14606 matches found
Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting
The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cmplz-proof-of-consent=%22+style%3Danimation-name%3Ashine+onanimationstart%3Dalert%281%29+x%3D...
WP-Appbox < 4.3.18 - Authenticated Local File Inclusion
The plugin does not validate user input before using it to create a local path then passed to an includeonce statement, leading to a Local File Inclusion issue PoC https://example.com/wp-admin/options-general.php?page=wp-appbox=advanced%2F..%2F...
Download Monitor < 4.4.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting issues...
RSVP and Event Management < 2.7.5 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape various parameters before outputting them back in attributes in admin pages, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=rsvp-top-level="="...
Random Banner < 4.1.6 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the /include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects...
Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL Injection
The plugin is affected by a SQL Injection in the id parameter of the delete action. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=aicpbanneduserdetails=delete=0%20OR%201=1%20--%20k...
Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the numofpages parameter before outputting it back the response of the themifycreatepopuppagepagination AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting PoC...
Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure
The plugin allows any logged in user, such as subscriber, to extract any other user's email address. PoC fetch"http://127.0.0.1:8001/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded" , "body": new URLSearchParams"action": "dilazmbqueryselect", "q": "@gma",...
WP Import Export < 3.9.16 - Unauthenticated Sensitive Data Disclosure
The plugins are vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or...
WHMCS Bridge < 6.3 - Subscriber+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting via the ccwhmcsbridgeurl parameter found in the /whmcs-bridge/bridgecp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the ccwhmcsbridgeaddadmin...
PHP Everywhere < 2.0.3 - Arbitrary Settings Update via CSRF
The plugin does not have CSRF check when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue. Note: Vendor decided to close the plugin and it won't be...
NewStatPress < 1.3.6 - Reflected Cross-Site Scripting
The plugin does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=nspsearch&what1;=%27+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28/XSS/%29+x...
XootiX Plugins - Various Versions CSRF to Arbitrary Options Update
The plugins Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce are all vulnerable to cross-site request forgery due to a missing nonce check that would make it possible for attackers to update arbitrary options on a vulnerable WordPress site. PoC...
Quiz And Survey Master < 7.3.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape parameters before outputting them back in the page, leading a Reflected Cross-Site Scripting issue...
Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS
The plugin does not have authorisation and CSRF checks in the ivesavegeneralsettings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue. Note: v1.1.4.7 added CSRF check, authorisation...
WP-DownloadManager < 1.68.7 - Admin+ Stored Cross-Site Scripting
The plugin does not escape some of the download settings such as downloadpath, downloadpathurl and downloadpageurl, which could allow high privilege users to perform Cross-Site Scripting attacks...
Quiz And Survey Master < 7.3.7 - CSRF
The plugin is lacking nonce check, which could allow attacker to make logged users perform unwanted actions via a CSRF attack...
WP Ultimate CSV Importer < 6.4.1 - Subscriber+ Arbitrary File Upload
The plugin does not have authorisation and CSRF checks when uploading zip files via the zipupload AJAX call, and does not perform any check on the files to be extracted. As a result, any authenticated user, such as subscriber could upload an archive with PHP files in it, leading to RCE PoC As any...
Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting
The plugin does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed. PoC In the plugin's settings, put the following values: - In "Step 1: Enter text/HTML to remove one per line" field: powered - In "Step...
Mitsol Social Post Feed <= 1.10 - Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Access Token User acce...
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting
The plugin does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?sibpageform=edit=1=xxxxx%22+accesskey%3DX+onclick%3Dalert%281%29+test%3D%22...
PowerPack Lite for Beaver Builder < 1.2.9.3 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/options-general.php?page=ppbb-settings=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...
Quiz And Survey Master < 7.3.7 - Low Privilege Stored Cross-Site Scripting
The plugin does not sanitise and escape parameters before outputting them in a page, leading a Stored Cross-Site Scripting issue exploitable by low privilege users...
Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting
The plugin does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC 1. Go to settings page available under the...
Adaptive Images < 0.6.69 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the REQUESTURI before outputting it back in a page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-content/plugins/adaptive-images/adaptive-images-script.php/%3Cimg/src/onerror=alert/XSS/%3E/?debug=true...
All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
The plugin was vulnerable to reflected XSS on the my-sticky-elements-leads admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=my-sticky-elements-leads&search-contact;=xxxx%22%3E%3Cimg+src+onerror%3Dalert%281%29+x...
Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Go to the AJAX settings of a Form and put the following payload in the "Minimum number of characters...
Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting
The plugin does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC On the Learning Management page /wp-admin/admin.php?page=cluevo-lms, click Add Course, then put the...
GTranslate < 2.9.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the body parameter in the urladdon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCESALT and NONCEKEY PoC...
SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download
The plugin creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page. PoC Navigate to...
WooCommerce – Store Exporter < 2.7.1 - Reflected Cross-Site Scripting (XSS)
The plugin was affected by a Reflected Cross-Site Scripting XSS vulnerability in the wooce admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wooce=1=%3Cscript%3Ealert1;%3C/script%3E...
Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=woost=%3Cimg+src+onerror%3Dalert%281%29%3E...
Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection
The plugin does not escape the discountcode in one of its REST route available to unauthenticated users before using it in a SQL statement, leading to a SQL injection PoC https://example.com/?restroute=/pmpro/v1/checkoutlevelid=3code=%27%20%20union%20select%20sleep1%20--%20g...
IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban
The plugin does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend. v2.26.5 added...
IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
The plugin does not have CSRF check in the ip2locationcountryblockersaverules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend. PoC Make an admin open a page with the following code in it,...
WordPress < 5.8.3 - SQL Injection via WP_Query
Description Due to improper sanitization in WPQuery, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way...
Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update
The plugin does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example PoC To add a product: fetch"https://example.com/wp-admin/admin-ajax.php",...
WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query
Description Due to lack of proper sanitization in WPMetaQuery, there's potential for blind SQL Injection...
Ultimate Reviews < 3.0.16 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters available to high privilege users such as admin which could allow them to perform Cross-Site Scripting attacks woven when the unfilteredhtml capability is disallowed...
WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs
Description Low-privileged authenticated users like author in WordPress core are able to execute JavaScript/perform stored XSS attack via post slugs, which can affect high-privileged users...
IP2Location Country Blocker < 2.26.5 - Ban Bypass
The plugin bans can be bypassed by using a specific parameter in the URL PoC https://example.com/?admin-ajax=hehe...
RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read
The plugin does not have proper authorisation, CSRF checks and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server PoC As a subscriber, open...
WordPress < 5.8.3 - Super Admin Object Injection in Multisites
Description On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection...
Contact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Create/Edit a form and put the following payload in a Filed Name or...
SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting
The plugin does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored in their cookies with an XSS payloa...
SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue PoC Note: the ticket-creation page is the one with the wpsccreateticket shortcode embed...
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
The plugin does not have authorisation and CRSF checks in its wpsctickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction. Other actions may be affected as well. PoC POST /wp-admin/admin-ajax.php...
Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection
The plugin does not have proper access controls in the saveallorder AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content for example with an XSS...
SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting
The plugin does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks PoC supportcandy page="init';alert/XSS///"...