14624 matches found
More From Google <= 0.0.2 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /morefromgoogle.php file which allows attackers to inject arbitrary web scripts...
SP Rental Manager <= 1.5.3 - Unauthenticated SQL Injection
The plugin is vulnerable to SQL Injection via the orderby parameter found in the /user/shortcodes.php file which allows attackers to retrieve information contained in a site’s database...
RentPress <= 6.6.4 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the /src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts...
WP Academic People List <= 0.4.1 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the categoryname parameter in the /admin-panel.php file which allows attackers to inject arbitrary web scripts...
Konnichiwa! Membership <= 0.8.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the planid parameter in the /views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts...
Twitter Friends Widget <= 3.1 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts...
Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting
The plugin does not properly sanitize or escape inputs in the plugin's settings. PoC Open "Chained Quiz Social Sharing" in the WP admin panel. Under title field enter the payload : " Click on Save All Setting and the XSS will fire every time the Social Sharing page is loaded...
WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting
The plugin does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payloads in the mentioned settings of the plugin: - How to display the...
Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting
The plugin does not properly validate and escape some of its settings like sizeleaf, flakesleaf, speed which could lead to Stored Cross-Site Scripting issues PoC POST /wp-admin/admin.php?page=weather-effects-setting HTTP/1.1 Accept: text/html, /; q=0.01 Accept-Language: en-GB,en;q=0.5...
Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting
The plugin does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue. v1.3.4 fixed the CSRF, but not the sanitisation/escaping fully. Another issue has been created for it PoC To have the XSS only...
PublishPress Editorial Calendar < 3.5.1 - Reflected Cross-Site Scripting
The plugin does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=pp-content-overview="="...
WordPress Automatic < 3.53.3 - Unauthenticated Arbitrary Options Update
The plugin was vulnerable to Unauthenticated Arbitrary Options Update...
ELEX WooCommerce Google Shopping < 1.2.4 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise or escape the search GET parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue, which will be executed in a logged in admin context PoC https://example.com/wp-admin/admin.php?page=elex-product-feed-manage="...
uListing < 2.0.9 - Arbitrary Blog Option Update via CSRF
The plugin does not have CSRF check in the uListingimportlayout function, nor perform any validation on the option/post meta key to update to ensure it belongs to the plugin. As a result, attackers could make a logged in admin change any of the blog option such as siteurl, blogname etc as well as...
CM Tooltip Glossary < 3.9.21 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape some glossarytooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks PoC glossarytooltip dashicon='" style="animation-name:twentytwentyone-close-button-transition"...
Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)
The Enfold theme was vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder. PoC The issue appears when pagination comes in place while navigating on a WordPress site with Enfold theme active. When that...
Pinterest Automatic < 4.14.4 - Unauthenticated Arbitrary Options Update
The plugin was vulnerable to Unauthenticated Arbitrary Options Update...
Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Go to the plugin Settings Messages Taxonomies...
UsersWP < 1.2.2.29 - Reflected Cross-Site Scripting
The plugin sanitises user input via sanitizetextfield but do not escape it before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues PoC On the reset page made by the plugin: https://example.com/reset/?key=a=%22accesskey=X%20onclick=alert1%20b=%22...
My Chatbot <= 1.1 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise or escape its tab parameter in the Settings page before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/options-general.php?page=my-chatbot=%22%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E...
User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting
The plugin does not properly sanitise the userregistrationprofilepicurl value when submitted directly via the userregistrationupdateprofiledetails AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed PoC 1...
Better Find and Replace < 1.2.9 - Reflected Cross-Site Scripting
The plugin does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=cs-all-masking-rules=...
Appointment Hour Booking < 1.3.16 - Authenticated Stored Cross-Site Scripting
The plugin does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create a new Calendar Appointment Hour Booking Add new Put the following payload in the Form...
Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site Scripting
The plugin does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=cs-woo-altcoin-all-coins="...
Media File Renamer - Auto & Manual Rename < 5.2.7 - Media Title/Filename/Locking State Update via CSRF
The plugin does not have CSRF in place, which could allow attacker to make a logged in admin change arbitrary uploaded media title, filename, as well as locking state via a CSRF attack Notes: - We were unable to reproduce the issue from an attacker point of view, the endpoints are expecting JSON...
Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections
The plugin does not escape multiple POST parameters such as statuscode, department, userid, conversationid, conversationstatuscode, and recipientid before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users. PoC The login-cookie parameter is...
Meow Gallery < 4.1.9 - Contributor+ SQL Injection
The plugin does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that...
Meow Gallery < 4.2.0 - Unauthorised Arbitrary Options Update via REST API
The plugin does not properly check for capability in its REST API, allowing - Any authenticated user with the uploadfile capability such as author+ to call them in versions before 4.1.9 - Any unauthenticated user to call them except the restallsettings endpoint, in 4.1.9 One endpoint in...
Easy Social Icons < 3.1.3 - Reflected Cross-Site Scripting
The plugin does not escape user input before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues PoC Affected parameters: width, height, margin, attrid, attrclass...
GeoDirectory < 2.1.1.3 - Authenticated (admin+) Stored Cross-Site Scripting (XSS)
The GeoDirectory plugin was vulnerable to Authenticated admin+ Stored Cross-Site Scripting XSS. PoC POST /wp-admin/admin.php?page=gd-settings=general=location HTTP/1.1 ..SNIP.. Content-Disposition: form-data; name="defaultlocationlatitude" prompt/XSS/ ..SNIP...
XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting
The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/edit.php?posttype=xoevent=xo-event-holiday-settings&selected-name;="...
Gutenberg Template Library & Redux Framework < 4.2.13 - Unauthenticated Sensitive Information Disclosure
Some AJAX actions of the plugin, available to unauthenticated users and used for support features could allow attackers to obtain potentially sensitive information such as the PHP version, active plugins along with their versions, as well as the unsalted MD5 hashes of the site’s AUTHKEY and...
Gutenberg Template Library & Redux Framework < 4.2.13 - Contributor+ Arbitrary Plugin Installation and Post Deletion
The plugin did not correctly check the authorisation in the redux/v1/templates/ REST API namespace, allowing any users with the editposts capability ie contributor and above to call the endpoints define in it. By using the redux/v1/templates/plugin-install one, they could install plugins from the...
WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Export
The plugin does not have authorisation check on its export feature, allowing unauthenticated users to export them. PoC https://example.com/?rpwcdpdexportsettings=1...
underConstruction < 1.19 - Reflected Cross-Site Scripting
The plugin does not escape the PHPSELF before outputting it in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php/"/?page=under-construction...
WooCommerce Dynamic Pricing & Discounts < 2.4.2 - Unauthenticated Settings Import to Stored XSS
The plugin does not have authorisation and CSRF checks on its import feature, nor sanitise or escape the imported settings. This could allow unauthenticated users to import arbitrary settings, and perform Stored Cross-Site Scripting attacks as well. Please note that v2.4.2 is still missing a CSRF...
Software License Manager < 4.5.0 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise or escape its License Key Prefix setting before outputting it in the Add/Edit Licenses page, leading to an Authenticated Stored Cross-Site Scripting issue PoC Go the plugin’s settings and add " as a License Key Prefix Then go the the Add/Edit Licenses page to trigger...
CF Geo Plugin < 7.13.12 - Reflected Cross-Site Scripting
The plugin does not escape the some parameter before outputting them back in admin pages, leading to a Reflected Cross-Site Scripting issue PoC POST /wp-admin/admin.php?page=cf-geoplugin-activate HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8...
qTranslate X <= 3.4.6.8 - Multiple Admin+ Stored Cross-Site Scripting
The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Affected POST Parameters: - Settings Languages Languages:...
DZS Zoomsounds < 6.50 - Unauthenticated Arbitrary File Download
The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter...
Easy Social Icons < 3.0.9 - Reflected Cross-Site Scripting
The plugin does not escape the $SERVER'PHPSELF' input before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php/alert/XSS/...
Cookie Notice & Compliance for GDPR / CCPA < 2.1.2 - Admin+ Stored Cross-Site Scripting
The plugin does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the Button text...
TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting
The plugin does not implement a proper sanitisation on the translated strings. The 'trpsanitizestring' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues. PoC As...
Docket Cache < 21.08.02 - Reflected Cross-Site Scripting
The plugin does not escape some filter parameters when the OPCache Viewer is enabled before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=docket-cache-opcviewer=opcviewer=a="="...
User Activity Log < 1.4.7 - Reflected Cross-Site Scripting
The plugin does not escape the txtsearch parameter before outputting it in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=useractionlog=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F...
Countdown Block < 1.1.2 - Missing Authorisation in AJAX action
The plugin does not have authorisation in the ebwriteblockcss AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users. v1.1.1 attempt to fix the issue was incomplete, still allowing it to be exploited via a CSRF attack on an admin due to a...
CoolClock < 4.3.5 - Contributor+ Stored Cross-Site Scripting
The plugin does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks PoC As a user with a role as low as contributor, put the following shortcode in a post/page and view/preview it to trigger the XSS which is specific...
User Activity Log < 1.4.7 - Reflected Cross Site Scripting via Query String
The plugin does not escape the $SERVER'QUERYSTRING' before outputting it back in attributes, which could lead to Reflected Cross-Site Scripting in web browsers which do not encode URL characters. PoC With a web browser which does not encode characters or use burp suite and decode the URL via the...
WP Statistic < 13.1 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise and escape various user input before outputting it back in pages, which could lead to Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=wpsreferrerspage=" https://example.com/wp-admin/admin.php?page=wpsvisitorspage="...
Premium Addons for Elementor < 4.5.2 - Subscriber+ Arbitrary Blog Option Update
The plugin does not have any CSRF and authorisation checks in the padismissadminnotice AJAX action, available to any authenticated users, and do not validate the option key to ensure the option to update belongs to the plugin. As a result, any authenticated user, such as subscriber can update...