14633 matches found
Mang Board WP < 1.6.9 - SQL Injection
The plugin does not validate and sanitise the ordertype parameter before using it in a SQL statement, leading to a SQL injection issue...
About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks. PoC With a role as low as Contributor, put the following payloads in one of the Social...
HashThemes Demo Importer < 1.1.2 - Improper Access Control to Blog Reset
The plugin does not have capability checks in some of its AJAX action, relying on CSRF nonces for this, which are displayed for any authenticated users. As a result, a user with a role as low as subscriber could use the hdiinstalldemo AJAX action to reset the entire blog including the tables in t...
Falang multilanguage for WordPress < 1.3.18 - Reflected Cross-Site Scripting
The plugin does not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site scripting issue PoC...
Slideshow Gallery < 1.7.4 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC Create/edit a Slide /wp-admin/admin.php?page=slideshow-slides and put...
Video Lessons Manager - Admin+ Stored Cross-Site Scripting
The plugins do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks PoC Open the CM Video Lesson Plugin's Settings page. Click on Label Tab Enter payload like " into the "channel" or "channels" fields...
Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting
The plugin does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Create a table, add a column with the following payload " as Name, then add data with the...
WP Spell Check < 9.3 - Reflected Cross-Site Scripting
The plugin does not escape the page and wpsc-scan-tab parameters before outputting them back in attributes, leading Reflected Cross-Site Scripting issues PoC...
Age Gate < 2.17.1 - Unauthenticated Import Settings
The plugin patched an Unauthenticated Import Settings vulnerability. It was found to be exploited in the wild a few days after being patched...
Media-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtnl capability is disallowed. PoC https://drive.google.com/file/d/1ZXIS-q2fzZhRhTyHpHEzxcZ2Shl4Up2/view?usp=sharing Put the...
Notification < 8.0.0 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions ...
Ecommerce - Two Factor Authentication < 1.0.5 - Reflected Cross-Site Scripting
The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue PoC v v 1.0.5: https://example.com/wp-admin/users.php?page=reset=resetedit=" style=animation-name:rotation...
Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting
The plugin does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue PoC...
MainWP Child < 4.1.8 - Admin+ SQL Injection
The plugin does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed PoC POST / HTTP/1.1 Accept:...
Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS
The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page PoC Enable reviews for post/pages, and enable the "Show...
MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF
The plugin does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack The vendor has been notified on August 24th, 2021, as well as escalated to the WP plugins team 3 times, no fix was made despite two new versions being released. PoC...
EditableTable <= 0.1.4 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Create a new EDTB and put the following payload in the Table Name, Column Name or...
Duplicate Post < 1.2.0 - Authenticated SQL Injection
The plugin does not properly sanitise and escape the id parameter passed to the cdpactionhandling AJAX action, which could allow user having access to the plugin by default admins to perform SQL Injection attacks PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 229 Accept: /...
Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update
The plugin does not have CSRF and authorisation checks in the lswsssaveattachmentdata AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media. PoC jQuery.postajaxurl, action: "lswsssaveattachmentdata",...
Pie Register < 3.7.2.4 - Open Redirect
The plugin passes unvalidated user input to the wpredirect function, without validating it, leading to an Open redirect issue PoC https://example.com/?piereglogouturl=trueto=https://wpscan.com...
Catch Themes Demo Import < 1.8 - Admin+ Arbitrary File Upload
The plugin is vulnerable to arbitrary file uploads via the import functionality found in the /inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload maliciou...
Simple Job Board < 2.9.5 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $jobboardprivacypolicylabel variable echo’d out via the /admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web...
Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF
The plugin allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks Po...
Sassy Social Share 3.3.23 - Missing Access Controls to PHP Object Injection
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wpajaxheateorsssimportconfig AJAX action due to a missing capability check in the importconfig function found in the /admin/class-sassy-social-share-admin.php file along with the implementation...
Responsive Image Slider, Photo Gallery And Carousel < 1.3.6 - Subscriber+ Arbitrary Post Access
The plugin does not have proper authorisation check in the sfimageid AJAX action, which could allow any authenticated, such as subscriber, to view the content and title of arbitrary posts, for example private, draft and password protected ones. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: /...
Download Monitor < 4.4.5 - Admin+ SQL Injection
The plugin does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue PoC There need to be at least one log for the payload to trigger...
BetterLinks < 1.2.6 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV. PoC Go to Plugin's Settings page, in "Tool" tab, import a CSV file with Betterlinks option. Put a simple XSS payload into "linktitle"...
Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed PoC As an admin, create or edit a Forminator form, add an email field and put the following payload in the label...
Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)
The plugin does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion PoC The PoC varies based on the endpoint targeted. Here is one example that will modify the...
Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting
The plugin does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase. PoC 1 Create a Logo Showcase 2 Set display type to Logo Grid 3 Set number of grid to 1"...
Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/student-registration/?userlogin="...
Easy Digital Downloads < 2.11.2.1 - Reflected Cross-Site Scripting
The plugin does not escape the start-date and end-date parameters in the payment history dashboard before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC...
Relevanssi - A Better Search < 4.14.3 - Unauthenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape user searches before outputting them in the related admin dashboard when the feature is enabled PoC Enable the logging of user query, then was unauthenticated user /?s= The XSS will be triggered when an admin will view the User Searches dashboard at...
Images to WebP < 1.9 - Authenticated Local File Inclusion
The plugin does not validate or sanitise the tab parameter before passing it to the include function, which could lead to a Local File Inclusion issue PoC Assuming WordPress installed at C:\xampp\htdocs\wordpress,...
Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in any of the plugin's settings with a text input: - v - v "Redirected to...
Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
The plugin does not have capability and CSRF checks in the dpwappluginactivate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed. PoC v 1.5.9 - jQuery.postajaxurl, action:"dpwappluginactivate", dpwapurl:"hello.php" v 1.6.0 -...
TableOn < 1.0.1 - Reflected Cross-Site Scripting
The plugin does not sanitise or escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting issues PoC https://example.com/?tableon-remote-page==1=...
WP Performance Score Booster < 2.1 - Settings Change via CSRF
The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC...
Stream < 3.8.2 - Admin+ SQL Injection
The plugin does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue. PoC https://example.com/wp-admin/admin.php?page=wpstream=+AND+SELECT+9940+FROM+SELECTSLEEP5vqNl...
Helpful < 4.4.59 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the System Miscellaneous Custom Timezone setting of the plugin: " The...
QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
The plugin does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects PoC jQuery.postajaxurl, qrredirectresponse...
Active Directory Integration / LDAP Integration < 3.6.95 - Reflected Cross-Site Scripting
The plugin does not escape the testusername parameter before outputting it back in the settings page, leading to a Reflected Cross-Site Scripting issue PoC...
Leaky Paywall <= 4.16.5 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the /class.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where unfilteredhtml is disabled for...
Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access
The plugin allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status ie private, using a shortcode. Password protected posts/pages are not affected by such issue. PoC insert page='pageslug' display='all' Where...
Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting
The plugin adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields. PoC - Create a page A - Add a custom field containing JS...
Support Board < 3.3.6 - Arbitrary File Deletion via CSRF
The plugin does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files PoC...
LearnPress < 4.1.3.2 - Admin+ Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $customprofile parameter found in the /inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-site...
Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting
The plugin does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create/Edit a Button and put the following payload in the Amount Menu Name field...
My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting
The plugin does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins PoC As unauthenticated, book a ticket, fill the purchase form with...