14623 matches found
File Manager Pro < 1.8 - Remote Code Execution via CSRF
Description The plugin does not properly check the CSRF nonce in the fsconnector AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell. PoC As a Super Admin, run the following...
Socialdriver <= 2021 - Prototype Pollution to XSS
Description The theme has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties resulting in a cross-site scripting XSS attack. PoC Access the URL:...
WooCommerce < 8.1.1 - Shop Manager+ User Metadata Disclosure
Description The plugin returns all user metadata via an AJAX action, which could allow users with a role as low as Shop Manager to access an arbitrary user's metadata which could include tokens and other potentially sensitive data PoC As a shop manager or product vendor admin: Edit an order/creat...
Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS
Description The plugin does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators PoC As an unauthenticated user, submit a booking form such form can be added via the Booking Calendar Block on a...
WooCommerce < 7.9 - Unauthenticated Sensitive Information Disclosure
Description The plugin does not properly apply CORS on some of its API endpoints, allowing attackers to leak customers PII information...
WooCommerce Subscriptions < 4.6.0 - Subscription Suspension/Activation via CSRF
Description The plugin does not have CSRF check when suspending and activating subscriptions, which could allow attackers to make a logged in admin suspend or activate arbitrary subscription via a CSRF attack PoC Deactivate subscription with ID 53:...
Read More & Accordion < 3.2.7 - Admin+ PHP Object Injection
Description The plugin unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. PoC To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup :...
Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries
Description The plugin does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin. PoC Add ...
PixTypes <= 1.4.15 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WooCommerce PDF Invoice Builder < 1.2.90 - Subscriber+ SQLi
Description The plugin does not properly sanitise and escape the pageId parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...
WP Categories Widget < 2.3 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Media Library Categories < 2.0.1 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Flowpaper < 2.0.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
User Email Verification for WooCommerce <= 3.5.0 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Booking Package < 1.6.02 - Reflected XSS
Description The plugin does not sanitise and escape the mode parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Post List With Featured Image <= 1.2.1 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Kangu para WooCommerce < 2.2.10 - Reflected XSS
Description The plugin does not sanitise and escape the etiqueta parameters before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Molongui < 4.6.20 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
ImageRecycle pdf & image compression < 3.1.12 - Reflected XSS
Description The plugin does not sanitise and escape the page and s parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
ImageRecycle pdf & image compression < 3.1.11 - Reflected XSS
Description The plugin does not sanitise and escape the page parameters before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress Social Login <= 3.0.4 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its wordpresssocialloginmeta shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WP 404 Auto Redirect to Similar Post <= 1.0.3 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Media Library Assistant < 3.10 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
Description The plugin is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mlastreamfile' parameter from the /includes/mla-stream-image.php file, where images are processe...
Duplicate Post Page Menu & Custom Post Type < 2.4.0 - Subscriber+ Post Duplication
Description The plugin is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicateppmcpostasdraft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts...
WooCommerce PDF Invoice Builder < 1.2.91 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WooCommerce PDF Invoice Builder < 1.2.91 - Invoice Update via CSRF
Description The plugin does not have CSRF check when updating invoices, which could allow attackers to make logged in admin perform such action via a CSRF attack...
Simple Membership < 4.3.6 - Reflected XSS
Description The plugin does not sanitise and escape the listtype parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
BigBlueButton <= 3.0.0-beta.4 - Reflected XSS
Description The plugin does not sanitise and escape the username and tempentrypass parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Font Awesome 4 Menus <= 4.7.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its fa and fa-stack shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WooCommerce PDF Invoice Builder < 1.2.91 - Invoice Fields Creation via CSRF
Description The plugin does not have CSRF check when creating invoice fields, which could allow attackers to make logged in admin perform such action via a CSRF attack...
WooCommerce PDF Invoice Builder < 1.2.92 - Subscriber+ Arbitrary Invoice Access
Description The plugin does not have authorisation in the GetInvoiceDetail function, allowing any authenticated users, such as subscriber to access arbitrary invoice by knowing or guessing the order and invoice IDs...
Elastic Email Sender < 1.2.7 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Woo Custom Emails <= 2.2 - Reflected XSS
Description The plugin does not sanitise and escape the wcemailsedit parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Business Pro <= 1.10.4 - Reflected XSS
Description The theme does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WebLibrarian <= 3.5.8.4 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
LINE Notify < 1.4.5 - Reflected XSS
Description The plugin does not sanitise and escape the uid parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Custom Admin Login Page | WPZest <= 1.2.0 - Admin+ Stored XSS
Description The plugin does not validate and escape some settings, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Schedule Posts Calendar < 5.3 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CT Commerce <= 2.0.1 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Avartan Slider Lite <= 1.5.3 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Plausible Analytics < 1.3.4 - Reflected XSS
Description The plugin does not sanitise and escape the page-url parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Online Booking & Scheduling Calendar for WordPress by vcita < 4.3.3 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Carrot <= 1.1.0 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload
Description The plugin does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE PoC Prerequisite: This vulnerability requires the "Upload Profile Picture" option to be enabled, which isn't th...
Newsletter < 7.9.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its newsletterform shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WRC Pricing Tables < 2.3.9 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
All in One B2B for WooCommerce <= 1.0.3 - Multiple CSRF
Description The plugin does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks. PoC This CSRF attack will reject a Quote in the database. 1. Go to All In One Quote Quotes 2. Click "Add quote", fill in the title, and save. 3. Find the Quote ID,...
Atarim < 3.9.4 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
Description The plugin does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation. PoC curl 'https://example.com/' -d...
Library Viewer < 2.0.6.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...