Last.fm Rotation 1.0 - lastfm-proxy.php snode Parameter Remote Path Traversal File Access

The lastfm-rotation WordPress plugin was affected by a lastfm-proxy.php snode Parameter Remote Path Traversal File Access security vulnerability...

WordPress 2.0.3 - 3.9.1 (except 3.7.4 / 3.8.4) CSRF Token Brute Forcing

...

Classic 1.5 - PHP_SELF XSS

The Classic WordPress theme was affected by a PHPSELF XSS security vulnerability...

Member Approval 131109 - wp-admin/options-general.php Option Manipulation CSRF

The member-approval WordPress plugin was affected by a wp-admin/options-general.php Option Manipulation CSRF security vulnerability...

HK Exif Tags 1.11 - hk_exif_tags.php hk_exif_tags_images_process Function EXIF Tags H&ling Stored XSS

The HK Exif Tags WordPress plugin was affected by a hkexiftags.php hkexiftagsimagesprocess Function EXIF Tags H Stored XSS security vulnerability...

Quick Page Post Redirect 5.0.4 - redirect-updates.php quickppr_redirects Parameter Stored XSS

The Quick Page/Post Redirect Plugin WordPress plugin was affected by a redirect-updates.php quickpprredirects Parameter Stored XSS security vulnerability...

Contus Video Gallery 2.0 & 1.6 - SQL Injection

The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability...

April's Super Functions Pack 1.4.7 - readme.php page Parameter Reflected XSS

The aprils-super-functions-pack WordPress plugin was affected by a readme.php page Parameter Reflected XSS security vulnerability...

AskApache Firefox Adsense 3.0 - Unspecified CSRF

The askapache-firefox-adsense WordPress plugin was affected by an Unspecified CSRF security vulnerability...

Connections <= 0.7.1.5 - Unspecified Security

The Connections Business Directory WordPress plugin was affected by an Unspecified Security security vulnerability...

Comment Attachment 1.0 - XSS

The Comment Attachment WordPress plugin was affected by a XSS security vulnerability...

Xorbin Digital Flash Clock 1.0 - Flash-based XSS

The xorbin-digital-flash-clock WordPress plugin was affected by a Flash-based XSS security vulnerability...

AntiVirus 1.0 - PHP Backdoor Detection Bypass

The AntiVirus WordPress plugin was affected by a PHP Backdoor Detection Bypass security vulnerability...

wp-cleanfix - Remote Comm& Execution, CSRF & XSS

The WP CleanFix WordPress plugin was affected by a Remote Comm& Execution, CSRF & XSS security vulnerability...

open-flash-chart-core - ofc_upload_image.php Arbitrary File Upload

The open-flash-chart-core WordPress plugin was affected by an ofcuploadimage.php Arbitrary File Upload security vulnerability...

Social Media Widget 4.0 - social-widget.php MITM Weakness Arbitrary Code Injection

The Social Media Widget WordPress plugin was affected by a social-widget.php MITM Weakness Arbitrary Code Injection security vulnerability...

drp-coupon <= 2.1 - XSS in ZeroClipboard

The drp-coupon WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

mobileview <= 1.0.7 - XSS in ZeroClipboard

The mobileview WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

RLSWordPressSearch - register.php agentid Parameter SQL Injection

The RLSWordPressSearch WordPress plugin was affected by a register.php agentid Parameter SQL Injection security vulnerability...

Vitamin 1.0 - minify.php path Parameter Traversal Arbitrary File Access

The vitamin WordPress plugin was affected by a minify.php path Parameter Traversal Arbitrary File Access security vulnerability...

WooCommerce 2.0.12 - index.php calc_shipping_state Parameter XSS

The WooCommerce WordPress plugin was affected by an index.php calcshippingstate Parameter XSS security vulnerability...

Events Manager 5.3.3 - Multiple Cross-Site Scripting (XSS)

The Events Manager WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

Portable phpMyAdmin 1.4.1 - Multiple Script Direct Request Authentication Bypass

The portable-phpmyadmin WordPress plugin was affected by a Multiple Script Direct Request Authentication Bypass security vulnerability...

RBX Gallery 2.1 - uploader.php File Upload PHP Code Execution

The rbxgallery WordPress plugin was affected by an uploader.php File Upload PHP Code Execution security vulnerability...

RokBox <= 2.13 - error_log Direct Request Error Log Information Disclosure

The wprokbox WordPress plugin was affected by an errorlog Direct Request Error Log Information Disclosure security vulnerability...

Sahifa 2.4.0 - Multiple Full Path Disclosure

The sahifa WordPress theme was affected by a Multiple Full Path Disclosure security vulnerability...

adminimize 1.7.21 - 'page' Parameter Cross Site Scripting

The Adminimize WordPress plugin was affected by a 'page' Parameter Cross Site Scripting security vulnerability...

WordPress 2.9 - Failure to Restrict URL Access

Description When WordPress implemented the new Trash feature they failed to change the permissions granted when the post is in the trash. This means that an unauthenticated user cannot see the post, however an authenticated user can, no matter what privileges they have, even ‘subscriber’. See...

wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload

The wpstorecart WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

Spreadsheet <= 0.6 - SQL Injection

The wpSS WordPress plugin was affected by a SQL Injection security vulnerability...

Video Posts Webcam Recorder < 1.55.5 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Video Posts Webcam Recorder WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. PoC https://example.com/wp-content/plugins/video-posts-webcam-recorder/posts/videowhisper/rlogout.php?message=message'//...

R&om Banner 1.1.2.1 - Cross-Site Scripting (XSS)

The Random Banner WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WP Tmkm Amazon <= 1.5b - XSS

The wp-tmkm-amazon WordPress plugin was affected by a XSS security vulnerability...

Podcast Channels < 0.28 - Unauthenticated Reflected XSS

The Podcast Channels WordPress plugin was affected by an Unauthenticated Reflected XSS security vulnerability. PoC http://127.0.0.1/wp-content/plugins/podcast–channels/getid3/demos/demo.write.php?Filename=Filename%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&...

WordPress 3.5.1 - Multiple Cross-Site Scripting (XSS)

...

Backupbuddy - importbuddy.php step Parameter Manipulation Authentication Bypass

The backupbuddy WordPress plugin was affected by an importbuddy.php step Parameter Manipulation Authentication Bypass security vulnerability...

Ajax Post Search <= 1.3 - SQL Injection

The cardoza-ajax-search WordPress plugin was affected by a SQL Injection security vulnerability...

Events Manager < 5.1.7 - Cross-Site Scripting (XSS)

The Events Manager WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Survey And Quiz Tool <= 2.9.2 - Cross Site Scripting

The wp-survey-and-quiz-tool WordPress plugin was affected by a Cross Site Scripting security vulnerability...

Bad Behavior < 2.2.5 - Cross-Site Scripting (XSS)

The Bad Behavior WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Buddypress <= 1.5.4 - SQL Injection

The BuddyPress WordPress plugin was affected by a SQL Injection security vulnerability...

Slideshow Gallery 2 <= 1.1.4 - Cross-Site Scripting (XSS)

The last time it was checked the plugin was still affected and had been closed...

FCChat 2.2.11-2.2.13 - Upload.php Arbitrary File Upload

The FCChat Widget WordPress plugin was affected by an Upload.php Arbitrary File Upload security vulnerability...

WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element

Description WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post...

WP < 7.0.3 - Subscriber+ Arbitrary Site Creation on Multisite

Description WordPress does not enforce the network registration policy in some cases, which could allow any authenticated user to create new sites on a multisite network where site registration is disabled...

Dating <= 11.2.0 - Missing Authorization

Description The Dating theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 11.2.0. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Magnific Popups JavaScript Library < 1.2.0 - Contributor+ Stored XSS

Description Multiple plugins are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library version 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The 360 View plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-leve...

Avada < 7.11.11 - Missing Authorization

Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.11.10. This makes it possible for unauthenticated attackers to perform an unauthoriz...