14623 matches found
FULL - Customer < 2.3 - Subscriber+ Health Check Disclosure
Description The plugin does not have proper authorisation in its health REST API, allowing any authenticated user, such as subscriber to access it and retrieve sensitive information from the WordPress health check...
PDQ CSV <= 1.0.0 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup...
User Activity Log < 1.6.6 - Subscriber+ Log Export
Description The plugin lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses. PoC As a subscriber, open the following URL...
Chatbot < 4.7.8 - Admin+ Stored XSS in FAQ Builder
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Navigate to "WPBot Lite -...
Biometric Login for WooCommerce < 1.0.4 - Unauthenticated Privilege Escalation
Description The plugin does not validate that a user's WebAuthn authentication request succeeded before sending them authentication cookies, making it possible for unauthenticated attackers to take over any accounts having WebAuthn credentials set up on affected sites. PoC While on the site not...
WPBulky < 1.0.10 - Contributor+ Stored Cross-Site Scripting
Description The plugin does not properly sanitize user input via its sanitize function, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Chatbot < 4.7.8 - Admin+ Stored XSS in Language Settings
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. In the plugin settings, select...
CartFlows Pro < 1.11.12 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CodeBard's Patron Button and Widgets for Patreon < 2.1.9 - Reflected XSS
Description The plugin does not sanitise and escape the siteaccount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access
Description The plugin does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones PoC Run the below command in the developer...
Ninja Forms < 3.6.26 - Admin+ Stored HTML Injection
Description The plugin does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored HTML injection. Only users with the unfilteredhtml capability can perform this, and such users are already allowed to use JS in posts/comments etc however t...
User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRF
Description The plugin does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks PoC Make a logged in admin open a page with the code below To make them deactivate the license To mak...
WP Ultimate CSV Importer < 7.9.9 - Author+ Privilege Escalation
Description The plugin does not validate User Metadata, which could allow author and above roles who have been granted access to the plugin settings to update their role to administrator...
wpShopGermany IT-RECHT KANZLEI < 1.8 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Custom Field Template < 2.6 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape the posttype parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WP Ultimate CSV Importer < 7.9.9 - Author+ RCE
Description The plugin does not validate imported files, which could allow authors and above roles who have been granted access to the plugin settings to perform RCE...
WpStream < 4.5.5 - Local Event Settings Update via CSRF
Description The plugin does not have CSRF check when updating its local event settings, which could allow attackers to make logged in admin perform such action via a CSRF attack...
Rank Math SEO < 1.0.119.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR
Description The plugin does not prevent non-administrator users from deleting messages from the all-users messenger. PoC 1 Go to the messenger 2 Catch a request that is constantly running at intervals of 3 seconds 3 Change the message time argument to true 4 Set true for permission to delete a...
GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRF
Description The plugin does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks PoC Make a logged in admin open a page with the code below To make them deactivate the license To mak...
CartFlows Pro < 1.11.13 - CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WP Ultimate CSV Importer < 7.9.9 - Imported Files Disclosure
Description The plugin does not protect its imported files, which could allow unauthenticated users to list and view exported files...
POEditor < 0.9.8 - Settings Reset via CSRF
Description The plugin does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks. PoC...
Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping PoC Create an HTML file with the...
User Access Manager < 2.2.18 - IP Spoofing
Description The plugin prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTEADDR, which makes it possible for attackers to access restricted content in certain situations. PoC Set HTTPXREALIP which is used in checkUserGroupAccess to use an IP from the allowlist...
Stripe Payment Plugin for WooCommerce < 3.7.8 - Authentication Bypass
Description The plugin does not properly check users during the Stripe checkout process, which could allow unauthenticated attackers to log in as any users having placed an order when the Stripe checkout option is enabled...
Bus Ticket Booking with Seat Reservation < 5.2.4 - Reflected XSS
Description The plugin does not sanitise and escape the tabdate and tabdater parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below the post value is the ID of a post/page...
Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the...
Front Editor <= 4.3.5 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Add a new form. 2. For the "Post Title",...
Upload Media By URL < 1.0.8 - Stored XSS via CSRF
Description The plugin does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files including HTML containing JS code for users with the unfilteredhtml capability on their behalf. PoC Have a logged in user with the unfilteredhtml capability open...
FormCraft < 1.2.7 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC There are two XSS issues: Example...
MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open...
MultiParcels Shipping For WooCommerce < 1.15.2 - Arbitrary Shipment Deletion via CSRF
Description The plugin does not have CRSF check when deleting a shipment, allowing attackers to make any logged in user, delete arbitrary shipment via a CSRF attack PoC Make any logged in user open https://example.com/wp-admin/admin-post.php?action=multiparcelsdeleteshipping=1 to make them delete...
Blog2Social < 7.2.1 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below...
Ninja Forms < 3.6.26 - Subscriber+ Form Entries Export
Description The plugin does not have proper authorisation check in the processing function, which could allow any authenticated users, such as subscriber to export and download submitted form entries...
Ninja Forms < 3.6.26 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Ninja Forms < 3.6.26 - Contributor+ Form Entries Export
Description The plugin does not have proper authorisation check in the exportlisten function, which could allow Contributors and above roles to export and download submitted form entries...
Multiple Plugins from Inisev - Subscriber+ Plugin Installation
Description Multiple plugins from the Inisev vendor are lacking authorisation in the handleinstallation function hooked to the inisevinstallation AJAX action, allowing any authenticated users, such as subscriber to install plugins from Inisev on the blog...
Multiple Plugins from Inisev - Plugin Installation via CSRF
Description Multiple plugins from the Inisev vendor are lacking CSRF check in the handleinstallation function hooked to the inisevinstallation AJAX action, allowing unauthenticated attackers to make logged in admins install plugins from Inisev on the blog via a CSRF attack...
ACF Photo Gallery Field < 2.0 - Subscriber+ UserMeta Update
Description The plugin does not check user meta to be updated, allowing any authenticated users, such as subscriber, to update any of their user meta to an arbitrary string...
Video Conferencing with Zoom < 4.3.0 - Sensitive Data Disclosure
Description The plugin hardcodes its encryption key, which could allow unauthenticated attackers to decrypt the meeting id and password via the vczapiencryptdecrypt function...
Bit Assist < 1.1.9 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. In the plugin's settings, click...
Change WP Admin < 1.1.4 - Secret Login Page Disclosure
Description The plugin discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. PoC - Set custom Login URL under "Settings Permalinks". For example, login - As an unauthenticated visitor, open https://example.com/wp-admin/customize.php in a...
InstaWP Connect < 0.0.9.19 - Unauthenticated Data Modification
Description The plugin does not have authorisation check in its eventsreceiver function, allowing unauthenticated users to create/update/delete posts/taxonomy, install/activate/deactivate plugin, update the customizer settings as well as create/update/delete arbitrary users...
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Description The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting. This directly affects over 1000 plugins and themes that use this SDK...