14633 matches found
Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
The plugin allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata. PoC customfield field="fieldname" postid="ID" e.g customfield field="ctctverifykey" postid="23"...
LearnPress < 4.1.4 - Admin+ SQL Injection
The plugin does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues PoC Id needs to start with a valid course/lesson/quiz/question ID:...
Get Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks PoC As a contributor, create a custom field in a post, with the following payload: Then add the following shortcode to the...
WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the key parameter of the woocsupdateprofilesdata AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected cross-Site Scripting issue PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept:...
Backup and Restore <= 1.0.3 - Admin+ Arbitrary File Deletion
The plugin does not sanitise and validate the foldername parameter when deleting a report, which could allow high privilege users to delete arbitrary files on the web server, including those outside of the WordPress folder PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...
WP Data Access < 5.0.0 - Admin+ SQL Injection
The plugin does not properly sanitise and escape the backupdate parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion PoC POST /wp-admin/admin.php?page=wpdataaccess=repository HTTP/1.1 Accept:...
Email Log < 2.4.8 - Reflected Cross-Site Scripting
The plugin does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=email-log="+style=animation-name:rotation+onanimationstart=alert/XSS///...
Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
The plugin does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an SQL injection. PoC...
PDF.js Viewer < 2.0.2 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks PoC pdfjs-viewer searchterm='" onload="alert/XSS/' pdfjs-viewer viewerwidth=0 viewerheight=800 url=undefined...
Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting
The plugin does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue PoC As a Staff Member, put the following payload in your Full Name Booklyn -- Profile -- Edit -- Full Name: The XSS will be triggered when an admin ope...
LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the rulloginurl and rullogouturl parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue PoC...
Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal
The plugin does not have capability and CSRF checks in the tawktosetwidget and tawktoremovewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users including simple subscribers to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-i...
Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection
The plugin does not sanitise and escape the eventid in the rtecsendunregisterlink AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an unauthenticated SQL injection. PoC The below request will send an email to [email protected]...
WP Google Fonts < 3.1.5 - Reflected Cross-Site Scripting
The plugin does not escape the googlefontajaxname and googlefontajaxfamily parameter of the googlefontaction AJAx action available to any authenticated user before outputing them in attributes, leading Reflected Cross-Site Scripting issues PoC The XSS from the googlefontajaxname will be triggered...
Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Elementor Template Import
The mepimportajaxtemplate AJAX action of the plugin, available to both unauthenticated and authenticated users, is lacking any authorisation and CSRF checks. As a result, unauthenticated user can import arbitrary Elementor template to the blog PoC Legit template:...
WooRockets Nitro <= 1.7.9 - Unauthenticated Arbitrary Plugin Installation
The theme does not have authorisation in some of its AJAX actions, and relied on CSRF checks for it. As one of the action allowed for nonces to be disclosed under a specific circumstance, unauthenticated users could then use them to install and active arbitrary plugins via a zip file, as well as...
Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset
The plugin has two AJAX actions, mepwlajaxlicenseactivate and mepwlajaxlicensedeactivate, which are available to both unauthenticated and authenticated users, and are lacking any authorisation, CSRF as well as checks to ensure that the options to be updated belong to the plugin. As a result,...
Cost Calculator <= 1.4 - Contributor+ Local File Inclusion
The plugin allows users with a role as low as Contributor to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout PoC As a contributor, create a Cost Calculator post, set the Layout to /../../../../../../../../../../file assuming the fil...
Email Tracker < 5.2.6 - Reflected Cross-Site Scripting
The plugin does not escape user input before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC...
Ivory Search < 4.8 - Contributor+ Stored Cross-Site Scripting
The plugin dos not escape the id argument of its shortcode, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks PoC As a contributor or above, put the following shortcode in a post/page ivory-search title="Some Form" id='1" onmouseover="alert/XSS/'...
WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Arbitrary Post Deletion
The ‘admin-dismiss-unsubscribe‘ AJAX action in WP DSGVO Tools GDPR = 3.1.23 lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete...
ARForms Form Builder < 1.5 - Admin+ Stored Cross Site Scripting
The plugin does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the From/Replyto Name field at ARForms Lite General Settings Email Settings: "...
WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
The plugin does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfilteredhtml capability is disallowed. PoC 1. Add a new Import at "New Import", upload a random.tx...
Ibtana - Ecommerce Product Addons < 0.2.4 - Reflected Cross-Site Scripting
The plugin does not escape some user input before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. PoC v v 0.2.4 - https://example.com/wp-admin/admin.php?page=ibtana-custom-post-typeid="+style=animation-name:rotation+onanimationstart=alert/XSS///...
myCred < 2.3 - Subscriber+ SQL Injection
The plugin does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user PoC any authenticated user...
Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS
The plugin does not have any authorisation and CSRF checks on some of its AJAX actions available to authenticated users, which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users d...
Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Add/edit a product and put the following payload in the Product Affiliate URL, Custom Button Text...
BSK PDF Manager < 3.1.2 - Admin+ SQL Injection
The plugin does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue PoC With at least one BSK PDF Category: https://example.com/wp-admin/admin.php?page=bsk-pdf-manager=and+sleep5...
Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users...
WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues. PoC Add an URL to Blacklist RSS Aggregator Tools...
My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting
The plugin does not sanitise and escape the callback parameter of the mcpostlookup AJAX action available to any authenticated user before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue PoC...
Google Maps Easy < 1.10.1 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /modules/markergroups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts. Th...
Email Tracker < 5.2.7 - Arbitrary Email Entry Deletion via CSRF
The plugin does not have CSRF check when deleting email entries, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack...
Check & Log Email < 1.0.4 - Reflected Cross-Site Scripting
The plugin does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting PoC With the "Enable Logs" setting activated: https://example.com/wp-admin/admin.php?page=check-email-logs="+style=animation-name:rotation+onanimationstart=alert/XSS//...
GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting
The plugin does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks. PoC Add the following code in a post/page while in code editor mode with an Contributor account: Then view/previe...
Contest Gallery < 13.1.0.7 - Subscriber+ Email Address Disclosure
The plugin does not have any proper access controls when exporting users from a gallery, which could allow any authenticated users such as subscriber to list all users from the blog, disclosing their username and email address PoC POST...
Email Before Download < 6.8 - Admin+ SQL Injection
The plugin does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues PoC...
Download Monitor < 4.4.7 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape the postid and downloadablefileversion parameters, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks...
Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
The plugin did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...
NextScripts: Social Networks Auto-Poster < 4.3.21 - Reflected Cross-Site Scripting
The plugin does not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...
Download Monitor < 4.4.7 - Admin+ Arbitrary File Download
The plugin does not validate files to be downloaded, which could allow high privilege users such as admin to access arbitrary files from the server...
Hotel Listing < 1.3.3 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape some of the Listing fields such as address, city, zipcode and country, which could lead to Stored Cross-Site Scripting issues...
Contact Form by Supsystic < 1.7.20 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape fields label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC Create/edit a field in a form, and put the following payload in the label:...
URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF
The plugin does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack. PoC https://example.com/wp-admin/admin.php?page=uslinks=bulkdeleteids=1...
OptinMonster < 2.6.5 - Unprotected REST-API Endpoints
OptinMonster was missing appropriate capability checks on several REST-API endpoints which made it possible for unauthenticated attackers, and in some instances authenticated with low privileges, to perform unauthorized actions, as well as access sensitive information such as the...
Floating Social Media Icon <= 4.3.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise some parameter in the Social media Configuration form, which could allow high privilege users to perform Cross-Site Scripting...
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
The plugin has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. PoC curl --referer "something" -sIXGET https://example.com/wp-admin/options.php HTTP/2 302 ... location:...
Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting
The plugin does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=registrations-for-the-events-calendar=registrations="+style=animation-name:rotation+onanimationstart=alert/XSS///...
Ninja Forms < 3.6.4 - Admin+ SQL Injection
The plugin does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks PoC POST /wp-admin/post.php HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: zh,en;q=0.5...
Bulk Datetime Change < 1.12 - Missing Authorisation
The plugin does not enforce capability checks which allows users with Contributor roles to 1 list private post titles of other users and 2 change the posted date of other users' posts. PoC Run on "Bulk Datetime Change" page:...