14629 matches found
ChatBot < 4.7.9 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
CopyRightPro <= 2.1 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Synchro < 1.10.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Enhanced Ecommerce Google Analytics for WooCommerce < 3.7.2 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Leadster < 1.1.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its Script Code setting, which could allow attackers to make a logged in admin change it via a CSRF attack...
Add Shortcodes Actions And Filters < 2.10 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WooCommerce Login Redirect <= 2.2.4 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
HTTP Auth < 1.0.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Like Button <= 1.7.0 - Button Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its Button settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Woocommerce Category Banner Management < 2.4.3 - Shop Banner Settings Update via CSRF
Description The plugin does not have CSRF check when updating its Shop Banner settings, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Fraud Prevention For Woocommerce < 2.1.6 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Emoji One <= 0.6.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Forms Puzzle Captcha <= 4.1 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Easy WP Cleaner <= 1.9 - Data Deletion via CSRF
Description The plugin does not have CSRF check when deleting data from the blog, which could allow attackers to make logged in admins perform such action via a CSRF attack...
WP Super Minify < 1.6 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Custom Post Template <= 1.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
AWP Classifieds < 4.3.1 - Categories Mgt via CSRF
Description The plugin does not have CSRF checks when managing categories such as deleting, updating etc, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
Mang Board WP <= 1.7.7 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP-CopyProtect <= 3.1.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP-dTree <= 4.4.5 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
SendPress Newsletters <= 1.23.11.6 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Easy Cookie Law <= 3.1 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Futurio Extra < 1.9.1 - Arbitrary Plugin Activation via CSRF
Description The plugin does not have CSRF check when activating plugins, which could allow attackers to make logged in admins perform such action via a CSRF attack...
WooCommerce Product Attachment < 2.2.0 - Checkout Attachements Update via CSRF
Description The plugin does not have CSRF check when saving checkout attachements, which could allow attackers to make logged in users perform such action via a CSRF attack...
authLdap < 2.5.9 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Responsive Gallery Grid <= 2.3.10 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Captcha <= 2.0.0 - Captcha Bypass
Description The plugin does not properly check the Captcha, allowing user to bypass it...
MyCryptoCheckout < 2.126 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
wpCentral <= 1.5.7 - Settings Update via CSRF
Description The plugin does not have CSRF checks when updating allowed IP addresses and reseting connection key, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
WP Captcha <= 2.0.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
MailMunch – Grow your Email List < 3.1.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
GTmetrix for WordPress < 0.4.8 - Arbitrary Post Deletion via CSRF
Description The plugin does not have CSRF check when deleting posts, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Order Delivery Date for WP e-Commerce <= 1.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Block Update < 3.3.2 - Arbitrary Plugin Update Blocking via CSRF
Description The plugin does not have CSRF check when blocking plugin from being updated, which could allow attackers to make logged in admins perform such actions via a CSRF attack...
Make Paths Relative <= 1.3.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP HTML Mail < 3.4.2 - Test Email Sending via CSRF
Description The plugin does not have CSRF check when sending test emails, which could allow attackers to make logged in admins perform such action via a CSRF attack...
GEO my WordPress < 4.0.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Outbound Link Manager <= 1.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Saphali Woocommerce Lite < 1.9.0 - Settings Update/Reset via CSRF
Description The plugin does not have CSRF check in place when updating and reseting its settings, which could allow attackers to make a logged in admin change and reset them via a CSRF attack...
Remove/hide Author, Date, Category Like Entry-Meta <= 2.1 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
EventPrime < 3.2.0 - Booking Creation via CSRF
Description The plugin does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks. PoC Create an Event, noting its ID. Add a ticket type to the Event the details don't matter. As a logged-in user, visit a page wi...
Timthumb Scanner <= 1.54 - Scan Initialisation via CSRF
Description The plugin does not have CSRF check when starting a scan, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Memberlite Shortcodes < 1.3.9 - Contributor+ Stored XSS via Shortcode
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. Po...
EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website. PoC Insert '"Clickme! on the keyword search field or directly on the link...
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
Description The plugin does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. PoC Make sure you have Elementor installed and a page or post edited with Elementor. Here's the python script that will execute the...
Login screen manager <= 3.5.2 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC Put the following payload in the...
Optimize Database after Deleting Revisions <= 5.1 - Database Optimization via CSRF
Description The plugin does not have CSRF check when starting the database optimization process, which could allow attackers to make logged in admins perform such action via a CSRF attack...
FooGallery < 2.3.2 - Extensions Mgt via CSRF
Description The plugin does not have CSRF checks when activating/deactivating and downloading extensions, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping
Description The plugin does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC 1 Create a new template on...
Table of Contents Plus < 2309 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...