14633 matches found
WordPress File Upload and WordPress File Upload Pro < 4.19.2 - Admin+ Stored Cross-Site Scripting
The plugin does not properly escape and sanitize user input coming from users with the administrator role in the plugin's settings, which is a problem in multisite configurations...
Go Pricing - WordPress Responsive Pricing Tables < 3.4 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...
Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Incorrect Authorization leading to Arbitrary File Upload
The plugin lacks proper authorization on the file upload feature, making it possible for authenticated users, who belong to specific roles defined by the administrator, to upload arbitrary files...
Go Pricing - WordPress Responsive Pricing Tables < 3.4 - Contributor+ PHP Object Injection via shortcode
The plugin does not sanitize the data parameter of its gopricing shortcode before unserializing it, which could allow users with a role as low as a contributor to perform PHP Object Injection attacks if a suitable gadget chain is found on the site...
WordPress File Upload < 4.19.2 - Admin+ Path Traversal
The plugin does not properly prevent attackers from modifying the target path to which the plugin will move files, via the wfunewpath parameter. This could allow administrators to move files outside of the site's root, which may be a problem in multisite configurations...
Integration for Contact Form 7 and Zoho CRM, Bigin < 1.2.4 - Admin+ SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin PoC 1. Send a GET request with...
Icegram Engage < 3.1.12 - Reflected XSS
The plugin does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below...
Novelist < 1.2.1 - Admin+ Stored XSS
The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup...
Leyka < 3.30.2 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
MStore API < 3.9.2 - Authentication Bypass
The plugin does not properly verify the user provided when syncing their cart via its REST API, allowing unauthenticated users to login as an arbitrary user by providing their ID...
WIP Custom Login < 1.3.0 - Cross-Site Request Forgery (CSRF)
The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...
AI ChatBot < 4.5.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC 1. Go to plugin settings under "WPBot Lite Simple Text Responses" 2. Enter the payload Test Query"...
Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery
The plugin does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. The original researcher didn't provide enough information on which actions could be performed...
Contact Form Entries < 1.3.1 - Contributor+ Stored XSS
The plugin does not sanitize and escape the vx-entries shortcode attributes before using them, which could allow a logged in user with roles as low as contributor to inject arbitrary web scripts into posts or pages...
qubotchat < 1.1.6 - Unauthenticated Stored XSS
The plugin doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard. PoC 1. Enter " as the malicious payload into the chatbot input. 2. See XSS vulnerability...
Leyka < 3.30.3 - Subscriber+ Privilege Escalation
The plugin does not validate password to be updated, allowing any authenticated user, such as subscriber to set the password of another user...
Revolution Slider <= 6.6.12 - Author+ Remote Code Execution
The plugin does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations. By default, the import functionality is only available to Admin users. However, the plugin may be configured to allow...
Rank Math SEO PRO < 3.0.36 - Unauthenticated Reflected XSS
The plugin does not sanitize and escape a parameter before outputting it back in the page, allowing an unauthenticated attacker to inject web scripts that will execute when a visitor follows a crafted link to the page...
WooCommerce Warranty Requests < 2.1.7 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below v = 2.1.6...
WooCommerce Follow-Up Emails < 4.9.50 - Cross-Site Request Forgery (CSRF)
The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...
WP-Piwik < 1.0.28 - Admin+ Stored XSS
The plugin does not sanitize and escape the plugin display name field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
EventPrime < 3.0.0 - Unauthenticated Reflected XSS
The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...
MailChimp Subscribe Forms < 4.0.9.2 - Admin+ Stored XSS
The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup...
Qubotchat < 1.1.6 – Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Add a "button" to the chatbot 2. In the...
Duplicator Pro < 4.5.11.1 - Unauthenticated Reflected XSS
The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...
Responsive Tabs For WPBakery Page Builder <= 1.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC Note: The plugin requires WPBakery Page...
WooCommerce Follow-Up Emails < 4.9.50 - Unauthenticated Reflected XSS
The plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin...
Easy Forms for Mailchimp < 6.8.9 - Reflected XSS
The plugin does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC When the debug settings is enabled ie...
Multiple Plugins from Wow-Company - Reflected XSS
The plugins do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below The XSS will be triggered when pressing...
BEAR < 1.1.3.2 - Cross-Site Request Forgery (CSRF)
The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...
Smart App Banner < 1.1.2 - Cross-Site Request Forgery (CSRF)
The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in user to submit a crafted request...
Groundhogg < 2.7.9.8 - Disable All Plugins via CSRF
The plugin does not have CSRF check when enabling Safe-mode on the plugin, which could allow attackers to make logged-in admins perform such action via a CSRF attack leading to disabling all other plugins...
Groundhogg <= 2.7.9.8 - Lack of Authorization for Non-Arbitrary File upload
The plugin fails to validate the destination contact for the file upload, allowing any Subscriber+ user to upload files to arbitrary contacts...
Groundhogg < 2.7.8.9 - Ticket Creation via CSRF
The plugin does not have CSRF check when creating a support ticket to the plugin author, which could allow attackers to make logged-in admins perform such action via a CSRF attack...
Groundhogg <= 2.7.9.8 - Privilege Escalation via CSRF
The plugin lacks CSRF protection when generating the auto login link through a shortcode, enabling attackers to manipulate the assigned user in the link...
Groundhogg < 2.7.9.8 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WooDiscuz – WooCommerce Comments < 2.3.0 - Admin+ Stored XSS
The plugin is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary we...
Better Notifications for WP < 1.9.3 - Cross-Site Request Forgery (CSRF)
The plugin does not protect its handleactions function against CSRF attacks, allowing an unauthenticated attacker to enable or disable notifications by tricking a logged in administrator to submit a crafted request...
UpdraftPlus < 1.23.4 - CSRF
The plugin does not have CSRF check in the actionauthenticatestorage, which could allow attackers to make logged in admins inject JavaScript into a parameter in the authentication process via a CSRF attack when they can trick an admin to perform multiple actions including re-authenticating a...
Baidu Tongji generator <= 1.0.2 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
BP Social Connect < 1.6.2 - Authentication Bypass
The plugin does not properly verify the user through its Facebook login, which could allow attackers to login as any user knowing their email address...
WeSecur Security <= 1.2.1 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitize and escape user input, leading to a stored XSS vulnerability...
Jazz Popups <= 1.8.7 - Unauthenticated Reflected Cross-Site Scripting
The plugin does not properly sanitize user input, leading to a potential Reflected Cross-Site Scripting XSS vulnerability...
Scripts n Styles < 3.5.8 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Performance Lab < 2.3.0 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WP Activity Log < 4.5.2 - Subscriber+ Information Leak
The plugin does not properly implement a capability check on the handleajaxcall function, leading to an authorization bypass that allows authenticated users to obtain a list of users' information, including ids, usernames, and emails...
WP < 6.2.1 - Contributor+ Content Injection
Description WordPress does not properly sanitise block attributes, which could allow users with a role of Contributor and above to perform content injection in comments on blog using a theme compatible with a block editor...
MStore API < 3.9.1 - Authentication Bypass
The plugin does not properly verify the user provided when redemption coupons via its REST API, allowing unauthenticated users to login as an arbitrary user by providing their ID...
WP < 6.2.1 - Directory Traversal via Translation Files
Description WordPress is affected by a directory traversal via the wplang parameter, which could allow attacker to load arbitrary translation files...
Waiting: One-click countdowns <= 0.6.2 - Subscriber+ Stored XSS
The plugin does not sanitise and escape some parameters, and is missing proper authorisation, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks...