14623 matches found
Multiple YITH WooCommerce plugins - Cross-Site Scripting via shortcode ajax
Multiple plugins from YITH does not protect its ajax actions against CSRF attacks, allowing an attacker to trick a logged in user to perform actions on their behalf by submitting a crafted request...
Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR Deserialisation
The plugin does not validate user input before using it in fileexist functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present...
Contest Gallery < 19.1.5.1 - Author+ SQL Injection
The plugins do not escape the upload POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database. PoC POST...
Contest Gallery < 19.1.5 - Author+ SQL Injection
The plugins do not escape the optionid POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database. PoC POST...
2kb Amazon Affiliates Store <= 2.1.5 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
Plugin Logic < 1.0.8 - Admin+ SQLi
The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin PoC POST /wp-admin/network/plugins.php?page=plugin-logic=options%20union%20SELECT%20SLEEP16%3b%23 HTTP/1.1 Content-Type:...
Chained Quiz < 1.3.2.3 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the dn parameter before outputting it back in the chainedquizlist page, leading to a Reflected Cross-Site Scripting...
Simple Basic Contact Form < 20221201 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to "Settings » Contact Form » Plugin...
Chained Quiz < 1.3.2.4 - Multiple Reflected Cross-Site Scripting
The plugin does not sanitise and escape the ip and date parameters before outputting them back in the chainedquizlist page, which could lead to reflected Cross-Site Scripting...
WP Google Review Slider < 11.6 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC POST /wp-admin/admin-ajax.php?fsblogadmin=tru...
Chained Quiz < 1.3.2.5 - Arbitrary Question Deletion via CSRF
The plugin does not have CSRF check when deleting questions, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Chained Quiz < 1.3.2.5 - Submitted Quiz Response Deletion via CSRF
The plugin does not have CSRF checks when deleting submitted quiz response, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Chained Quiz < 1.3.2.5 - Arbitrary Quiz Deletion & Copying via CSRF
The plugin does not have CSRF checks when deleting and copying quiz, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
Chained Quiz < 1.3.2.3 - Admin+ Stored XSS
The plugin does not sanitise and escape its facebookappid and apikey settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Chained Quiz < 1.3.2.1 - Multiple Reflected Cross-Site Scripting
The plugin does not sanitise and escape the ipf, emailf, dnf, pointsf and datef parameters before outputting them back in the chainedquizlist page, leading to a Reflected Cross-Site Scripting...
ImageInject <= 1.17 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC POST...
Advanced Booking Calendar <= 1.7.1 - Unauthenticated SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR
The theme does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreapaddonsserviceremove action, allowing any user to delete any post by knowing or guessing the id. PoC POST /testt/wp-admin/admin-ajax.php HTTP/...
ARMember < 5.6 - Unauthenticated Privilege Escalation
The plugin could allow unauthenticated attackers to escalate themselves as admin...
Google Apps Login < 3.4.5 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to the setting page of this plugin. 2...
Advanced Booking Calendar <= 1.7.1 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Afterpay Gateway for WooCommerce < 3.5.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters, allowing an attacker to trick a visitor to send a request with XSS payloads that will trigger when they visit the site...
Afterpay Gateway for WooCommerce < 3.5.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the orderToken parameter before outputting it back in the page via an error message, leading to a Reflected Cross-Site Scripting...
Easy WP SMTP < 1.5.2 - Admin+ Arbitrary File Deletion
The plugin does not validate some user input used to generate paths, which could allow high privilege users such as admin to delete arbitrary files even when they should not be able to, for example in multisite via a traversal attack...
Sliderby10Web < 1.2.53 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to "Slider » Sliders" and edit one of...
Eventify <= 2.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to Settings » Eventify. 2. Under...
Custom Product Tabs for WooCommerce < 1.8.0 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Paytium < 4.3.7 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to Playtium » Settings and in the 'Test...
Easy WP SMTP < 1.5.2 - Admin+ RCE
The plugin could allow high privilege users such as admin to perform RCE even when they should not be able to for example in multisite setups...
Easy WP SMTP < 1.5.2 - Admin+ Arbitrary File Access
The plugin does not validate some user input used to generate paths, which could allow high privilege users such as admin to access arbitrary files even when they should not be able to, for example in multisite via a traversal attack...
Advanced Coupons for WooCommerce Coupons < 4.5.0.1 - Notice Dismiss via CSRF
The plugin does not have CSRF check when dismissing notices, which could allow attackers to make logged in users dismiss the Getting Started notice via a CSRF attack...
Simple:Press < 6.8.1 - Unauthenticated Stored XSS via Forum Replies
The plugin does not sanitise and escape the postitem parameter when posting a forum reply, which could allow unauthenticated users to perform Stored XSS attacks...
Simple:Press < 6.8.1 - Admin+ Arbitrary File Update
The plugin does not validate files to be updated, which could allow high privilege users such as admin to update arbitrary files and not just the one allowed by the plugin...
Quiz and Survey Master < 8.0.5 - Improper Input Validation
The plugin does not properly validate the questionid parameter, which could allow attackers to send values other than the expected type...
Appointment Hour Booking < 1.3.73 - CSV Injection
The plugin does not validate data when output it back in a CSV file, which could lead to CSV injection...
Simple:Press < 6.8.1 - Subscriber+ Arbitrary File Deletion
The plugin does not validate a file parameter when a user delete its avatar, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server...
WP CSV Exporter < 1.3.7 - CSV Injection
The plugin does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability. PoC - create a post using =5+5 as the title - export the data as CSV - open the CSV with a spreadsheet application Excel, Libre Office - the CSV formula gets executed...
Appointment Hour Booking < 1.3.73 - CAPTCHA Bypass
The plugin does not have a strong hashing algorithm on the CAPTCHA secret, and displays it to the user via a cookie, which could allow them to bypass the protection in place...
Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution
The plugin doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment. PoC 1. As an admin, go to "Appearance - Menus" and create a menu with some items of your choice...
Appointment Hour Booking < 1.3.73 - Unauthenticated iFrame Injection
The plugin does not sanitise and escape the email and general field parameters, which could allow unauthenticated users to perform iFrame injection attack PoC As an unauthenticated user, submit a booking and put an iFrame payload in the email/general field parameter The iFrame will be executed wh...
Simple:Press < 6.8.1 - Subscriber+ Stored XSS via Profile Signatures
The plugin does not sanitise and escape the postitem parameter when modifying profile signatures, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...
Quiz and Survey Master < 8.0.5 - Unauthenticated iFrame Injection
The plugin does not sanitise and escape the questionid parameter, which could allow unauthenticated users to perform iFrame injection attack...
Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure
The plugin does not prevent users with low privileges like subscribers from accessing sensitive system information. PoC fetch'http://wpscan.local/wp-admin/admin-ajax.php', method: 'POST', headers: new Headers 'Content-Type': 'application/x-www-form-urlencoded', , body: 'action=sendsysteminfo',...
Wholesale Market for WooCommerce < 1.0.7 - Unauthenticated Arbitrary File Download
The plugin does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server. Note: v1.0.7 added capability check, making the issue still exploitable by high privilege users such a...
Theme and plugin translation for Polylang < 3.2.17 - Unauthenticated Translation Settings Update
The theme does not have authorisation in the processpolylangthemetranslationwploaded function, which could allow unauthenticated attack to update translation settings, as well as import arbitrary translations...
JoomSport < 5.2.8 - Unauthenticated SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users PoC 1. Install the vulnerable plugin joomsport-sports-league-results-management version 5.2.6, skip the demo data import when prompted...
InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE
The plugin insecurely uses PHP's extract function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers. PoC Invoke the following shell commands to disclose the /etc/passwd file: Define the payload "pagepath"...
FlyingPress < 3.9.7 - Arbitrary Settings Update to Stored XSS
The plugin does not have authorisation in various AJAX actions, allowing any authenticated users, such as subscribers to call them. One of those actions could allow them to rewrite static files URL JS, CSS etc to a malicious CDN under their control, which could lead to XSS...
Popup Manager <= 1.6.6 - Unauthenticated Stored XSS
The plugin does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well PoC fetch'/wp-admin/admin-ajax.php', method: 'POST',...
SEO Plugin by Squirrly SEO < 12.1.11 - Contributor+ Arbitrary File Upload
The plugin does not validate files to be uploaded, which could allow users with a role as low as contributor to upload arbitrary files such as PHP...