Realty Workstation < 1.0.15 - Agent SQLi

The plugin does not sanitise and escape the transedit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection PoC As a logged in agent: https://example.com/workstation/?transactions=opentransactionsedit=1%20AND%20SELECT%2042%20FROM%20SELECTSLEEP5...

Logo Slider <= 1.4.8 - Admin+ SQLi

The plugin does not sanitise and escape the lspsliderid parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection PoC https://example.com/wp-admin/admin.php?page=manageimagessliderid=1+AND+SELECT+7741+FROM+SELECTSLEEP5hlAf...

Amazon Link <= 3.2.10 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. PoC Put the following payload in settings such as the "AWS Public Key": "...

User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC An an admin -...

Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update

The plugin does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector PoC curl --url...

External Links in New Window / New Tab < 1.43 - Tabnabbing

The plugin does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur. PoC Create an external link, check window.opener in the newly opened tab after clicking the external link...

No Future Posts <= 1.4 - Admin+ Stored Cross-Site Scripting

The plugin does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed PoC Put the following payload in any of the plugin's settings such as Exclude posts IDs and save: " autofocus onfocus=alert/XSS//...

JivoChat < 1.3.5.4 - Stored Cross-Site Scripting via CSRF

The plugin does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript. PoC XSS will be triggered...

HPB Dashboard <= 1.3.1 - Admin+ Stored Cross Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. PoC Put the following payload in the plugin's settings: "...

IMDB info box <= 2.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC As administrator, put the following payload in any of the plugin's settings and save: "...

PNG to JPG < 4.1 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in place when updating its settings, allowing attackers to make a logged in admin do such action via a CSRF attack which could lead to Stored XSS issues due to the lack of sanitisation and escaping in some of them...

Remove CPT Base < 5.9 - CPT Deletion via CSRF

The plugin does not have CSRF check in place when deleting the custom post type CPT, allowing attackers to make a logged in admin do such action via a CSRF attack...

WP 2FA < 2.2.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wp-2fa-settingserror=...

Checkout Files Upload for WooCommerce < 2.1.3 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape filenames before outputting them back in order confirmation page, leading to a Reflected Cross-Site Scripting...

Image Hover Effects Ultimate < 9.7.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting...

WP Slider <= 1.4.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...

Disable Right Click For WP <= 1.1.6 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Andrea Pernici News Sitemap for Google <= 1.0.16 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfilteredhtml is disallowed PoC Put the following payload in any of the Mailchimp integration settings...

Code Snippets Extended <= 1.4.7 - RCE via CSRF

The plugin could allow attackers to perform RCE by using a CSRF attack against a logged in admin...

Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting

The plugin does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious...

Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG

The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads PoC As an author or above, upload the below SVG file via the Media library: The XSS will be triggered when accessing the file directly, e.g...

WP JS <= 2.0.6 - Reflected Cross-Site Scripting

The plugin contains a script called wp-js.php with the function wpjsadmin, that accepts unvalidated user input and echoes it back to the user, leading to a Reflected Cross-Site Scripting...

VikBooking < 1.5.9 - Reflected Cross-Site Scripting

The plugin does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/?test%22-alert/XSS/-%22 https://example.com/wp-admin/profile.php?test%22-alert/XSS/-%22...

Helpful < 4.5.15 - Votes Tampering

The plugin allowed users to vote more than once, which could allow attackers to increase votes drastically on some posts...

StaffList < 3.1.6 - Reflected Cross-Site Scripting

The plugin does to sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=stafflist=1=1%27%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...

Content Mask < 1.8.4.1 - Subscriber+ Arbitrary Options Update

The plugin does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options PoC POST /wp-admin/admin-ajax.php...

WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi

The plugin fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability. PoC curl 'http://127.0.0.1:8080/wp-admin/admin-ajax.php?action=WPContactsManagercall=get-contact' \ --data '"id":"1\u0027...

Check & Log email < 1.0.6 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=check-email-settings="...

StaffList < 3.1.5 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection PoC https://example.com/wp-admin/admin.php?page=stafflist=test%'+AND+SELECT+42+FROM+SELECTSLEEP5b+AND+'aa%'='aa...

WP Subscribe < 1.2.13 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its widgets settings, which could allow high privilege users such as admin to perform Cross-Site Scripting even when unfilteredhtml is disallowed PoC Add the widget of the plugin to a page, and put the following payload in settings such as "Title",...

Tabs Responsive < 2.2.8 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Create/edit a Tab via the plugin, and put the following payload in a Tab...

WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs

The plugin does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. PoC As admin, put the following payload in the Breadcrumb...

Breeze < 2.0.3 - Subscriber+ Arbitrary Settings Update to Stored XSS

The plugin is lacking authorisation, CSRF and sanitisation in its AJAX actions available to any authenticated users, which could allow any logged in user to change the plugin's settings and perform XSS attacks...

Nirweb support < 2.8.2 - Unauthenticated SQLi

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an SQL injection PoC curl https://example.com/wp-admin/admin-ajax.php --data 'action=answerdticketform=1 UNION ALL SELECT NULL,NULL,SELECT...

StaffList < 3.1.6 - Arbitrary Staff Deletion via CSRF

The plugin does not have CSRF check in place when deleting staff members, which could allow attacker to make a logged in admin perform such action and delete arbitrary staff via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=stafflist=last=1=1...

Ultimate Member < 2.3.2 - Open Redirect

The plugin is vulnerable to open redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims...

Footer Text <= 2.0.3 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF in place when updating its settings, and is lacking sanitisation as well as escaping in them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks...

Hermit <= 3.1.6 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in when creating a source, and does not sanitise as well as escape the title, which could allow attackers to make a logged in user create an arbitrary source with an XSS payload in it...

Hermit <= 3.1.6 - Unauthenticated SQLi

The plugin does not sanitise and escape the id parameter before using it in a SQL statement, leading to a SQL injection...

Countdown & Clock < 2.3.3 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the ycdtype parameter before outputting back in a page, leading to a Reflected Cross-Site Scripting...

Countdown & Clock <= 2.3.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...

Countdown & Clock <= 2.3.2 - Pro Features Lock Bypass

The plugin does not properly lock its Pro features which could allow high privilege users such as admin to bypass the restriction and use them...

All-in-One WP Migration < 7.59 - Admin+ File Deletion on Windows Hosts via Path Traversal

The plugin is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the /lib/model/class-ai1wm-backups.php file which can be exploited by administrative users, and users who have access to the site’s secret key on WordPress instances with Windows...

Hermit <= 3.1.6 - Subscriber+ SQLi

The plugin does not sanitise and escape the ids parameter before using it in a SQL statement, leading to a SQL injection...

Hermit <= 3.1.6 - Arbitrary Cache/Source Deletion & Source Creation via CSRF

The plugin does not have CSRF checks in multiple actions, which could allow attackers to make logged in users perform them via CSRF attacks...

Ravpage <= 2.16 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape various base64 encoded parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting...

WP-Invoice <= 4.3.1 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attacker to make a logged in admin update them and change the minimum role allowed to access the plugin's features to subscriber for example, which would make invoices available to any authenticated users P...

Booking Calendar < 9.1.1 - PHP Object Injection

The plugin unserializes user data without being validated first, which could allow attackers to perform PHP object injection attack. If a timeline is published, unauthenticated attackers could perform such attack, otherwise any authenticated could. A suitable POP chain, from another plugin for...

Coru LFMember <= 1.0.2 - Arbitrary Game Deletion/Activation via CSRF

The plugin does not have CSRF in place when deleting and activating games, which could allow attacker to make a logged in admin perform such actions PoC...