14623 matches found
Active Directory Integration / LDAP Integration < 4.1.6 - Sensitive Information Disclosure
The plugin will expose Sensitive Information due to insufficient sanitization of the supplied username value...
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.6.5 - Authentication Bypass
The improper credential validation on the plugin allows unauthenticated attackers to escalate privileges if administrator's emails is known...
LearnDash LMS < 4.6.0.1 - User Account Takeover via Insecure Direct Object References
The plugin does not correctly manage access to system resources, resulting in Insecure Direct Object References. As a result, users can bypass authorization checks, leading to unauthorized changes to user passwords, potentially compromising administrator accounts...
Quiz Expert – Easy Quiz Maker, Exam and Test Manager <= 1.5.0 - Cross-Site Request Forgery
The plugin does not adequately verify requests, leading to a Cross-Site Request Forgery CSRF vulnerability...
NOO Timetable <= 2.1.3 - Cross-Site Request Forgery
The plugin does not adequately verify incoming requests using nonces, leading to potential Cross-Site Request Forgery vulnerabilities...
WP Abstracts <= 2.6.2 - Cross-Site Request Forgery
The plugin does not sufficiently verify requests use nonces, leading to a CSRF vulnerability...
Salon Booking System < 8.4.8 - User Role change via CSRF
The plugin does not implement nonce checks, which could allow attackers to make a logged in admin change its own user role to customer...
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor < 3.8.0 - Sensitive Data Disclosure
The plugin could expose backup files if the web server had Directory Listing enabled...
TheRoof < 1.0.4 - Unauthenticated Reflected XSS
The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against visitors following crafted links...
Coupon Affiliates < 5.4.4 - Unauthenticated Reflected XSS
The plugin was vulnerable to Unauthenticated Reflected Cross-Site Scripting XSS via the 'wcucoupons' parameter...
Connections Business Directory < 10.4.37 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...
AN_GradeBook <= 5.0.1 - Subscriber+ SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber PoC Access the following URL to demonstrate SQLi:...
Querlo Chatbot <= 1.2.4 - Stored Cross-Site Scripting
The plugin does not escape or sanitize chat messages, leading to a stored Cross-Site Scripting vulnerability. PoC Submit the following in the chat message: """ See the XSS in Querlo...
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite < 1.0.0 - Subscriber+ Stored XSS
The plugin does not sanitize and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...
Order date time for WooCommerce < 3.0.20 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Steps to Reproduce: 1. Open Chaty Plugin...
WooCommerce Stripe Payment Gateway < 7.4.1 - Subscriber+ Order Intent Update
The plugin does not properly restrict users from making a certain set of changes to other customers' orders. TODO: ADD link to Patchstack's post instead of H1 PoC Affected functions: createpaymentintentajax updatepaymentintentajax saveupeappearanceajax updateorderstatusajax updatefailedorderajax ...
Lana Shortcodes < 1.2.0 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC Insert any of the following shortcodes in a...
Subscribe2 – Form, Email Subscribers & Newsletters < 10.41 - Sending Emails via CSRF
The plugin does not implement nonce checks, which could allow attackers to make a logged-in admin send test emails with arbitrary content to users...
Subscribe2 – Form, Email Subscribers & Newsletters < 10.41 - Missing Access Controls
The vulnerability allows any Author leveled users to perform actions that only an administrator should be allowed to do e.g., sending unsolicited e-mail to users...
IFrame Shortcode <= 1.0.5 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...
Beautiful Cookie Consent Banner < 2.10.2 - Unauthenticated Stored Cross-Site Scripting
The plugin is affected by an Unauthenticated Stored Cross-Site Scripting XSS vulnerability due to a lack of input sanitization and output escaping...
SimpleModal Contact Form (SMCF) <= 1.2.9 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite < 1.0.0 - CSRF to Stored XSS
The plugin does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack...
Membership Plugin - Restrict Content < 3.2.3 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged-in admin open a page containing the HTML code below...
POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability delete arbitrary logs via a CSRF attack. Note: The AJAX actions are also affected by SQL injections, making the issue PoC Make a logged in...
Conditional extra fees for WooCommerce < 1.0.97 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Login Configurator <= 2.1 - Reflected Cross-Site Scripting
The plugin does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators. PoC Visit the following path:...
Optin Forms <= 1.3.2 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WooCommerce Pre-Orders < 2.0.2 - Reflected XSS
The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC When there is at least one pre-order, make a logged in admin open the URL below...
NEX-Forms < 8.4.4 - Authenticated Stored XSS
The plugin does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins in multisite / admins in single site can create forms, however there is a settings allowing them to give lower roles access to such feature. PoC Create a new form with the...
Cancel order request WooCommerce < 1.3.3 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Direct checkout, Add to cart redirect for Woocommerce < 2.1.49 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WooCommerce Google Sheet Connector <= 1.3.5 - Access Code Update via CSRF
The plugin does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack PoC Make a logged in admin open https://example.com/wp-admin/admin.php?page=wc-gsheetconnector-config=attacker-code...
POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability resend an email to an arbitrary address for example a password reset email could be resent to an attacker controlled email, and allow them to...
Lana Text to Image < 1.1.0 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitize or escape some of its settings before outputting them in the admin's dashboard, allowing Contributor+ privileged users to perform Cross-Site Scripting attacks against other users even when the unfilteredhtml capability is disallowed...
Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS
The plugin does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability. PoC 1. Upload an SVG file with the following contents. 2. View the SVG file on the frontend and see the alerts...
InventoryPress <= 1.7 - Author+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks. PoC 1. Create a "New Inventory Item" 2. In the "Description" field, add the value " 3. Edit the created item and see the XSS...
OOPSpam Anti-Spam < 1.1.45 - Cross-Site Request Forgery
The plugin does not adequately verify requests use nonces, leading to a potential Cross-Site Request Forgery vulnerability...
JS Help Desk – Best Help Desk & Support <= 2.7.7 - Ticket Manipulation via IDOR
Submission imported from CVE-2023-23679. Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7...
MStore API < 3.9.8 - Unauthenticated SQL Injection
The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
MainWP Child < 4.4.1.1 - Sensitive File Disclosure
The plugin uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files...
MStore API < 4.0.2 - Unauthenticated SQL Injection
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
Supsystic Popup < 1.10.19 - Prototype Pollution
The plugin has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype. PoC 1 Create a pop-up that is set to load on any page 2 Go to http://example.com/?protopoc=polluted 3 Open browser console 4 Type poc and see polluted as the resul...
WPBakery Page Builder < 6.13.0 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
About Me 3000 widget <= 2.2.6 - Administrator Stored Cross-Site Scripting
The plugin does not sufficiently sanitize user inputs nor escape output in the admin settings, leading to a Stored Cross-Site Scripting vulnerability. This can result in the injection of arbitrary web scripts in pages that execute when a user accesses an injected page. The issue primarily affects...
Metform Elementor Contact Form Builder < 3.3.3 - Cross-Site Request Forgery
The plugin does not correctly validate nonces on the permalinksetup function. This can potentially enable the alteration of permalink structure via a forged request, if an administrator is tricked into clicking a deceptive link. Verification only takes place when a nonce is provided, leaving the...
Ninja Forms < 3.6.25 - Admin+ Arbitrary File Deletion
The plugin does not validate the path of files to be deleted, which could allow administrators to delete arbitrary files on the server even when they should not be able to...
Event Manager for WooCommerce < 3.9.6 - Editor+ Stored Cross-Site Scripting
The plugin does not correctly sanitize user inputs, leading to potential Stored Cross-Site Scripting XSS vulnerabilities...