14633 matches found
Event Monster < 1.2.1 - Admin+ SQLi
The plugin does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users PoC...
Booster for WooCommerce - Checkout Files Deletion via CSRF
The plugins do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack PoC Requirements: - Enable the "Checkout File Upload" module of the plugin...
Booster for WooCommerce - ShopManager+ Arbitrary File Download
The plugins do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to for example in multisite PoC Enable the "Checkout File Upload" module and open the following URL ...
miniOrange's Google Authenticator < 5.6.2 - Subscriber+ Settings Update
The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Restaurant Menu < 2.3.2 - Multiple CSRF
The plugin does not have proper CSRF checks in some AJAX actions, allowing any attackers to make a logged in admin perform unwanted actions via CSRF attacks...
TeraWallet – For WooCommerce < 1.4.0 - Settings Update via CSRF
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Appointment Hour Booking < 1.3.72 - Feedback Submission via CSRF
The plugin does not have CSRF check when submitting feedback, which could allow attackers to make logged in users do such action on their behalf via a CSRF attack...
Appointment Booking Calendar < 1.3.70 - Feedback Submission via CSRF
The plugin does not have CSRF check when submitting feedback, which could allow attackers to make logged in users do such action on their behalf via a CSRF attack...
Advanced Dynamic Pricing for WooCommerce < 4.1.6 - Settings Import via CSRF
The plugin does not have CSRF check in place when importing its settings, which could allow attackers to make a logged in admin import them via a CSRF attack...
Soledad < 8.2.6 - Subscriber+ Cross-Site Scripting
The plugin does not sanitise and escape a parameter, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...
Advanced Dynamic Pricing for WooCommerce < 4.1.6 - Rule Type Migration via CSRF
The plugin does not have CSRF check when migrating rule types, which could allow attackers to make logged in admin perform such action via a CSRF attack...
Evaluate <= 1.0 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup. PoC 1. Go to Settings » Evaluate » Add New. 2...
Ultimate Member < 2.5.1 - Subscriber+ RCE
The plugin does not validate user input passed to calluserfunc via the populatedropdownoptions function, which could allow any authenticated users, such as subscriber to call arbitrary functions without argument ie phpinfo...
Creative Mail < 1.6.0 - Settings Reset via CSRF
The plugin does not have CSRF check when resetting its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Modula < 2.6.91 - Unauthenticated Troubleshooting Settings Update
The plugin does not have authorisation and CSRF checks when updating its troubleshooting settings, which could allow any unauthenticated user to update them...
Creative Mail < 1.6.0 - CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins perform unwanted actions such as Update Marketing Information via CSRF attacks...
WP Best Quiz <= 1.0 - Author+ Stored XSS
The plugin does not sanitize and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks. PoC 1. Go to Quiz » Add Categories. 2. Inset a category with the payload as name: . 3. The XSS will be trigged when accessing the Add Categories...
Spacer < 3.0.7 - Admin+ Stored XSS
The plugin does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup. PoC Add new Spacers and add payload " Gem to...
Api2Cart Bridge Connector < 1.2.0 - Unauthenticated RCE
The plugin does not validate some parameters which could lead to RCE...
Api2Cart Bridge Connector < 1.2.0 - Unauthenticated Arbitrary File Upload
The plugin does not validate file to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP...
Login Block IPs <= 1.0.0 - IP Spoofing Bypass
The function checkisloginpage uses headers for the IP check, which can be easily spoofed. PoC Set HTTPCLIENTIP to bypass blocks / use allowed IP addresses...
Booster for WooCommerce < 5.6.7 - Settings Reset via CSRF
The plugin does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...
Ultimate Member < 2.5.1 - Admin+ LFI via Traversal
The plugin does not validate and sanitize the pack parameter before using it in an include statement, which could allow high privilege users to perform local file inclusion attacks via a Traversal vector...
Creative Mail < 1.6.0 - Multiple CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as enable disable contact sync, reset the plugin, unlink accounts and update email marketing settings...
Ultimate Member < 2.5.1 - Contributor+ LFI via Traversal
The plugin does not validate and sanitize the template attribute of its shortcode before using it in an include statement, which could allow users with a role as low as contributor to perform local file inclusion attacks via a Traversal vector...
My wpdb < 2.5 - Arbitrary SQL Query via CSRF
The plugin is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack PoC...
Ultimate Member < 2.5.1 - Admin+ RCE
The plugin does not validate user input passed to calluserfunc via the getoptionvaluefromcallback function, which could allow high privilege users to perform RCE even when they are not allowed to for example in multisite setup...
Avada < 7.8.2 - Arbitrary Plugin Instalation/Activation via CRSF
Description The theme does not have CSRF check when installing and activating plugins, which could allow attackers to make logged admins install and activate arbitrary plugins via CSRF attacks...
Zoho CRM Lead Magnet < 1.7.6.2 - Subscriber+ Arbitrary Options Update
The plugin does not have authorisation and CSRF in some AJAX actions, and does not ensure that the option to be updated belong to the plugin. As a result, any authenticated users, such as subscriber could update arbitrary blog options such as defaultrole and userscanregister. PoC v response.text...
All in One SEO Pro < 4.2.6 - Admin+ SSRF
The plugin does not validate a parameter before making a request to it, which could allow users with a role as low as Admin to perform SSRF attack...
Contact Form 7 Database Addon < 1.2.6.5 - CSV Injection
The plugin does not validate data when output it back in a CSV file, which could lead to CSV injection PoC Use a Contact Form 7 form and submit an Excel formula in the message field, such as "=5+5" without quotes. Export the entry as CSV using the plugin and import it into Excel...
Web Stories < 1.25.0 - Subscriber+ Server Side Request Forgery
The plugin does not validate the url parameter passed to the v1/hotlink/proxy REST endpoint, allowing any authenticated users to perform SSRF attacks...
Grid Kit Premium <= 1.8.53 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in various pages, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=grid-kit=edit=...
Image Hover Effects Ultimate < 9.7.2 - Authenticated Arbitrary Options Change
The plugin does not ensure that the options to be updated belong to the plugin, which could allow high privilege users to update arbitrary options even when they should not be allowed to...
SEO Redirection Plugin < 9.1 - Multiple CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
IP Blacklist Cloud Plugin <= 5.00 - Admin+ SQLi
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
SearchWP < 4.2.6 - Subscriber+ Settings Update
The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Traffic Manager <= 1.4.5 - Subscriber+ Stored Cross-Site Scripting
The plugin does not authorisation and does not sanitise as well as escape some parameters, which could allow users with a role as low as subscriber to perform Stored Cross-Site Scripting attacks...
Phone Orders for WooCommerce < 3.7.2 - Subscriber+ Sensitive Data Exposure
The plugin disclose unspecified sensitive information to low privilege users such as subscriber...
tagDiv Composer < 3.5 - Unauthenticated Account Takeover
Description The plugin, required by the themes, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address PoC Run the below command in the developer console of the web browser while being on the blog as an...
IP Blacklist Cloud Plugin <= 5.00 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Contact Form Entries < 1.3.0 - CSV Injection
The plugin does not validate data when its output in a CSV file, which could lead to CSV injection. PoC - Submit a form using Contact Form 7, Ninja Forms, Elementor Forms or WP Forms using =5+5 as the value - Export the data as CSV /wp-admin/admin.php?page=vxcfleads - Open the CSV with a...
Quiz And Survey Master < 7.3.11 - Sensitive Information Disclosure
The plugin discloses unspecified sensitive information...
Quiz And Survey Master < 7.3.11 - Bypass
The plugin is affected by an unspecified bypass issue...
Quiz And Survey Master < 7.3.11 - Subscriber+ XSS
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks...
Quiz And Survey Master < 7.3.5 - Admin+ SQL Injection
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users...
Quiz And Survey Master < 7.3.5 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting against users with a role as low as editor...
Quiz And Survey Master < 7.3.5 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
Better Messages < 1.9.10.69 - Subscriber+ SSRF
The plugin does not validate a parameter before making a request to it, which could allow users with a role as low as subscriber to perform SSRF attacks...
WP Page Builder < 1.2.7 - Author+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks...