Unlimited Category slider for WooCommerce < 2.1.0 - CSRF Bypass

The plugin does not property check for CSRF due to a logic flaw, allowing the check to be bypassed by not having the cxnonce parameter in the request...

Flash Games <= 2.2 - CSRF Bypass

The plugin does not properly check for CSRF in its cgwpsearchgame AJAX action, however we could not identify a risk associated with it...

NMI Gateway For WooCommerce <= 1.6.11 - CSRF Bypass

The plugin does not properly check for CSRF in its bng701stepOneaddBilling, bng701stepOne and bng701deletePaymentMethod functions, allowing attacker to make logged in users call them and perform unwanted actions...

Magic Post Thumbnail < 3.3.7 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its ids GET parameter before outputting it back in the bulk generation page, leading to a reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=magicpostthumbnail%2Finc%2Fadmin%2Fbulkgeneration.php=...

Woo MerchantX <= 1.0 - CSRF Bypass

The plugin does not properly check for CSRF in its merchantxstepOneaddBilling, merchantxstepOne and merchantxdeletePaymentMethod functions, allowing attacker to make logged in users call them and perform unwanted actions...

Filter Gallery < 0.0.7 - Unauthorised AJAX Calls

The plugin had a logic flaw in the CSRF checks of its AJAX calls, allowing them to be passed by not providing the related parameter in the request. This could allow attacker to make logged in users do unwanted actions. Furthermore, the AJAX calls are also lacking capability checks, allowing any...

Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE

The plugin did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE PoC PoC | Authenticated RCE | Caching Exclude URLs / Cached query strings: POST /wp-admin/admin.php?page=sbp-settings HTTP/2 Host: example.com...

Popular Brand SVG Icons - Simple Icons < 2.7.8 - Contributor+ Stored XSS

The plugin does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in...

Haxcan <= 1.0.0 - CSRF Bypass

The plugin does not properly check for CSRF in its getajaxresponse AJAX action, allowing attacker to make logged in admin call them it via CSRF attack and add arbitrary files in quarantine for example. PoC Add an arbitrary file to quarantine...

WooCommerce Extra Cost <= 2.6 - CSRF Bypass

The plugin does not properly check for CSRF in its saveextracost method, which might allow attacker to make logged in users call it and perform unwanted actions...

Haxcan <= 1.0.0 - Arbitrary File Access

The plugin does not properly ensure that the file to be accessed is within the blog, allowing high privilege users to read any file on the web server. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...

Advanced Post Listing Shortcode <= 2.8 - CSRF Bypass

The plugin does not properly check for CSRF in its gettextonomy, getterm and gtpagination methods, allowing attacker to make users call them via a CSRF attack...

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue. PoC https://www.example.com/?cpmvcid=1doaction=mvparse=editindex=0=1=0=F00=1=999=a%22%3E%3Csvg/%3E%3C%22...

Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting XSS vulnerability within the Forms "Add new" field. PoC Step 1: Install and activate the plugin. Step 2: Go to the Forms-- Add New...

WordPress Popular Posts < 5.3.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the widget-wpp2posttype parameter before outputting it in the page, which could lead to a Stored Cross-Site Scripting issue...

Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator PoC...

Workreap < 2.2.2 - Missing Authorization Checks in Ajax Actions

The theme had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site. PoC log in as arbitrary...

Workreap < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities

Several AJAX actions available in the theme lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary object...

Woostify < 1.9.2 - CSRF Bypass

The theme did not properly check for CSRF, allowing attackers to bypass them and make logged in users add products and edit quantity in their checkout basket...

Workreap < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

The theme's AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were...

PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Arbitrary File Upload

The plugin did not have a capability check in its pwaforwpsplashscreenuploader function, and relied on CSRF check, however, the nonce was available to any authenticated user. As a result, any authenticated user such as a subscriber could call it and upload a malicious zip file containing a shell...

WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfilteredhtml capability is disallowed PoC Create a new map. Add an XSS payload to the title. Click "Show as map title". A...

Leaflet Map < 3.0.0 - Contributor+ Stored XSS

The plugin does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues PoC Most of the shortcode attributes are not escaped, so these are just one of them: leaflet-map...

PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Settings Change

The plugin did not have a capability check in its pwaforwpupdatefeaturesoptions function, and relied on CSRF check, however, the nonce was available to any authenticated user. As a result, any authenticated user such as a subscriber could call it and change the plugin's settings...

Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS

The plugin does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or usin...

Cooked < 1.7.9.1- Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin was vulnerable to Unauthenticated Reflected Cross-Site Scripting XSS. For clarification, this vulnerability is separate to the similar vulnerability CVE-2021-24233. PoC The PoC will be displayed once the issue has been remediated...

Woocommerce Tabs Plugin, Add Custom Product Tabs <= 1.0.1 - Arbitrary Tab Deletion/Edition via CSRF

The plugin does not properly check for CSRF in its tabsession, tabsessiondel, tabsessionedit and ptabsubmit AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a tab:...

SEO Wizard <= 4.0.2 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its ajaxsaveglobalsettings and ajaxsavepostsettings AJAX actions, as well as other AJAX actions. Furthermore, capability checks were also missing, resulting in any authenticated users as low as subscriber being able to call those actions and modify t...

Strong Testimonials < 2.51.3 - Unauthorised AJAX Call

The plugin did not propely check for CSRF and authorisation in all the wpmtstaddfieldfunction functions, allowing unauthorised call of the associated AJAX actions either via low privilege users or CSRF attack PoC https://example.com/wp-admin/admin-ajax.php?action=wpmtstgetcatcount...

KONTXT Improves WordPress Search <= 1.4.6 - CSRF Bypass

The plugin does not properly check for CSRF in its kontxtanalyzeresults, kontxtanalyzeresults and kontxtsendevent functions, allowing attacker to make logged in users call them them via CSRF attacks...

BNG Gateway For Woocommerce <= 1.6.10 - CSRF Bypass

The plugin does not properly perform CSRF checks, allowing attackers to make logged in users perform unwanted actions, such as add a new billing method to an existing customer, and delete a payment method...

Instantio < 1.2.6 - CSRF Bypass

The plugin did not properly check for CSRF in its wivariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF

The plugin does not properly check for CSRF in its delfield and savealldata AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a field from the Registration Form: To change the whole Registration Form:...

MZ Mindbody API < 2.8.3 - Unauthorised AJAX Calls

The plugin did not properly check for CSRF and authorisation in various AJAX actions, allowing attacker to make users call them and perform unwanted actions, as well as allow low privilege users to call them PoC As a low privilege user such as subscriber...

Adapta RGPD < 1.3.3 - Unauthorised Consent via CSRF

The acceptcookieconsent AJAX action did not properly check for CSRF, allowing attackers to make users consent via a CSRF attack. PoC https://example.com/wp-admin/admin-ajax.php?action=acceptcookieconsent...

Newspaper < 11 - Reflected Cross-Site Scripting (XSS)

Description The theme does not sanitise the tdatts.modulescategory parameter in its tdajaxsearch AJAX action, leading to a Reflected Cross-Site Scripting XSS vulnerability. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate...

BuddyPress Customer.io Analytics Integration <= 1.1.6 - Arbitrary Plugin Settings Update via CSRF

The plugin does not properly perform the CSRF check when saving its settings, allowing attackers to make logged in admin change them to arbitrary values PoC...

Profile Builder < 3.4.8 - Authenticated Stored XSS

The plugin does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue PoC As admin, put the followin...

YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

Intimate Payments <= 1.3.1 - CSRF Bypass

The plugin does not properly check for CSRF in its handleselectcurrency and handleupdatetrx AJAX actions, allowing attacker to make logged in admin call them them via CSRF attacks...

ReviewX < 1.2.9 - Unauthorised AJAX call via CSRF

Some of the plugin AJAX actions did not properly check for CRSF nonce, allowing attacker to make users call them and perform unwanted actions...

SEO Wizard <= 4.0.2 - Unauthorised robots.txt & .htaccess Edit via CSRF

The plugin does not properly check for CSRF in its wswedithtaccessfile, wswcreaterobotstext and wswupdatecontentrobots AJAX actions, allowing attackers to make logged in admin write arbitrary data to the robots.txt and .htaccess files PoC...

Title Field Validation <= 1.1 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its findposttype, savevalidation, editvalidation, updatevalidation and deletevalidation AJAX actions. Additionally, the actions were also missing any capability checks. As a result, any authenticated user such as subscriber could call them to create,...

Journey Analytics < 1.0.13 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in some of its function, allowing attacker to make users do unwanted actions...

TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue. PoC Add or edit a Taximony...

Global Multisite Search <= 1.0.1 - CSRF Bypass

The plugin does not properly check for CSRF in its wpgmsajaxresultfunction AJAX action, allowing attacker to make logged in user call them it a CSRF attack...

WP SMS < 5.4.9.1 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape some of its parameter before outputting them back in the pages, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in admin. PoC...

Fontsampler < 0.4.13 - CSRF to Authenticated Reflected Cross-Site Scripting (XSS)

The plugin did not properly check for CSRF and authorisation in its ajaxgetmockfontsampler AJAX action, which could lead to an authenticated reflected XSS issue as user input was then output without being sanitised first. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...

Alkubot < 3.0.0 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its successfulBargain AJAX action, allowing attacker to make users place arbitrary product in their cart...

Food Store < 1.3.7 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its AJAX actions, allowing attackers to make users perform unwanted actions via a CSRF attack, such as add product add-on for users with the editproducts capability, as well as add/remove arbitrary products to the basket of the targeted user...