14608 matches found
Share One Drive < 1.15.3 - Reflected Cross-Site Scripting
Insufficient Input Validation in the search functionality of the plugin allows attackers to perform a reflected Cross-Site Scripting attack...
tarteaucitron.js - Cookies legislation & GDPR < 1.6 - CSRF to Stored Cross-Site Scripting
The plugin does not have CSRF check in place in its settings, as well as does not sanitise and escape them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks against them...
Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module
The plugin does not sanitise and escape the wcjdeleterole parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue PoC The "General" module needs to be enabled in "Woocommerce - Booster Settings - Booster"...
Hide My WP < 6.2.4 - Unauthenticated Plugin Deactivation
The plugin does not have any authorisation check when outputing a reset token, which could then be used to deactivate the plugin via another request...
Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the gwollegbuseremail parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page PoC...
Icegram < 2.0.5 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the messageid parameter of the getmessageactionrow AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue PoC The XSS will be triggered when moving the mouse over the text in the response...
WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF
The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack. PoC...
WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
The plugin does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfilteredhtml capability is disallowed. PoC 1. Add a new Import at "New Import", upload a random.tx...
Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting
The plugin does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Create a table, add a column with the following payload " as Name, then add data with the...
Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF
The plugin allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks Po...
Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC As an admin, create or edit a Forminator form, add an email field and put the following payload in the label...
Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
The plugin does not have capability and CSRF checks in the dpwappluginactivate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed. PoC v 1.5.9 - jQuery.postajaxurl, action:"dpwappluginactivate", dpwapurl:"hello.php" v 1.6.0 -...
Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in any of the plugin's settings with a text input: - v - v "Redirected to...
Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)
The plugin does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion PoC The PoC varies based on the endpoint targeted. Here is one example that will modify the...
Leaky Paywall <= 4.16.5 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the /class.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where unfilteredhtml is disabled for...
Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF
The plugin does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack PoC...
Brizy < 2.3.12 - Authenticated File Upload and Path Traversal
Using the brizycreateblockscreenshot AJAX action, it was possible to provide a filename using the id parameter, and populate the file contents via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin appended .jpg to all uploaded filenames, a double extensio...
WP Cloudy < 4.4.9 - Admin+ SQL Injection
The plugin does not escape the postid parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue PoC The first digits of the post parameter must be a valid Post ID Weather post or not...
Quiz Tool Lite <= 2.3.15 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC 1. When creating a new Question Pot, you can...
wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...
Affiliate Manager < 2.8.7 - Admin+ SQL injection
The plugin does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue PoC POST /wp-admin/admin.php?page=wpam-affiliates=exportdata=if=0,1,SLEEP10 HTTP/1.1 Accept:...
Post Content XMLRPC <= 1.0 - Admin+ SQL Injections
The plugin does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections PoC https://example.com/wp-admin/admin.php?page=pcxaddsites=add=1%20AND%20SELECT%207953%20FROM%20SELECTSLEEP5AgUn...
Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting
The plugin does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC PoC 1: This requires Firefox due to onclick+accesskey trick on hidden input. There is...
Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update
The plugin does not have proper authorisation nor CSRF checks in the saveglobalsetting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which wi...
Stripe For WooCommerce 3.0.0 - 3.3.9 - Missing Authorization Controls to Financial Account Hijacking
The plugin is missing a capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts...
Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site Scripting
The plugin does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Click on "Add New" under Restaurant Menu Plugin. Give any random title like...
Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfilteredhtml capability is disallowed PoC Create a new Form via the plugin, fill it with any values. In the next step, change the Form nam...
Cookie Bar <= 1.8.8 - Admin+ Stored Cross-Site Scripting
The plugin doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Add the following payload in the "Cookie Bar Message" setting of the plugin...
St Daily Tip <= 4.7 - CSRF to Stored Cross-Site Scripting
The plugin does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to ...
WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site Scripting
The plugin is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack. PoC...
Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. PoC scembedplayer fileurl='" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alertorigin//'...
DJ EmailPublish <= 1.7.2 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /dj-email-publish.php file which allows attackers to inject arbitrary web scripts...
WooCommerce Payment Gateway Per Category <= 2.0.10 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /includes/pluginsettings.php file which allows attackers to inject arbitrary web scripts...
OSD Subscribe <= 1.2.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the osdsubscribemessage parameter found in the /options/osdsubscribeoptionssubscribers.php file which allows attackers to inject arbitrary web scripts...
On Page SEO + Whatsapp Chat Button < 1.0.2 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /settings.php file which allows attackers to inject arbitrary web scripts...
WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting
The plugin does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payloads in the mentioned settings of the plugin: - How to display the...
CoolClock < 4.3.5 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks PoC As a user with a role as low as contributor, put the following shortcode in a post/page and view/preview it to trigger the XSS which is specific...
Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
The plugin does not escape the IP addresses which can be controlled by attacker via headers such as X-Forwarded-For of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue. PoC POST /wp-login.php HTTP/1.1 Accept:...
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
The plugin does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server. PoC As an authenticated user, with a role as low as subscriber, viewing the admin the dashboard...
WP-Board <= 1.1 (beta) - Unauthenticated SQL Injection
The options.php file of the plugin accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it take...
The Sorter <= 1.0 - Authenticated SQL Injection
The checkorder function of the plugin uses an areaid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC GET /wp-admin/admin.php?page=thesorterareasid=1%20AND%20SELECT%207667%20FROM%20SELECTSLEEP5DWBj HTTP/1.1 Cache-Control:...
Language Bar Flags <= 1.0.8 - CSRF to Stored XSS
The plugin does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in t...
Plugmatter Pricing Table Lite <= 1.0.32 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the email parameter in the /license.php file which allows attackers to inject arbitrary web scripts...
Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC In the admin dashboard navigate to Services Add service and put the...
Stop Spammers Security < 2021.18 - Authenticated Stored XSS
The plugin does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfilteredhtml capability is disallowed PoC Put the following payload in any of the API field of the Web Services settings: " autofocus...
Availability Calendar < 1.2.1 - Authenticated SQL Injection
The plugin does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+ PoC With an account role as low as contributor, put the followin...
FluentSMTP < 2.0.1 - Authenticated Stored XSS
The plugin does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting XSS vulnerability. Only users with roles capable of managin...
Poll Maker < 3.2.9 - Reflected Cross-Site Scripting
The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8. PoC...
uListing < 2.0.6 - Unauthenticated Privilege Escalation
An Unauthenticated Privilege Escalation vulnerability was discovered in the uListing plugin through v2.0.5 for WordPress. User registration must be allowed on the target website. PoC PoC | Unauthenticated Privilege Escalation | Request: POST /wp-admin/admin-ajax.php?action=stmlistingregister HTTP...
uListing < 2.0.4 - Unauthenticated SQL Injection
An Unauthenticated SQL Injection vulnerability was discovered in the plugin. Vulnerable parameters: custom. SQL Injection types: Error-based, Boolean-based Blind, Time-based Blind. PoC PoC 1 | Unauthenticated SQL Injection | Tables: sqlmap...