XSS) & CSRF

The xpinner-lite WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...

WP Symposium <= 15.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The wp-symposium WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/wp-symposium/getalbumitem.php?size=...

Manual Image Crop <= 1.10 - Authenticated Reflected Cross-Site Scripting (XSS)

The Manual Image Crop WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

MDC Private Message <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS)

The mdc-private-message WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...