14633 matches found
Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion
The plugin does not have proper access control when deleting a timeslot, allowing any user with the editposts capability contributor+ to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in wit...
OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API
The plugin does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website. PoC Access the URL below as unauthenticated...
GSEOR <= 1.3 - Authenticated SQL Injection
A pageid GET parameter of the plugin is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC GET /wp-admin/admin.php?page=gseor.php=1=1%20AND%20SELECT%206449%20FROM%20SELECTSLEEP5wwdQ HTTP/1.1 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1...
WP Domain Redirect <= 1.0 - Authenticated SQL Injection
The Edit domain functionality in the plugin has an editid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC POST /wp-admin/admin.php?page=add=edit=1 HTTP/1.1 Content-Length: 102 Cache-Control: max-age=0...
The Sorter <= 1.0 - Authenticated SQL Injection
The checkorder function of the plugin uses an areaid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC GET /wp-admin/admin.php?page=thesorterareasid=1%20AND%20SELECT%207667%20FROM%20SELECTSLEEP5DWBj HTTP/1.1 Cache-Control:...
WP-Board <= 1.1 (beta) - Unauthenticated SQL Injection
The options.php file of the plugin accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it take...
MicroCopy <= 1.1.0 - Authenticated SQL Injection
The edit functionality in the plugin makes a get request to fetch the related option. The id parameter used is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC GET...
Display users <= 2.0.0 - Authenticated SQL Injection
The Edit Role functionality in the plugin had an id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC GET /wp-admin/admin.php?page=display-users=manage-role=edit=-4476+UNION+ALL+SELECT+NULL%2Cuser%28%29%2CNULL--+- HTTP/1.1...
WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL Injection
The Orders functionality in the plugin has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors PoC POST /wp-admin/admin.php?page=wpagecontact-plugin...
WP iCommerce <= 1.1.1 - Authenticated (contributor+) SQL Injection
The Orders functionality in the plugin has an orderid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors PoC GET...
Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection
The fetchproductajax functionality in the plugin uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 162 Accept: / X-Requested-With:...
Responsive 3D Slider <= 1.2 - Authenticated SQL Injection
The Add new scene functionality in the plugin uses an id parameter which is not sanitised, escaped or validated before being inserted to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 secon...
Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting
The plugin does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting XSS. Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user as low as subscriber, or unauthenticat...
Donate With QRCode <= 1.4.5 - Plugin's Setting Update via CSRF
The plugin does not have CSRF check in place when saving its settings, which could allow attackers to make a logged in admin update them PoC...
WP Cerber Security < 8.9.3 - 2FA Authentication Bypass
The plugin improperly checked certain HTTP parameters leading to an administrative multi-factor authentication bypass...
WP Cerber Security < 8.9.3 - Rest-API Protection Bypass
The /wp-json REST API endpoint is by default blocked by WP Cerber from accessing its information. However, by appending a ?, the access control list protections are bypassed and data can then be retrieved from it...
Shopping Cart & eCommerce Store < 5.1.1 - CSRF to Stored Cross-Site Scripting
The plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts...
Gutenslider < 5.2.0 - Contributor+ Stored XSS
The plugin does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks PoC As a contributor or above, create/edit a post, put the below code while in Code Editor mode, and view/preview the post The...
Jock on air now < 5.6.2 - Reflected Cross-Site Scripting
The plugin does not escape the $SERVER'PHPSELF' before outputting it back in an attribute in its settings, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php/"/?page=joansettings...
ThinkTwit < 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue. PoC Put the following payload in the "Consumer key" setting of the plugin /wp-admin/options-general.php?page=thinktwit: - v - v 1.7.1 : "...
Print My Blog < 3.4.2 - Plugin Deactivation via CSRF
The plugin does not enforce nonce CSRF checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link PoC...
BuddyPress < 9.1.1 - SQL Injections
The plugin was affected by SQL Injections via the BPNotificationsNotification::getorderbysql and BPInvitation::getorderbysql functions...
BuddyPress < 9.1.1 - Activation Key Disclosure
The plugin disclosed the activation key from responses of the createitem method in the BP REST API Signup controller...
Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls
The plugin does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user such as subscriber to call them and 1 Get and search through title and content of Draft post, 2 Get title of a password-protected post as...
Jock on air now < 5.6.3 - Authenticated Stored Cross-Site Scripting
The plugin does not properly sanitise and escape some Show parameters before outputting them in pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Vulnerable parameters: linkURL some validation is done an...
Jock on air now < 5.6.2 - Arbitrary Plugin's Settings Update via CSRF
The plugin does not have CSRF check in place when saving its settings, allowing attackers to make logged in admin change them to arbitrary values via a CSRF attack PoC...
Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload
The shoppuploadfile AJAX action of the plugin, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE PoC...
PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls
The plugin performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values. PoC You can run this from a browser's javascript console:...
Icegram < 2.0.3 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise some parameters, such as headline, which could allow high prolegs users to perform Cross-Site Scripting attacks...
MF Gig Calendar <= 1.1 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise or escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue PoC...
Fileviewer <= 2.2 - Arbitrary File Upload/Deletion via CSRF
The plugin does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack PoC To delete /phpinfo.php:...
SEOPress 5.0.0 – 5.0.3 - Authenticated Stored Cross-Site Scripting
The plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the /src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts. PoC $wpuser, 'pwd' = $wppass, 'rememberme' = 'forever', 'wp-submit' = 'Log+In', ;...
Language Bar Flags <= 1.0.8 - CSRF to Stored XSS
The plugin does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in t...
Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
The plugin does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will ...
Simple eCommerce <= 2.2.5 - Arbitrary File Upload
The plugin does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE PoC...
Email Artillery <= 4.1 - Arbitrary File Upload
The plugin does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denyin...
Amazon Auto Links < 4.6.20 - Reflected Cross-Site Scripting
The plugin does not escape some parameters before outputting them back in attributes in an admin page, leading to Reflected Cross-Site Scripting issues PoC...
WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Navigate to Tickets Add New add all information on the title,...
Multiple Plugins - CSRF Bypass
Multiple plugins are affected by CSRF issues due to a logic flaw in their CSRF checks, which could allow attackers to make users perform unwanted actions rucy = 0.4.4 wp-backgrounds-lite = 2.3 wp-security-questions = 1.0.5 event-espresso-decaf = 4.10.11.decaf photo-contest = 1.0.6 opal-estate =...
Email Artillery <= 4.1 - CSRF to Stored XSS
The plugin does not sanitise, validate or escape its settings, and is lacking any CSRF check before saving them. As a result, an attacker could make a logged in admin change them and put malicious JavaScript code as well, leading to Stored Cross-Site Scripting issues. PoC...
SP Project & Document Manager < 4.26 - Reflected Cross-Site Scripting
The plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts PoC https://example.com/wp-admin/admin.php?page=sp-client-document-manager=" style=animation-name:rotation...
CBX Bookmark & Favorite < 1.6.9 - Reflected Cross-Site Scripting
The plugin does not escape a page parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting issues PoC...
Email Artillery <= 4.1 - Multiple Reflected Cross-Site Scripting
The plugin does not sanitise, validate or escape some user input before outputting back in pages leading to Reflected Cross-Site Scripting issues which will be executed in the context of a logged in admin PoC https://example.com/wp-admin/admin.php?page=etmbu-all-posts=yes=no="="...
WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed Code
The plugin does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfilteredhtml capability is disallowed, which could lead to Stored Cross-Site Scripting issues PoC 1. On the dashboard, navigate to WP Courses Courses Add New...
Email Artillery <= 4.1 - Multiple Authenticated SQL Injections
The plugin does not sanitise, validate or escape some user input before using it in SQL statements in the admin dashboard, leading to SQL Injections PoC https://example.com/wp-admin/admin.php?page=etmbu-all-posts=yesid=1%20AND%20SELECT%2042%20FROM%20SELECTSLEEP5aa...
Afterpay Gateway for WooCommerce < 3.2.1 - Reflected Cross-Site Scripting
The plugin has sample files form the https://github.com/afterpay/sdk-php library, which do not escape some parameters before outputting them in attributes, leading to Reflected Cross-Site Scripting issues. PoC...
WP Courses LMS < 2.0.44 - Reflected Cross-Site Scripting
The plugin does not escape some parameters before outputting them back in admin pages, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=managestudentsid=1id="...
Post Carousel < 2.3.5 - CSRF Bypass / Unauthorised AJAX Calls
The plugin did not properly check for CSRF in two of its AJAX actions, allowing them to be bypassed. Furthermore, other actions which should only be accessible to admins were missing capability check but had CSRF checks, and the spf-reset action did not validate that the actions to be delete belo...
Skaut bazar < 1.3.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file which allows attackers to inject arbitrary web scripts PoC https://example.com/wp-admin/options-general.php/"/?page=skatubazaroption...
Media Usage <= 0.0.4 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /mmuadmin.php file which allows attackers to inject arbitrary web scripts...