14633 matches found
WP Reroute Email < 1.4.8 - Cross-Site Request Forgery
Description Cross-Site Request Forgery CSRF vulnerability in Sajjad Hossain WP Reroute Email plugin = 1.4.6 versions...
Bubble Menu < 3.0.5 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup. PoC 1. Click on the "Add new" tab...
MultiParcels Shipping For WooCommerce < 1.14.14 - Subscriber+ Arbitrary Shipment Deletion
Description The plugin does not have authorisation when deleting shipment, allowing any authenticated users, such as subscriber to delete arbitrary shipment PoC Login as a subscriber an open https://example.com/wp-admin/admin-post.php?action=multiparcelsdeleteshipping=1 to delete the shipment wit...
WooCommerce Order Barcodes < 1.6.5 - Cross-Site Request Forgery
Description Cross-Site Request Forgery CSRF vulnerability in WooCommerce WooCommerce Order Barcodes plugin = 1.6.4 versions...
WP PDF Generator < 1.2.3 - Cross-Site Request Forgery
Description Cross-Site Request Forgery CSRF vulnerability in wpexperts.Io WP PDF Generator plugin = 1.2.2 versions...
Quiz And Survey Master < 8.1.11 - Contributor+ Stored XSS
Description The plugin does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a Contributor, create or edit a Quiz with the default theme and put the following payload in a question...
WPCode < 2.0.13.1 - Reflected XSS
Description The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting PoC Make a logged in admin open https://example.com/wp-admin/admin.php?page=wpcode"=2...
Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending
Description The plugin allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubelysendformdata AJAX action. PoC Execute the below command in the web developer console, on the blog homepage as an unauthenticated user, replacing domain by the domain of the blog:...
MultiParcels Shipping For WooCommerce < 1.14.15 - Subscriber+ SQLi
Description The plugin does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks. Note WPScan: The issue was fixed in 1.14.13, however a better patch was done in 1.14.15 a...
WP Shopping Pages <= 1.14 - Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. PoC Make a logged in admin access a page with the following code:...
MultiParcels Shipping For WooCommerce < 1.15.4 - Reflected XSS
Description The plugin does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Note: The issue was fixed in 1.14.15 but re-introduced in 1.14.16 PoC Make a...
Album Gallery – WordPress Gallery < 1.5.0 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks either flawed or missing completely in when performing update actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload Leading to RCE
The plugin does not validate the file types, and uses a hardcoded encryption key during the profile picture upload process. Authenticated users with minimal permissions, such as a subscriber, can thus upload arbitrary files, potentially leading to remote code execution...
Export and Import Users and Customers < 2.4.2 - Shop Manager+ Privilege Escalation
The plugin does not correctly implement a capability check on the 'hfupdatecustomer' function, which is triggered via an AJAX action. This omission allows users with shop manager-level permissions to modify data they should not have access to, such as changing user passwords and potentially gaini...
All-In-One Security (AIOS) – Security and Firewall < 5.2.0 - Insecure Storage of Password
The plugin stores the password inside the database as plaintext allowing administrators to obtain access to user's passwords...
Justin Klein WP Social AutoConnect < 4.6.2 - Cross-Site Request Forgery
The plugin does not use nonces to verify requests, making it vulnerable to Cross-Site Request Forgery CSRF attacks...
User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload
The plugin uses a static encryption key and does not validate the file path when renaming profile pictures, which could allow any authenticated users, such as subscriber, to upload arbitrary files such as PHP on the server...
Replace Word <= 2.1 - Cross-Site Request Forgery
The plugin does not adequately verify requests using nonces, leading to a potential Cross-Site Request Forgery vulnerability...
Post SMTP < 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Email Contents
The plugin does not sufficiently sanitize and escape email contents, which could lead to unauthenticated users injecting arbitrary web scripts that execute whenever a page is accessed...
Advanced Flat rate shipping Woocommerce < 1.6.4.6 - Cross-Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin = 1.6.4.4 versions...
Database Collation Fix < 1.2.8 - Cross-Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in Dave Jesch Database Collation Fix plugin = 1.2.7 versions...
Shortcode IMDB <= 6.0.8 - Cross-Site Request Forgery
The plugin does not properly implement anti-CSRF mechanisms, making it vulnerable to potential CSRF attacks...
LWS Cleaner < 2.3.1 - Cross-Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in LWS Cleaner plugin = 2.3.0 versions...
WishSuite < 1.3.4 - Cross-Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in HasTheme WishSuite plugin = 1.3.3 versions...
Forminator < 1.24.4 - Reflected XSS
The plugin does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks. PoC 1. Create a "Contact Us" form from the plugin presets 2. Click on the Message field, go to the "Settings" tab and choose a...
WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF
The plugin has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacks PoC Make a logged in admin open an HTML pa...
Multiple Plugins from Addify - Multiple CSRF
The plugins have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions PoC addify-order-approval-woocommerce - To make a logged in admin approve the order with ID 103...
Short URL < 1.6.5 - Admin+ Cross Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC In the plugin settings, add the POC to the...
WooCommerce GoCardless Gateway < 2.5.7 - Unauthenticated Sensitive Information Disclosure
The plugin does not check user permissions before displaying sensitive information about an Order, leading to sensitive information disclosure as well as the ability for an unauthenticated user to cancel any guest's order...
Social Media Icons Widget <= 1.6 - Cross-Site Request Forgery
The plugin does not adequately protect against Cross-Site Request Forgery CSRF attacks...
BigContact <= 1.5.8 - Cross-Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin = 1.5.8 versions...
Grid Kit Premium < 2.2.0 - Multiple Reflected Cross-Site Scripting
The plugin does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open one of the URL below...
Mail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject
The plugin does not adequately sanitize input or escape output for email subjects, resulting in potential for stored cross-site scripting...
HT Feed < 1.2.8 - Cross-Site Request Forgery
Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Feed plugin = 1.2.7 versions...
WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF
The plugin has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack PoC Make a logged in admin open the URL below 42 being a pre-order to be canceled...
LMS by Masteriyo < 1.6.8 - Information Exposure
The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints. PoC curl -i -s -k -X $'GET' \ -H $'Host: localhost:8000' -H $'sec-ch-ua: ' -H $'Accept:...
WordPress Mobile Pack <= 3.4.1 - Cross-Site Request Forgery
The plugin does not properly validate requests use nonces, leading to a Cross-Site Request Forgery CSRF vulnerability...
WP Dummy Content Generator < 3.0.0 - Cross-Site Request Forgery
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Getnet Argentina para Woocommerce < 0.0.5 - Unauthenticated Authorization Bypass
The plugin does not perform adequate validation on the 'webhook' function, which can lead to an unauthenticated user changing their payment status to 'APPROVED' without making an actual payment...
FluentSMTP < 2.2.5 - Unauthenticated Stored Cross-Site Scripting
The plugin does not adequately sanitize and escape input in the email subject, making it possible to inject arbitrary web scripts that execute when a user accesses the affected page...
WP Mail Log < 1.1.2 - Unauthenticated Stored Cross-Site Scripting
The plugin does not properly sanitize and escape email contents, leading to a potential Stored Cross-Site Scripting vulnerability. This issue allows for arbitrary web scripts to be injected into pages, which will execute when a user accesses an affected page...
Media Library Helper by Codexin <= 1.2.0 - Cross-Site Request Forgery
The plugin does not properly validate requests using nonces, making it susceptible to Cross-Site Request Forgery CSRF attacks...
WP Reroute Email < 1.5.0 - Unauthenticated Stored Cross-Site Scripting
The plugin does not properly sanitize and escape input in the email subject, leading to potential Stored Cross-Site Scripting issues. This flaw allows the injection of arbitrary web scripts that are executed whenever an injected page is accessed...
ARMember < 4.0.6 - ARMember Cross-Site Request Forgery
The plugin does not properly validate nonces in the armcheckusercap function, leading to a potential Cross-Site Request Forgery vulnerability. As a result, unauthenticated users can carry out actions without appropriate permissions, provided they manage to mislead a site administrator into clicki...
Classified Listing < 2.4.6 - Cross-Site Request Forgery
The plugin does not adequately verify requests using nonces, leading to a potential Cross-Site Request Forgery vulnerability...
WPLMS < 4.900 - Cross-Site Request Forgery
The plugin does not adequately verify requests use nonces, making it susceptible to Cross-Site Request Forgery CSRF attacks...
ShopLentor < 2.6.3 - Settings Update via CSRF
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Visibility Logic for Elementor < 2.3.5 - Cross-Site Request Forgery
The plugin does not properly validate requests using nonces, which makes it susceptible to Cross-Site Request Forgery attacks...
SMTP Mail <= 1.2.16 - Unauthenticated Stored Cross-Site Scripting
The plugin does not properly sanitize and escape input in email subjects when the 'Save Data SendMail' feature is enabled, leading to potential Stored Cross-Site Scripting issues...