Easy2Map <= 1.2.9 - Local File Inclusion

The Easy2Map WordPress plugin was affected by a Local File Inclusion security vulnerability...

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus WordPress theme was affected by a Directory Traversal security vulnerability...

xPinner Lite <= 2.2 - Cross-Site Scripting (XSS) & CSRF

The xpinner-lite WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...

MyPixs <= 0.3 - Unauthenticated Local File Inclusion (LFI)

Plugin is still affected and has been closed. Typical local file inclusion vulnerability: from downloadpage.php: I've tried to get RCE but didn't have success reading from /proc/self/environ or /var/log/apache2/access.log include: Failed opening '/proc/self/environ' for inclusion...

Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS)

The Google Analyticator WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

Manual Image Crop <= 1.10 - Authenticated Reflected Cross-Site Scripting (XSS)

The Manual Image Crop WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

Monetize <= 1.03 - Cross-Site Scripting (XSS) & CSRF

The monetize WordPress plugin was affected by a Cross-Site Scripting XSS & CSRF security vulnerability...

Altos Connect Widget <= 1.3.0 - Unauthenticated Cross-Site Scripting (XSS)

The altos-connect WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/"...

FileDownload <= 1.4 - Multiple Issues

XSS, Blind SQL Injection and Open Proxy issues...

Sell Downloads < 1.0.8 - Insufficient Restrictions when Brute-Force Purchase IDs

The Sell Downloads WordPress plugin was affected by an Insufficient Restrictions when Brute-Force Purchase IDs security vulnerability...

Swim Team <= v1.44.10777 - Local File Inclusion

The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files. PoC $ curl "http://www.vapidlabs.com/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd=/etc/passwd=text/html=1=/usr/share/wordpress"...

WordPress File Upload <= 2.7.6 - Multiple Vulnerabilities

The plugin allows upload of file extensions that may lead to code execution, such as php4 or php5. Additionally, it allows an admin user to rename files and thus change the extension of uploaded files, leading to code execution. There is no CSRF protection for this. The plugin also allows for the...

WP ViperGB < 1.3.16 - XSS

The WP-ViperGB WordPress plugin was affected by a XSS security vulnerability...

WordPress Landing Pages <= 1.8.4 - XSS & SQL Injection

The WordPress Landing Pages WordPress plugin was affected by a XSS & SQL Injection security vulnerability...

WP Photo Album Plus <= 6.1.2 - Stored Cross-Site Scripting (XSS)

The WP Photo Album Plus WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

Syndication Links <= 1.0.2 - DOM Cross-Site Scripting (XSS)

The Syndication Links WordPress plugin was affected by a DOM Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/syndication-links/genericons/example.html...

WordPress File Upload < 2.7.1 - JS File Upload

The WordPress File Upload WordPress plugin was affected by a JS File Upload security vulnerability...

eShop <= 6.3.11 - Remote Code Execution

The eshop WordPress plugin was affected by a Remote Code Execution security vulnerability...

Exquisite Ultimate Newspaper Theme <= 1.3.3 - DOM Cross-Site Scripting (XSS)

The exquisite-wp WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/...

All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection

There are some pages which use the WordPress escsql function incorrectly. PoC http://www.example.com/wp-admin/admin.php?page=aiowpsec=tab3=userid,select from selectsleep30a=asc...

WP Business Intelligence Lite < 1.6.3 - SQL Injection

...

AB Google Map Travel (AB-MAP) <= 3.4 - CSRF/Stored XSS

The AB Google Map Travel AB-MAP WordPress plugin was affected by a CSRF/Stored XSS security vulnerability...

Captcha <= 4.0.6 - Captcha Bypass

The captcha WordPress plugin was affected by a Captcha Bypass security vulnerability...

Photocrati Theme 4.x.x - SQL Injection

PoC http://www.example.com/wp-content/themes/photocrati-theme-path/ecomm-sizes.php?prodid=SQL...

EasyCart 1.1.30 - 3.0.20 - Privilege Escalation

Due to a lack of validation in the ecajaxupdateoption and ecajaxclearalltaxrates functions located in /inc/admin/adminajaxfunctions.php, it is possible to update any WordPress option as an authenticated non-admin user, which can in turn lead to privilege escalation and remote code execution...

Easy Social Icons <= 1.2.2 - Stored XSS & CSRF

The Easy Social Icons WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...

Frontend Uploader <= 0.9.2 - Unauthenticated Cross-Site Scripting (XSS)

The Frontend Uploader WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://localhost:8080/?pageid=0&fu-disallowed-mime-type0name=%3CSCRIPT%20SRC=http://ha.ckers.org/xss.js?%3C%20B%20%3E...

Simplelife <= 1.2 - Multiple CSRF

Plugin is still affected and has been closed...

Tweetscribe <= 1.1 - Multiple CSRF

Plugin is still affected and has been closed...

Bird Feeder <= 1.2.3 - CSRF & XSS

The bird-feeder WordPress plugin was affected by a CSRF & XSS security vulnerability...

WP Popup <= 1.3 - XSS & CSRF

It is unclear if the issues have been fixed. Plugin has been closed...

VN-Calendar <= 1.0 - Multiple Cross-Site Scripting (XSS)

The vn-calendar WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

Gr& Flagallery <= 4.24 - Full Path Disclosure

The Album and Image Gallery with Lightbox – Flagallery Photo Portfolio WordPress plugin was affected by a Full Path Disclosure security vulnerability...

Contact Form Integrated With Google Maps 1.0-2.4 - Stored Cross-Site Scripting (XSS)

The Contact Form Integrated With Google Maps WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

Cforms < 13.2 - XSS

The cforms WordPress plugin was affected by a XSS security vulnerability...

Cforms < 10.5 - XSS

The cforms WordPress plugin was affected by a XSS security vulnerability...

Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS)

The contact-form-7-to-database-extension WordPress plugin was affected by a 2 x Cross-Site Scripting XSS security vulnerability...

Wordfence <= 5.2.4 - Multiple Vulnerabilities (XSS & Bypasses)

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by a Multiple Vulnerabilities XSS & Bypasses security vulnerability...

Photo Gallery 1.1.30 - Cross Site Scripting

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Cross Site Scripting security vulnerability...

BulletProof Security <= .50.8 - Script Insertion

The BulletProof Security WordPress plugin was affected by a Script Insertion security vulnerability...

Advanced Access Manager 2.8.2 - Admin User File Read/Write

The Advanced Access Manager WordPress plugin was affected by an Admin User File Read/Write security vulnerability...

SI CAPTCHA 2.7.4 - Cross-Site Scripting (XSS)

The si-captcha-for-wordpress WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting (XSS)

The WooCommerce WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

Pinboard 1.0.6 - includes/theme-options.php tab Parameter XSS

The Pinboard WordPress theme was affected by an includes/theme-options.php tab Parameter XSS security vulnerability...

wp-football 1.1 - Multiple Cross-Site Scripting (XSS)

The wp-football WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

Easy Banners 1.4 - Cross-Site Scripting (XSS)

The easy-banners WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

HK Exif Tags 1.11 - hk_exif_tags.php hk_exif_tags_images_process Function EXIF Tags H&ling Stored XSS

The HK Exif Tags WordPress plugin was affected by a hkexiftags.php hkexiftagsimagesprocess Function EXIF Tags H Stored XSS security vulnerability...

Quick Page Post Redirect 5.0.4 - redirect-updates.php quickppr_redirects Parameter Stored XSS

The Quick Page/Post Redirect Plugin WordPress plugin was affected by a redirect-updates.php quickpprredirects Parameter Stored XSS security vulnerability...

April's Super Functions Pack 1.4.7 - readme.php page Parameter Reflected XSS

The aprils-super-functions-pack WordPress plugin was affected by a readme.php page Parameter Reflected XSS security vulnerability...

Redirection - view/admin/log_item.php Non-existent Posts Referer HTTP Header XSS

The Redirection WordPress plugin was affected by a view/admin/logitem.php Non-existent Posts Referer HTTP Header XSS security vulnerability...