14629 matches found
Email Subscribers & Newsletters < 4.5.1 - Cross-site Request Forgery in send_test_email()
An attacker could exploit this issue by convincing a user to click a specially crafted URL, which will send emails from the affected user’s WordPress email account. PoC https://github.com/tenable/poc/blob/master/WordPress/plugins/Icegram/emailsubscribersandnewsletters/csrfpoc.html...
Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection
SQL Injection in the Blog2Social plugin 6.3.0 for WordPress exists via Re-Share Posts feature. PoC Please refer to the video below for steps to reproduce and demonstration of automatic exploit with sqlmap. - Mega.nz: https://mega.nz/file/mt1gFYTKe3XkA-zY0cCApTYlLZktRZ4Q4vchVhbPsNqQC6CKORo -...
Login/Signup Popup < 1.5 - Authenticated Stored Cross-Site Scripting (XSS)
A lack of capability checks and security nonce allows any authenticated user to inject, via the AJAX API, JavaScript code into the plugin’s settings and to use it to target the administrator in the backend of WordPress. The vulnerability has been exploited for a couple of days...
Elementor Pro < 2.9.4 - Authenticated Arbitrary File Upload
According to Jerome Bruandet, from NintechNet, the vulnerability, currently exploited by attackers, allows any logged-in user to upload and execute PHP scripts on the blog. Chloe Chamberland from Wordfence also confirmed the issue and added that "This vulnerability is being used in conjunction wi...
Elementor Page Builder < 2.9.6 - Authenticated Safe Mode Privilege Escalation
The Elementor WordPress plugin could allow an authenticated user to enable Safe Mode. This could allow the user to then disable plugins, which could include security plugins, which would weaken the overall security of the site...
IMPress for IDX Broker < 2.6.2 - Authenticated Post Creation, Modification, and Deletion
This plugin registers 2 AJAX actions intended to create and delete "dynamic pages," intended to ensure that any IDX pages match the site’s style and branding. Neither of the functions called by these AJAX actions used capability checks or nonce checks. As such it was possible for an authenticated...
CardGate < 3.1.16 - Unauthorised Payments Hijacking and Order Status Spoofing
Lack of origin authentication CWE-346 at IPN callback processing function allow even unauthorized attacker to remotely replace critical plugin settings merchant id, secret key etc with known to him and therefore bypass payment process eg. spoof order status by manually sending IPN callback reques...
wpCentral < 1.5.1 - Improper Access Control to Privilege Escalation
The flaw allowed anybody to escalate their privileges to those of an administrator, as long as subscriber-level registration was enabled on a given WordPress site with the vulnerable plugin installed. PoC 1. Log in as Subscriber. 2. Scrape the page /wp-admin/index.php for the connection key. i.e...
GDPR Cookie Consent < 1.8.3 - Improper Access Controls
Improper Access Controls issue in the clipolicygenerator AJAX call which could allow an authenticated user with low privileges such as a subscriber to: - Change the status of any post/page from published to draft, removing them from the frontend of the blog. - Put a payload in the content of one...
Chatbot with IBM Watson < 0.8.21 - DOM Cross-Site Scripting (XSS)
Note: The issue could be qualified of Self-XSS...
WP Database Reset < 3.15 - Privilege Escalation
This flaw "allowed any authenticated user, even those with minimal permissions, the ability to grant their account administrative privileges while dropping all other users from the table with a simple request." PoC Login as a subscriber then send the following request:...
bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - CSRF to Stored XSS
Lack of CSRF checks in the plugin's settings allow arbitrary change of the settings, which can also lead to stored XSS issues. PoC The payload below will result in a stored XSS in the 'Style Customize' page...
Login Or Logout Menu Item <= 1.1.1 - Unauthenticated Options Change
The Login or Logout Menu Item WordPress plugin was affected by an Unauthenticated Options Change security vulnerability...
WP Code Highlight.js < 0.6.3 - CSRF to Stored XSS
Lack of CSRF checks could allow attackers to make a logged in admin create XSS payloads. PoC...
Appointment Booking Calendar < 1.3.19 - Unauthenticated Stored XSS
Lack of authorisation check in the cpabcappointmentssaveedition function can lead to stored XSS via the editionarea parameter when cfwppedit is set to 'js' or 'css' PoC The payload will be triggered in all pages with a booking form...
Admin Renamer Extender <= 3.2.1 - CSRF
CSRF leading to arbitrary username change...
Easy Pdf Restaurant Menu Upload < 1.2 - XSS
The Easy PDF Restaurant Menu Upload WordPress plugin was affected by a XSS security vulnerability...
WP Slimstat <= 4.8 - Unauthenticated Stored XSS from Visitors
This vulnerability allows a visitor to inject arbitrary JavasScript code on the plugin access log functionality, which is visible both on the plugin’s access log page and on the admin dashboard index—‚ the default page shown once you log in...
JobCareer < 2.5.1 - Authenticated Stored Cross-Site Scripting
Bad input fields data filtering has been discovered in the 'JobCareer | Job Board Responsive WordPress Theme'. PoC http://jobcareer.chimpgroup.com/candidate/asdasdasdasdasd/ Register a new account on the demo website: http://jobcareer.chimpgroup.com/ , then go to the «Resume» profile tab:...
Forminator <= 1.5.4 - Authenticated Multiple Vulnerabilities
The Forminator – Contact Form, Payment Form & Custom Form Builder WordPress plugin was affected by an Authenticated Multiple Vulnerabilities security vulnerability...
WP Google Maps <= 7.10.41 - Cross-Site Scripting (XSS)
The WP Google Maps WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Wise Chat <= 2.6.3 - Reverse Tabnabbing
The Wise Chat WordPress plugin was affected by a Reverse Tabnabbing security vulnerability...
MapSVG Lite <= 3.2.3 - Cross-Site Request Forgery (CSRF)
CSRF in the mapsvgsave AJAX method PoC...
WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)
Description According to WordPress: "Tim Coen discovered that contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting vulnerability."...
JobCareer < 2.4.1 - User enumeration & Reset password
The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...
Ninja Forms <= 3.3.17 - Unauthenticated Cross-Site Scripting (XSS)
According to the changelog: "Patched a redirect XSS vulnerability using code injection on our submissions page."...
File Manager < 3.1 - CSRF to Stored Cross-Site Scripting
The plugin is lacking CSRF as well as sanitisation checks, allowing attackers to perform CSRF attacks against logged in administrators and set an XSS payload in the publicpath setting. PoC...
WooCommerce <= 3.4.4 - Potential Object Injection
According to WooCommerce: "Versions 3.4.4 and earlier are affected by an issue where a function that updates attributes could lead to object injection. This is related to the WordPress 4.8.3 security release. This issue can only be exploited by users who can edit attributes and should not be...
Gwolle Guestbook <= 2.5.3 - Cross-Site Scripting (XSS)
The Gwolle Guestbook WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Membermouse < 2.2.9 - Blind SQL Injection
Note: It seems like the affected plugin is the premium version from https://membermouse.com, the free one has been closed as of v1.2.0...
Caldera Forms <= 1.5.9.1 - Multiple Cross-Site Scripting (XSS)
The Caldera Forms – More Than Contact Forms WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
Duplicator <= 1.2.32 - Cross-Site Scripting (XSS)
The Duplicator – WordPress Migration Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Pinterest Feed <= 1.1.1 - Authenticated XSS & CSRF
The Weblizar Pin Feeds WordPress plugin was affected by an Authenticated XSS & CSRF security vulnerability...
Testimonial Slider <= 1.2.4 - Authenticated SQL Injection
During the security analysis, ThunderScan discovered SQL injection vulnerability in Testimonial Slider WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugin...
Dbox 3D Slider Lite <= 1.2.2 - Multiple Authenticated SQL injection
During the security analysis, ThunderScan discovered SQL injection vulnerabilities in Dbox 3D Slider Lite WordPress plugin. The easiest way to reproduce the vulnerabilities is to modify the POST request for the slider rename or reorder and append parts of the SQL query to the currentsliderid...
Football Pool < 2.6.5 - Multiple XSS
The Football Pool WordPress plugin was affected by a Multiple XSS security vulnerability...
Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting (XSS)
The Import any XML or CSV File to WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Loginizer <= 1.3.5 - Cross-Site Request Forgery (CSRF)
Due to insufficient security checks an attacker can remove blacklisted and whitelisted IP:s from the plugin using CSRF...
Popup Maker <= 1.6.4 - Authenticated Cross-Site Scripting (XSS)
The Popup Maker – Popup Forms, Opt-ins & More WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
Postman SMTP Mailer/Email Log - Cross-Site Scripting (XSS)
The postman-smtp WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Easy Team Manager 1.3.2 - Authenticated Blind SQL Injection
The easy-team-manager WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...
eventr 1.02.2 - Blind SQL Injection
The eventr WordPress plugin was affected by a Blind SQL Injection security vulnerability...
Ultimate Addons for Visual Composer <= 3.16.11 - Authenticated XSS, CSRF, RCE
The UltimateVCAddons WordPress plugin was affected by an Authenticated XSS, CSRF, RCE security vulnerability...
SiteBuilder Dynamic Components <= 1.0 - Unauthenticated PHP Object Injection
The plugin sitebuilder-dynamic-components insecurely trusts serialized data submitted over AJAX requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. PoC Attack is exploitable over AJAX calls sites with the sitebuilder-dynamic-components Plugin...
BuddyPress Docs <= 1.9.2 - Authenticated Lack of Authorisation
The BuddyPress Docs WordPress plugin was affected by an Authenticated Lack of Authorisation security vulnerability...
Adminer <= 1.4.5 - Security Bypass
The plugin is still affected and has been closed. PoC https://example.com/wp-content/plugins/adminer/inc/editor/index.php...
Magic Fields <= 1.7.1 - Authenticated Cross-Site Scripting (XSS)
The magic-fields WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
rockhoist-badges 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS)
The rockhoist-badges WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...