14624 matches found
Variation Swatches for WooCommerce < 2.1.2 - Subscriber+ Stored Cross-Site Scripting
The plugin does not have authorisation and CSRF checks in the tawcvssavesettings, updateattributetypesetting and updateproductattrtype AJAX actions, allowing any authenticated users to call them. The tawcvssavesettings could especially be used to update the plugin’s settings and add XSS payloads...
LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting
The plugin does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting PoC As admin, enter the following payload in the Domain Key setting of the plugin: Then open...
Video Conferencing with Zoom < 3.8.16 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape user data before outputting it back in attributes in some admin pages, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/edit.php?posttype=zoom-meetings=zoom-video-conferencingid="...
LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS
The plugin does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then ...
Contact Form With Captcha <= 1.6.2 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts...
Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Add/edit a new button, set its Button action to "Website...
Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads PoC fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...
WP Mail Logging < 1.10.0 - Outdated Redux Framework
The plugin uses an outdated version of the Redux Framework, which is know to be affected by security issues CVE-2021-38312 and CVE-2021-38314, and could allow unauthenticated attackers to change some of the Framework settings by using CVE-2021-38314 PoC The first endpoint we can identify is...
WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting
The plugin does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprssdismissaddonnotice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and se...
Asgaros Forums < 1.15.14 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the /admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations wher...
Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting
The plugin does not sanitise and escape Template data before outputting it in various pages such as admin dashboard and frontend. Due to the lack of authorisation and CSRF checks in the wpdmsavetemplate AJAX action, any authenticated users such as subscriber is able to call it and perform...
CorreosExpress <= 2.6.0 - Sensitive Information Disclosure
The plugin generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses PoC https://example.com/wp-content/plugins/correos-express/log/logcronfunction.txt...
MOLIE <= 0.5 - Authenticated SQL Injection
The plugin does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection PoC https://example.com/wp-admin/post.php?post=validpostid+and+SLEEP%285%29=edit https://example.com/wp-admin/admin-post.php?action=edit=1+and+SLEEP%285%29...
Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection
The plugin does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue PoC error-based SQLI: orderby=id AND EXTRACTVALUE4795,CONCAT0x5c,0x717a627871,SELECT ELT4795=4795,1,0x7176707071 time-bas...
Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting
The plugin does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the 'Publish ID or Full URL" setting and save: "...
MOLIE <= 0.5 - Reflected Cross-Site Scripting
The plugin does not escape the courseid parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=moliecoursecheckid=alert/XSS/...
Stetic < 1.0.9 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the statspage function found in the /stetic.php file, which made it possible for attackers to inject arbitrary web scripts. The CSRF issue has been fixed in 1.0.7, while sanitisation and escaping have been...
Awesome Support < 6.0.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the id and assignee parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue...
WordPress < 5.8 - Plugin Confusion
Description WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.o...
Hide My WP < 6.2.4 - Unauthenticated Plugin Deactivation
The plugin does not have any authorisation check when outputing a reset token, which could then be used to deactivate the plugin via another request...
Hide My WP < 6.2.4 - Unauthenticated SQL Injection
The plugin does not escape the IP address retrieved via headers such as X-Forwarded-For before using it in a SQL statement, leading to an SQL injection...
Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
The plugin does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. PoC As unauthenticated, book an Event, and put the following...
Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the gwollegbuseremail parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page PoC...
IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the idpayerror parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting PoC Append the following payload on a page where a form with an idPay payment interface is embed: error= Example:...
Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting
The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=pmpro-discountcodes=s"+style=animation-name:rotation+onanimationstart=alert/XSS///...
WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting PoC...
HTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC Put the following payload in the "Text size of answer in pixels" settings: alert'XSS';...
Everest Forms < 1.8.0 - Reflected Cross-Site Scripting
The plugin does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC The formid needs to be a valid one...
WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
The plugin does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks PoC...
Kudos Donations < 3.1.2 - Arbitrary Items Deletion via CSRF
The plugin has a logic flaw in its CSRF checks when deleting items such as Donors, Transactions, Subscriptions etc, allowing attackers to make a logged in admin delete them PoC https://example.com/wp-admin/admin.php?page=kudos-transactions=delete=1...
WP Guppy < 1.3 - Sensitive Information Disclosure
The plugin does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user PoC !/bin/bash Exploit Title:...
WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection
The wcfmajaxcontroller AJAX action of the plugin, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections PoC v 3.4.11 POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...
Logo Carousel < 3.4.2 - Unauthorised Private Post Access
The plugin allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature PoC 1 Go to Logo Carousel - Shortcode Generator. 2 If there is no carousel, create one. 3 Copy URL of the "Duplicate" link under the...
Blog2Social < 6.8.7 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=blog2social&b2sShowByDate;="...
Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting
The plugin does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks PoC 1 Make a new carousel /wp-admin/post-new.php?posttype=splcshortcodes 2 Set "Logo Margin" of the Style Setting to...
Icegram < 2.0.5 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the messageid parameter of the getmessageactionrow AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue PoC The XSS will be triggered when moving the mouse over the text in the response...
Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL Injection
The getquery function of the plugin, used by the niwoocosajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber PoC POST...
WP User Frontend < 3.5.25 - Admin+ SQL Injection
The plugin does not validate and escape the postid parameter from the Subscribers list before using in a SQL statement, leading to an SQL injection PoC https://example.com/wp-admin/edit.php?posttype=wpufsubscription=wpufsubscribersID=1+AND+%28SELECT+42+FROM+%28SELECT%28SLEEP%285%29%29%29b%29...
Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting
The plugin does not sanitise escape the parade parameter before outputting it back, leading to a Reflected Cross-Site Scripting in the admin dashboard PoC...
Easy Registration Forms <= 2.1.1 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajaxaddform function found in the /includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1...
Backup Migration < 1.1.6 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks...
Preview E-mails for WooCommerce < 2.0.0 - Reflected Cross-Site Scripting
The plugin is vulnerable to reflected XSS via the searchorder parameter found in the /views/form.php file. PoC...
Login/Signup Popup < 2.2 - Reflected Cross-Site Scripting
The plugin does not escape its tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=xoo-el-fields="...
Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload
The plugin was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory. This vulnerability was seen actively exploited by Sucuri in the wild for ransomware attacks. PoC 1. Authenticate as any user. 2. Paste below...
Mortgage Calculator / Loan Calculator < 1.5.17 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks PoC mlcalc schedule="month';alert/XSS///"...
Push Notifications for WordPress (Lite) < 6.0.1 - Settings Update via CSRF
The plugin is lacking CSRF checks in some of its function, for example when saving its settings, which could allow attackers to make a logged in admin change them...
SportsPress < 2.7.9 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape its matchday parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/edit.php?posttype=speventday=%22%3E%3Csvg%2Fonload%3Dalert%28%2FXSS%2F%29%3B%3E%3C%22...
NEX-Forms <= 7.9.4 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings and form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC In Global Setting Preferences Validation, put the followi...
Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF
The plugin does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page such as...
ProfilePress < 3.2.3 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the ppressccdata parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue PoC...