Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download

The lack of authorisation checks in the handledownloads function, hooked to admininit could allow unauthenticated users to download arbitrary files from the blog using a path traversal payload. PoC /wp-admin/admin-post.php?algwcpifdownloadfile=../../../../../wp-config.php...

WooCommerce Subscriptions < 2.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

An unauthenticated user could put XSS payload in their billing details when subscribing, which will then be executed in the admin dashboard when moused over...

TC Custom JavaScript < 1.2.2 - Unauthenticated Stored Cross-Site Scripting (XSS)

A stored Cross-Site Scripting XSS vulnerability in the TC Custom JavaScript plugin for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of...

SRS Simple Hits Counter <= 1.0.4 - Unauthenticated Blind SQL Injection

Alex Peña from Tenable discovered a blind SQL injection which could allow unauthenticated remote attackers to retrieve data from the DBMS. Note: The vendor attempted a fix in v1.0.4, which is incomplete. PoC The PoC will be displayed once the issue has been remediated...

Login/Signup Popup < 1.5 - Authenticated Stored Cross-Site Scripting (XSS)

A lack of capability checks and security nonce allows any authenticated user to inject, via the AJAX API, JavaScript code into the plugin’s settings and to use it to target the administrator in the backend of WordPress. The vulnerability has been exploited for a couple of days...

Elementor Pro < 2.9.4 - Authenticated Arbitrary File Upload

According to Jerome Bruandet, from NintechNet, the vulnerability, currently exploited by attackers, allows any logged-in user to upload and execute PHP scripts on the blog. Chloe Chamberland from Wordfence also confirmed the issue and added that "This vulnerability is being used in conjunction wi...

wpForo < 1.7.0 - Reflected Cross-Site Scripting (XSS) via User Agent

The plugin did not escape, validate or escape the User Agent header before outputting back in the page, leading to a reflected Cross-Site Scripting issue...

Real-Time Find and Replace < 4.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

This flaw could allow any user to inject malicious Javascript anywhere on a site if they could trick a site’s administrator into performing an action, like clicking on a link in a comment or email. PoC...

Vanguard <= 2.1 - Multiple Cross-Site Scripting (XSS)

The plugin does not sanitise, validate or escape some of its parameters before outputting the back in various place, leading to either Stored or Reflected Cross-Site Scripting issues PoC Put the following payload in the In Products Search box: " POST /search HTTP/1.1 Accept:...

WPJobBoard < 5.6.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

"An attacker can submit malicious javascript code persistent XSS on some fields of 'add job' form in frontend. Then, when an admin want to edit or delete this job in control page, the malicious payload will be executed." Edit WPScanTeam February 26th, 2020 - Vendor contacted via their page...

CardGate < 3.1.16 - Unauthorised Payments Hijacking and Order Status Spoofing

Lack of origin authentication CWE-346 at IPN callback processing function allow even unauthorized attacker to remotely replace critical plugin settings merchant id, secret key etc with known to him and therefore bypass payment process eg. spoof order status by manually sending IPN callback reques...

GDPR Cookie Consent < 1.8.3 - Improper Access Controls

Improper Access Controls issue in the clipolicygenerator AJAX call which could allow an authenticated user with low privileges such as a subscriber to: - Change the status of any post/page from published to draft, removing them from the frontend of the blog. - Put a payload in the content of one...

Ninja Forms < 3.4.23 - CSRF to Stored Cross-Site Scripting (XSS)

Authenticated Stored XSS vulnerabilities in recaptchasitekey, recaptchasecretkey, recaptchalang and dateformat keys, which can be performed via CSRF attacks...

Chatbot with IBM Watson < 0.8.21 - DOM Cross-Site Scripting (XSS)

Note: The issue could be qualified of Self-XSS...

WP Database Reset < 3.15 - Unauthenticated Database Reset

This flaw "allowed any unauthenticated user to reset any table from the database to the initial WordPress set-up state." PoC URL/wp-admin/admin-post.php?db-reset-tables%5B%5D=comments&db-reset-code;=11111&db-reset-code-confirm;=11111 Where you can set db-reset-tables%5B%5D to any database table y...

Visualizer < 3.3.1 - Stored Cross-Site Scripting (XSS)

By abusing a lack of access controls on the /wp-json/visualizer/v1/update-chart WP-JSON API endpoint, an attacker can arbitrarily modify meta data of an existing chart, and inject a XSS payload to be stored and later executed when an admin goes to edit the chart. PoC curl -i -s -k -X $'POST' \ -H...

WooCommerce Product Feed for Google, Facebook, eBay and Many More < 3.1.15 - Authenticated Reflected XSS

The WooCommerce Product Feed for Google, Bing, eBay and Many More WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability...

UserPro <= 4.9.34 - Unauthenticated Reflected XSS

Edit WPscanTeam: August 26th, 2019 - Envato Notified September 2nd, 2019 - v4.9.34 released, still vulnerable September 24th, 2019 - v4.9.35 and 4.9.35.1 released, fixing the issue PoC...

WP Social Feed Gallery < 2.4.8 - CSRF & Missing Authorisation Checks

The lack of CSRF and Authorisations checks in some AJAX methods, such as qliggdismissnotice and qliggformitemdelete could allow attacker to perform unauthorised actions via actions when logged in as a low privilege user, or via CSRF attacks...

Adaptive Images for WordPress <= 0.6.66 - Local File Inclusion & Deletion

The Adaptive Images for WordPress WordPress plugin was affected by a Local File Inclusion & Deletion security vulnerability...

OneSignal Web Push Notifications - Stored XSS

The OneSignal – Web Push Notifications WordPress plugin was affected by a Stored XSS security vulnerability...

Ad Inserter <= 2.4.19 - Authenticated Path Traversal

Edit WPScanTeam: Even though the original advisory mentions that it only affect accounts with the administrator privilege, subscriber accounts and above can exploit the issue, as the nonce can be retrieved when submitting a request with a specific cookie, as described at...

Simple Link Directory < 7.3.5 - Cross-Site Scripting (XSS)

An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the 'echo getthetitle' or 'echo $term-name' statement...

Admin Renamer Extender <= 3.2.1 - CSRF

CSRF leading to arbitrary username change...

Insert or Embed Articulate Content into WordPress <= 4.2998 - Authenticated RCE

Original issue fixed in 4.2998. However, it was also be possible to upload via articulateuploadajaxfile AJAX method which was lacking authorisation checks and has been fixed in 4.2999...

WP Booking System <= 1.5.1.1 - CSRF to Authenticated SQL Injection

According to the original researcher, no CSRF nonces were present and therefore could be exploited by chaining with the CSRF issue...

WP Slimstat <= 4.8 - Unauthenticated Stored XSS from Visitors

This vulnerability allows a visitor to inject arbitrary JavasScript code on the plugin access log functionality, which is visible both on the plugin’s access log page and on the admin dashboard index—‚ the default page shown once you log in...

Ultimate Faqs < 1.8.22 - Cross-Site Scripting (XSS)

The Ultimate FAQ – WordPress Q Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Carts Guru <= 1.4.4 - Unauthenticated Object Injection

The Carts Guru WordPress plugin was affected by an Unauthenticated Object Injection security vulnerability...

WooCommerce Checkout Manager <= 4.2.6 - Arbitrary File Upload

The Checkout Manager for WooCommerce WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

Download Manager <= 2.9.93 - Authenticated Cross-Site Scripting (XSS)

In the pro features of the WordPress download manager plugin, there is a Category Short-code feature witch can use to sort categories with order by a function which will be used as ?orderby=title,publishdate . By adding parameter " and add any XSS payload , the xss payload will execute. To...

FormCraft <= 1.2.1 - Cross-Site Request Forgery (CSRF)

The FormCraft – Contact Form Builder for WordPress WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

WooCommerce <= 3.5.4 - Stored Cross-Site Scripting (XSS)

Security - Improved escaping for Photoswipe captions. Security - Improved escaping for JSON attributes and structured data...

Give <= 2.3.0 - Cross-Site Scripting (XSS)

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

NextScripts: Social Networks Auto-Poster < 4.2.8 - Authenticated Reflected Cross-Site Scripting (XSS)

The NextScripts: Social Networks Auto-Poster WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

WP Support Plus Responsive Ticket System < 9.1.2 - Stored XSS

The WP Support Plus Responsive Ticket System WordPress plugin was affected by a Stored XSS security vulnerability...

MapSVG Lite <= 3.2.3 - Cross-Site Request Forgery (CSRF)

CSRF in the mapsvgsave AJAX method PoC...

JobCareer < 2.4.1 - User enumeration & Reset password

The theme used a vulnerable version of the WP-jobhunt plugin affected by the issues below: CVE-2018-19487: The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the csemployerajaxprofile function through the admin-ajax.php file, which allows remote...

Master Slider <= 3.7.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not properly sanitise the slider name when creating or editing a slider, leading to an Authenticated editor+ Stored Cross-Site Scripting issue which will be triggered in the Slider table /wp-admin/admin.php?page=master-slider. Edit WPScanTeam: - The original report was from 2018,...

Support Board - Chat And Help Desk | Support & Chat <= 1.2.3 - XSS

The supportboard WordPress plugin was affected by a Chat And Help Desk | Support & Chat = 1.2.3 - XSS security vulnerability...

Gwolle Guestbook <= 2.5.3 - Cross-Site Scripting (XSS)

The Gwolle Guestbook WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Site Reviews <= 2.15.2 - Cross-Site Scripting (XSS)

The Site Reviews WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WD Instagram Feed <= 1.3.0 - XSS

The 10Web Social Photo Feed WordPress plugin was affected by a XSS security vulnerability...

Import any XML or CSV File to WordPress <= 3.4.5 - Cross-Site Scripting (XSS)

The Import any XML or CSV File to WordPress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

NextGEN Gallery <= 2.2.44 - Cross-Site Scripting (XSS)

XSS in error message caused by alt and title image attributes...

Bookly #1 WordPress Booking Plugin (Lite) <= 13.2 – Unauthenticated Blind Stored XSS

An unauthenticated user can inject arbitrary persistent javascript code in the admin panel via Bookly plug-in...

Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download

The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by an Unauthenticated Subscriber Download security vulnerability. PoC POST /?es=export ... option=viewallsubscribers...

Pinterest Feed <= 1.1.1 - Authenticated XSS & CSRF

The Weblizar Pin Feeds WordPress plugin was affected by an Authenticated XSS & CSRF security vulnerability...

SrbTransLatin <= 1.46 - Stored XSS & CSRF

The SrbTransLatin – Serbian Latinisation WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...

Smart Marketing SMS and Newsletters Forms <= 1.1.1 - Unauthenticated Cross-Site Scripting (XSS)

The Smart Marketing SMS and Newsletters Forms WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC POST /wordpress/wp-content/plugins/smart-marketing-for-wp/admin/partials/custom/egoi-for-wp-formegoi.php HTTP/1.1 Host: 127.0.0.1 Content-Type:...