14621 matches found
WordPress File Upload <= 2.7.6 - Multiple Vulnerabilities
The plugin allows upload of file extensions that may lead to code execution, such as php4 or php5. Additionally, it allows an admin user to rename files and thus change the extension of uploaded files, leading to code execution. There is no CSRF protection for this. The plugin also allows for the...
Events Manager < 5.5.7.1 - DOM Cross-Site Scripting (XSS)
The Events Manager WordPress plugin was affected by a DOM Cross-Site Scripting XSS security vulnerability...
Estrutura-Basica - Local File Download
The estrutura-basica WordPress theme was affected by a Local File Download security vulnerability...
Exquisite Ultimate Newspaper Theme <= 1.3.3 - DOM Cross-Site Scripting (XSS)
The exquisite-wp WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/...
WP Symposium <= 15.1 - SQL Injection
The wp-symposium WordPress plugin was affected by a SQL Injection security vulnerability...
Community Events <= 1.3.5 - SQL Injection
The Community Events WordPress plugin was affected by a SQL Injection security vulnerability...
All in One SEO Pack <= 2.2.5.1 - Information Disclosure
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code...
Captcha <= 4.0.6 - Captcha Bypass
The captcha WordPress plugin was affected by a Captcha Bypass security vulnerability...
EasyCart 1.1.30 - 3.0.20 - Privilege Escalation
Due to a lack of validation in the ecajaxupdateoption and ecajaxclearalltaxrates functions located in /inc/admin/adminajaxfunctions.php, it is possible to update any WordPress option as an authenticated non-admin user, which can in turn lead to privilege escalation and remote code execution...
EasyCart <= 3.0.15 - Unrestricted File Upload
In versions = 3.0.8 this can be exploited by authenticating as any WordPress user, and in versions 3.0.9 - 3.0.15 can be exploited by passing a valid password hash being used by any admin in the EasyCart user system...
Pixabay Images <= 2.3 - Multiple Vulnerabilities (RCE, XSS, ...)
1 Authentication bypass The plugin does not correctly check if the user is logged in. Certain code can be called without authentication 2 Arbitrary file upload The plugin code does not validate the host in the provided download URL, which allows to upload malicious files, including PHP code. 3 Pa...
Our Team Showcase 1.2 - CSRF & XSS
The Our Team Showcase WordPress plugin was affected by a CSRF & XSS security vulnerability...
Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting (XSS)
The Frontend Uploader WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://localhost:8080/?pageid=0&fu-disallowed-mime-type0name=%3CSCRIPT%20SRC=http://ha.ckers.org/xss.js?%3C%20B%20%3E...
Tweetscribe <= 1.1 - Multiple CSRF
Plugin is still affected and has been closed...
Simple Visitor Stat <= 1.0 - Multiple XSS
Plugin is still affected and has been closed...
Cardoza Facebook Like Box < 2.8.3 - Multiple CSRF
The Easy Social Like Box – Popup – Sidebar Widget WordPress plugin was affected by a Multiple CSRF security vulnerability...
Simple Ip Ban <= 1.2.3 - Multiple CSRF
The IP Ban WordPress plugin was affected by a Multiple CSRF security vulnerability...
Paid Memberships Pro 1.7.14.2 - Path Traversal
The Paid Memberships Pro WordPress plugin was affected by a Path Traversal security vulnerability...
Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)
The Contact Form Integrated With Google Maps WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
Cforms < 10.5 - XSS
The cforms WordPress plugin was affected by a XSS security vulnerability...
Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS)
The contact-form-7-to-database-extension WordPress plugin was affected by a 2 x Cross-Site Scripting XSS security vulnerability...
BulletProof Security <= .50.8 - Script Insertion
The BulletProof Security WordPress plugin was affected by a Script Insertion security vulnerability...
Classic 1.5 - PHP_SELF XSS
The Classic WordPress theme was affected by a PHPSELF XSS security vulnerability...
HK Exif Tags 1.11 - hk_exif_tags.php hk_exif_tags_images_process Function EXIF Tags H&ling Stored XSS
The HK Exif Tags WordPress plugin was affected by a hkexiftags.php hkexiftagsimagesprocess Function EXIF Tags H Stored XSS security vulnerability...
Under Construction 1.08 - Setting Manipulation CSRF
The underConstruction WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
Xorbin Digital Flash Clock 1.0 - Flash-based XSS
The xorbin-digital-flash-clock WordPress plugin was affected by a Flash-based XSS security vulnerability...
wp-cleanfix - Remote Comm& Execution, CSRF & XSS
The WP CleanFix WordPress plugin was affected by a Remote Comm& Execution, CSRF & XSS security vulnerability...
Social Media Widget 4.0 - social-widget.php MITM Weakness Arbitrary Code Injection
The Social Media Widget WordPress plugin was affected by a social-widget.php MITM Weakness Arbitrary Code Injection security vulnerability...
coupon-code-plugin <= 2.1 - XSS in ZeroClipboard
The coupon-code-plugin WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
buckets <= 0.1.9.2 - XSS in ZeroClipboard
The Buckets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
mobileview <= 1.0.7 - XSS in ZeroClipboard
The mobileview WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Events Manager 5.3.3 - Multiple Cross-Site Scripting (XSS)
The Events Manager WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
Portable phpMyAdmin 1.4.1 - Multiple Script Direct Request Authentication Bypass
The portable-phpmyadmin WordPress plugin was affected by a Multiple Script Direct Request Authentication Bypass security vulnerability...
Google Document Embedder 2.4.6 - pdf.php file Parameter Arbitrary File Disclosure
The Google Doc Embedder WordPress plugin was affected by a pdf.php file Parameter Arbitrary File Disclosure security vulnerability...
RokBox <= 2.13 - error_log Direct Request Error Log Information Disclosure
The wprokbox WordPress plugin was affected by an errorlog Direct Request Error Log Information Disclosure security vulnerability...
Wordpress 2.5 - Cookie Integrity Protection
...
Advanced Dewplayer <= 1.2 - download-file.php dew_file Parameter Traversal Arbitrary File Access
The Advanced Dewplayer WordPress plugin was affected by a download-file.php dewfile Parameter Traversal Arbitrary File Access security vulnerability...
Wordpress <= 1.5.1.3 - Remote Code Execution
...
slidedeck2 < 2.1.20130313 - XSS in ZeroClipboard
The SlideDeck 2 Lite Responsive Content Slider WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability. PoC /wp-content/plugins/slidedeck2/js/zeroclipboard/ZeroClipboard.swf?id="catcheif!self.aself.a=!alertdocument.cookie//...
Video Posts Webcam Recorder < 1.55.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Video Posts Webcam Recorder WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. PoC https://example.com/wp-content/plugins/video-posts-webcam-recorder/posts/videowhisper/rlogout.php?message=message'//...
Spreadsheet <= 0.6 - SQL Injection
The wpSS WordPress plugin was affected by a SQL Injection security vulnerability...
Simple Share Buttons Adder 4.4 - options-general.php Multiple Admin Actions CSRF
The Simple Share Buttons Adder WordPress plugin was affected by an options-general.php Multiple Admin Actions CSRF security vulnerability...
WP Tmkm Amazon <= 1.5b - XSS
The wp-tmkm-amazon WordPress plugin was affected by a XSS security vulnerability...
WP eBay Product Feeds < 1.2 - Cross-Site Scripting via rss_url Parameter
The WP eBay Product Feeds WordPress plugin was affected by a Cross-Site Scripting via rssurl Parameter security vulnerability. PoC http://localhost/wordpress/wp-content/plugins/ebay–feeds–for–wordpress/magpie/scripts/magpieslashbox.php?rssurl=%3Cscript%3Ealert%281%29%3C/script%3E...
WP e-Commerce Swipe <= 3.1.0 - Multiple XSS Issues
The last time it was checked the plugin was still affected and had been closed. PoC...
Podcast Channels < 0.28 - Unauthenticated Reflected XSS
The Podcast Channels WordPress plugin was affected by an Unauthenticated Reflected XSS security vulnerability. PoC http://127.0.0.1/wp-content/plugins/podcast–channels/getid3/demos/demo.write.php?Filename=Filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&...
Wordpress Social Login < 2.1.5 - XSS
The WordPress Social Login WordPress plugin was affected by a XSS security vulnerability...
Nextend Facebook Connect <= 1.4.59 - Cross-Site Scripting (XSS)
The Nextend Social Login and Register WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Media File Renamer <= 1.7.0 - Stored Cross-Site Scripting (XSS)
The Media File Renamer – Auto & Manual Rename WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
OptimizePress Theme < 1.6 - Unauthenticated Arbitrary File Upload
The OptimizePress premium WordPress theme was vulnerable to Unauthenticated Arbitrary File Upload, which could allow unauthenticated attackers to compromise a WordPress site. This vulnerability has been seen exploited in the wild. PoC The affected file was:...