Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape $GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=advanceddbcleanertab=optionscat=all&'=...

Anti-Malware Security and Brute-Force Firewall < 4.20.94 - Admin+ Reflected Cross-Site Scripting

The plugin does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user...

Ad Inserter < 2.7.10 - Reflected Cross-Site Scripting

The plugins do not sanitise and escape the htmlelementselection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting PoC...

WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS

The plugin does not sanitise and escape the packageids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue PoC...

Shield Security < 13.0.6 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed. PoC Put the following payload as an Admin Note Shield Security Tools Admin Notes:...

WOOCS < 1.3.7.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action available to both unauthenticated and authenticated users before outputting it back in the response, leading to a Reflected Cross-Site Scripting PoC...

WP HTML Mail < 3.1 - Unprotected REST-API Endpoint

The plugin is vulnerable to setting changes and stored cross-site scripting due to misconfigured authorization controls on the /themesettings REST API endpoint...

AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race Condition

The plugin is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users PoC https://www.youtube.com/watch?v=0IqZL-slt00 1. Make a new comment 2. Like your comment and intercept it...

AnyComment < 0.2.18 - Arbitrary HyperComments Import/Revert via CSRF

The plugin does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack PoC Go to https://example.com/wordpress/wp-admin/admin.php?r=import%2Fhypercomments=http://, and you will see a get request in yo...

Give < 2.17.3 - Reflected Cross-Site Scripting via Import Tool

The plugin does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting PoC...

Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard

The plugin does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting PoC...

ProfileGrid < 4.7.5 - Subscriber+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pmuseravatar and pmcoverimage parameters found in the /admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts...

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

The plugin does not sanitise and escape the formid parameter before outputting it back in the response of an unauthenticated request via the givecheckoutlogin AJAX action, leading to a Reflected Cross-Site Scripting PoC As an unauthenticated user:...

Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS

The plugin does not have any authorisation and CSRF in its bpfwpwelcomeaddcontactpage and bpfwpwelcomesetcontactinformation AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting...

Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard PoC As a contributor, create/edit a gallery and add the followi...

Translation Exchange <= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin was vulnerable to Authenticated Stored Cross-Site Scripting XSS within the Project Key text field found in the plugin's settings. PoC 1. Click on Use on translation exchange connector 2. In Basic Settings,insert following payload in Project Key text field. " 3. Click Save Changes...

FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

The plugin is affected by a Reflected Cross-Site Scripting XSS within the "visibility" parameter. PoC https://example.com/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php=%22%3E%3Cimg+src%3D2+onerror%3Dalert%28origin%29%3E...

The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)

The plugin was vulnerable to Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field. PoC 1. Insert below payload in the Twitter username to mention text field " 2. Click on Save Changes...

Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting

The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cmplz-proof-of-consent=%22+style%3Danimation-name%3Ashine+onanimationstart%3Dalert%281%29+x%3D...

Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting

The plugins do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/index.php?p=%3Cimg%20src%20onerror=alert/XSS/%3Eurl=1...

Magee Shortcodes < 2.0.9 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape various parameters before outputting them back in attributes in AJAX actions available to both unauthenticated and authenticated users, leading to Reflected Cross-Site Scripting issues PoC...

Noptin < 1.6.5 - Open Redirect

The plugin does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue PoC https://example.com/?noptinns=emailclick=https://wpscan.com...

Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service

The plugin autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog PoC 1 Create a popup as admin and access the popup page as unauthenticated 2 Send data on the form and interce...

WP-Appbox < 4.3.18 - Authenticated Local File Inclusion

The plugin does not validate user input before using it to create a local path then passed to an includeonce statement, leading to a Local File Inclusion issue PoC https://example.com/wp-admin/options-general.php?page=wp-appbox=advanced%2F..%2F...

WP Ultimate CSV Importer < 6.4.2 - Subscriber+ Arbitrary Option Deletion

The plugin does not have authorisation and CSRF checks when deleting options via the disablemainmode AJAX action, and does not ensure that the option to be delete belong to the plugin. As a result, any authenticated user, such as subscriber, could delete arbitrary options from the blog PoC POST...

Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update

The plugin allows any user, even not logged in, to arbitrarily change the coming soon page layout. PoC wget 127.0.0.1:8001...

MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting

The plugin does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting PoC https://example.com/?mappiframe=1=--%3E%3Cimg%20src%20onerror=alert/XSS/%3E...

PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS

The plugin does not have authorisation and CSRF checks in the ppomsettingspanelaction AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues PoC 1. Use the new settings panel...

Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin PoC POST /wp-json/contact-form-7/v1/contact-forms/1337/feedback HTTP/2 Content-Type: multipart/form-data;...

WHMCS Bridge < 6.3 - Subscriber+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting via the ccwhmcsbridgeurl parameter found in the /whmcs-bridge/bridgecp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the ccwhmcsbridgeaddadmin...

RSVP and Event Management < 2.7.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape various parameters before outputting them back in attributes in admin pages, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=rsvp-top-level="="...

Random Banner < 4.1.6 - Admin+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the /include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects...

WP Import Export < 3.9.16 - Unauthenticated Sensitive Data Disclosure

The plugins are vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or...

Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure

The plugin allows any logged in user, such as subscriber, to extract any other user's email address. PoC fetch"http://127.0.0.1:8001/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded" , "body": new URLSearchParams"action": "dilazmbqueryselect", "q": "@gma",...

Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL Injection

The plugin is affected by a SQL Injection in the id parameter of the delete action. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=aicpbanneduserdetails=delete=0%20OR%201=1%20--%20k...

Download Monitor < 4.4.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting issues...

Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the numofpages parameter before outputting it back the response of the themifycreatepopuppagepagination AJAX action available to any authenticated user, leading to a Reflected Cross-Site Scripting PoC...

XootiX Plugins - Various Versions CSRF to Arbitrary Options Update

The plugins Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce are all vulnerable to cross-site request forgery due to a missing nonce check that would make it possible for attackers to update arbitrary options on a vulnerable WordPress site. PoC...

SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue. Note: Vendor decided to close the plugin and it won't be...

NewStatPress < 1.3.6 - Reflected Cross-Site Scripting

The plugin does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=nspsearch&what1;=%27+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28/XSS/%29+x...

PHP Everywhere < 2.0.3 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS

The plugin does not have authorisation and CSRF checks in the ivesavegeneralsettings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue. Note: v1.1.4.7 added CSRF check, authorisation...

PowerPack Lite for Beaver Builder < 1.2.9.3 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/options-general.php?page=ppbb-settings=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...

Quiz And Survey Master < 7.3.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape parameters before outputting them back in the page, leading a Reflected Cross-Site Scripting issue...

Quiz And Survey Master < 7.3.7 - CSRF

The plugin is lacking nonce check, which could allow attacker to make logged users perform unwanted actions via a CSRF attack...

WP Ultimate CSV Importer < 6.4.1 - Subscriber+ Arbitrary File Upload

The plugin does not have authorisation and CSRF checks when uploading zip files via the zipupload AJAX call, and does not perform any check on the files to be extracted. As a result, any authenticated user, such as subscriber could upload an archive with PHP files in it, leading to RCE PoC As any...

Quiz And Survey Master < 7.3.7 - Low Privilege Stored Cross-Site Scripting

The plugin does not sanitise and escape parameters before outputting them in a page, leading a Stored Cross-Site Scripting issue exploitable by low privilege users...

WP-DownloadManager < 1.68.7 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of the download settings such as downloadpath, downloadpathurl and downloadpageurl, which could allow high privilege users to perform Cross-Site Scripting attacks...

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting

The plugin does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?sibpageform=edit=1=xxxxx%22+accesskey%3DX+onclick%3Dalert%281%29+test%3D%22...

Mitsol Social Post Feed <= 1.10 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Access Token User acce...