MultiParcels Shipping For WooCommerce < 1.14.15 - Subscriber+ SQLi

Description The plugin does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks. Note WPScan: The issue was fixed in 1.14.13, however a better patch was done in 1.14.15 a...

Album Gallery – WordPress Gallery < 1.5.0 - Cross-Site Request Forgery

Description The plugin does not have CSRF checks either flawed or missing completely in when performing update actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload Leading to RCE

The plugin does not validate the file types, and uses a hardcoded encryption key during the profile picture upload process. Authenticated users with minimal permissions, such as a subscriber, can thus upload arbitrary files, potentially leading to remote code execution...

All-In-One Security (AIOS) – Security and Firewall < 5.2.0 - Insecure Storage of Password

The plugin stores the password inside the database as plaintext allowing administrators to obtain access to user's passwords...

Export and Import Users and Customers < 2.4.2 - Shop Manager+ Privilege Escalation

The plugin does not correctly implement a capability check on the 'hfupdatecustomer' function, which is triggered via an AJAX action. This omission allows users with shop manager-level permissions to modify data they should not have access to, such as changing user passwords and potentially gaini...

Justin Klein WP Social AutoConnect < 4.6.2 - Cross-Site Request Forgery

The plugin does not use nonces to verify requests, making it vulnerable to Cross-Site Request Forgery CSRF attacks...

User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload

The plugin uses a static encryption key and does not validate the file path when renaming profile pictures, which could allow any authenticated users, such as subscriber, to upload arbitrary files such as PHP on the server...

Replace Word <= 2.1 - Cross-Site Request Forgery

The plugin does not adequately verify requests using nonces, leading to a potential Cross-Site Request Forgery vulnerability...

Post SMTP < 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Email Contents

The plugin does not sufficiently sanitize and escape email contents, which could lead to unauthenticated users injecting arbitrary web scripts that execute whenever a page is accessed...

Advanced Flat rate shipping Woocommerce < 1.6.4.6 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin = 1.6.4.4 versions...

Database Collation Fix < 1.2.8 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in Dave Jesch Database Collation Fix plugin = 1.2.7 versions...

Shortcode IMDB <= 6.0.8 - Cross-Site Request Forgery

The plugin does not properly implement anti-CSRF mechanisms, making it vulnerable to potential CSRF attacks...

WishSuite < 1.3.4 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in HasTheme WishSuite plugin = 1.3.3 versions...

LWS Cleaner < 2.3.1 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in LWS Cleaner plugin = 2.3.0 versions...

Multiple Plugins from Addify - Multiple CSRF

The plugins have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions PoC addify-order-approval-woocommerce - To make a logged in admin approve the order with ID 103...

WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF

The plugin has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF attacks PoC Make a logged in admin open an HTML pa...

Forminator < 1.24.4 - Reflected XSS

The plugin does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks. PoC 1. Create a "Contact Us" form from the plugin presets 2. Click on the Message field, go to the "Settings" tab and choose a...

Grid Kit Premium < 2.2.0 - Multiple Reflected Cross-Site Scripting

The plugin does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open one of the URL below...

Short URL < 1.6.5 - Admin+ Cross Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC In the plugin settings, add the POC to the...

BigContact <= 1.5.8 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin = 1.5.8 versions...

Social Media Icons Widget <= 1.6 - Cross-Site Request Forgery

The plugin does not adequately protect against Cross-Site Request Forgery CSRF attacks...

WooCommerce GoCardless Gateway < 2.5.7 - Unauthenticated Sensitive Information Disclosure

The plugin does not check user permissions before displaying sensitive information about an Order, leading to sensitive information disclosure as well as the ability for an unauthenticated user to cancel any guest's order...

LMS by Masteriyo < 1.6.8 - Information Exposure

The plugin does not properly safeguards sensitive user information, like other user's email addresses, making it possible for any students to leak them via some of the plugin's REST API endpoints. PoC curl -i -s -k -X $'GET' \ -H $'Host: localhost:8000' -H $'sec-ch-ua: ' -H $'Accept:...

WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF

The plugin has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack PoC Make a logged in admin open the URL below 42 being a pre-order to be canceled...

HT Feed < 1.2.8 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Feed plugin = 1.2.7 versions...

Mail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject

The plugin does not adequately sanitize input or escape output for email subjects, resulting in potential for stored cross-site scripting...

WordPress Mobile Pack <= 3.4.1 - Cross-Site Request Forgery

The plugin does not properly validate requests use nonces, leading to a Cross-Site Request Forgery CSRF vulnerability...

WP Dummy Content Generator < 3.0.0 - Cross-Site Request Forgery

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Getnet Argentina para Woocommerce < 0.0.5 - Unauthenticated Authorization Bypass

The plugin does not perform adequate validation on the 'webhook' function, which can lead to an unauthenticated user changing their payment status to 'APPROVED' without making an actual payment...

FluentSMTP < 2.2.5 - Unauthenticated Stored Cross-Site Scripting

The plugin does not adequately sanitize and escape input in the email subject, making it possible to inject arbitrary web scripts that execute when a user accesses the affected page...

WP Mail Log < 1.1.2 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly sanitize and escape email contents, leading to a potential Stored Cross-Site Scripting vulnerability. This issue allows for arbitrary web scripts to be injected into pages, which will execute when a user accesses an affected page...

Media Library Helper by Codexin <= 1.2.0 - Cross-Site Request Forgery

The plugin does not properly validate requests using nonces, making it susceptible to Cross-Site Request Forgery CSRF attacks...

Classified Listing < 2.4.6 - Cross-Site Request Forgery

The plugin does not adequately verify requests using nonces, leading to a potential Cross-Site Request Forgery vulnerability...

WP Reroute Email < 1.5.0 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly sanitize and escape input in the email subject, leading to potential Stored Cross-Site Scripting issues. This flaw allows the injection of arbitrary web scripts that are executed whenever an injected page is accessed...

ARMember < 4.0.6 - ARMember Cross-Site Request Forgery

The plugin does not properly validate nonces in the armcheckusercap function, leading to a potential Cross-Site Request Forgery vulnerability. As a result, unauthenticated users can carry out actions without appropriate permissions, provided they manage to mislead a site administrator into clicki...

WPLMS < 4.900 - Cross-Site Request Forgery

The plugin does not adequately verify requests use nonces, making it susceptible to Cross-Site Request Forgery CSRF attacks...

SMTP Mail <= 1.2.16 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly sanitize and escape input in email subjects when the 'Save Data SendMail' feature is enabled, leading to potential Stored Cross-Site Scripting issues...

ShopLentor < 2.6.3 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Visibility Logic for Elementor < 2.3.5 - Cross-Site Request Forgery

The plugin does not properly validate requests using nonces, which makes it susceptible to Cross-Site Request Forgery attacks...

WP RSS Images <= 1.1 - Cross-Site Request Forgery

The plugin does not adequately verify requests use nonces, leading to a potential Cross-Site Request Forgery vulnerability...

Menubar < 5.9 - Cross-Site Request Forgery

The plugin does not properly implement anti-CSRF measures, potentially making it possible for unwanted actions to be performed in the user's session...

WebwinkelKeur < 3.25 - Cross-Site Request Forgery

Cross-Site Request Forgery CSRF vulnerability in Albert Peschar WebwinkelKeur plugin = 3.24 versions...

Waitlist Woocommerce < 2.5.3 - Settings Reset via CSRF

The plugin does not have CSRF check when reseting its Settings, which could allow attackers to make logged in admins perform such action via a CSRF attack PoC Make a logged in admin open https://example.com/wp-admin/admin.php?page=waitlist-woocommerce-settings=yes...

Login/Signup Popup < 2.4 - Settings Reset via CSRF

The plugin does not have CSRF check when reseting its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack PoC Make a logged in admin open https://example.com/wp-admin/admin.php?page=easy-login-woocommerce-settings=yes...

User Activity Log < 1.6.3 - Admin+ SQL Injection

The plugin does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin. PoC As an admin, visit either of the following URL's. Note that it takes several seconds f...

SP Project & Document Manager < 4.68 - Subscriber+ Insecure Direct Object References

The plugin allows direct access to objects, allowing an authenticated user with subscriber privileges or above, to bypass authorization and change user passwords and potentially take over administrator accounts...

Web3 – Crypto wallet Login & NFT token gating < 2.7.0 - Authentication Bypass

The plugin does not properly perform authentication in the 'hiddenformdata' function, allowing an unauthenticated user to log in as any existing user on the site, such as an administrator, if they have access to the username...

Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

The plugin does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild. PoC POST /register/ HTTP/1.1 Host: wpscan-vulnerability-test-bench.ddev.site...

User Registration < 3.0.2 - Subscriber+ PHP Object Injection

The plugin does not properly sanitize the 'profile-pic-url' parameter, leading to a potential PHP Object Injection. This vulnerability stems from the deserialization of untrusted input, potentially enabling a malicious user with subscriber-level permissions to inject a PHP Object. The issue may...

Short URL < 1.6.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...