Workreap < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution

The theme's AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were...

WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfilteredhtml capability is disallowed PoC Create a new map. Add an XSS payload to the title. Click "Show as map title". A...

PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Arbitrary File Upload

The plugin did not have a capability check in its pwaforwpsplashscreenuploader function, and relied on CSRF check, however, the nonce was available to any authenticated user. As a result, any authenticated user such as a subscriber could call it and upload a malicious zip file containing a shell...

Leaflet Map < 3.0.0 - Contributor+ Stored XSS

The plugin does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues PoC Most of the shortcode attributes are not escaped, so these are just one of them: leaflet-map...

PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Settings Change

The plugin did not have a capability check in its pwaforwpupdatefeaturesoptions function, and relied on CSRF check, however, the nonce was available to any authenticated user. As a result, any authenticated user such as a subscriber could call it and change the plugin's settings...

Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS

The plugin does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or usin...

Cooked < 1.7.9.1- Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin was vulnerable to Unauthenticated Reflected Cross-Site Scripting XSS. For clarification, this vulnerability is separate to the similar vulnerability CVE-2021-24233. PoC The PoC will be displayed once the issue has been remediated...

BNG Gateway For Woocommerce <= 1.6.10 - CSRF Bypass

The plugin does not properly perform CSRF checks, allowing attackers to make logged in users perform unwanted actions, such as add a new billing method to an existing customer, and delete a payment method...

Strong Testimonials < 2.51.3 - Unauthorised AJAX Call

The plugin did not propely check for CSRF and authorisation in all the wpmtstaddfieldfunction functions, allowing unauthorised call of the associated AJAX actions either via low privilege users or CSRF attack PoC https://example.com/wp-admin/admin-ajax.php?action=wpmtstgetcatcount...

Instantio < 1.2.6 - CSRF Bypass

The plugin did not properly check for CSRF in its wivariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

Adapta RGPD < 1.3.3 - Unauthorised Consent via CSRF

The acceptcookieconsent AJAX action did not properly check for CSRF, allowing attackers to make users consent via a CSRF attack. PoC https://example.com/wp-admin/admin-ajax.php?action=acceptcookieconsent...

MZ Mindbody API < 2.8.3 - Unauthorised AJAX Calls

The plugin did not properly check for CSRF and authorisation in various AJAX actions, allowing attacker to make users call them and perform unwanted actions, as well as allow low privilege users to call them PoC As a low privilege user such as subscriber...

Woocommerce Tabs Plugin, Add Custom Product Tabs <= 1.0.1 - Arbitrary Tab Deletion/Edition via CSRF

The plugin does not properly check for CSRF in its tabsession, tabsessiondel, tabsessionedit and ptabsubmit AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a tab:...

SEO Wizard <= 4.0.2 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its ajaxsaveglobalsettings and ajaxsavepostsettings AJAX actions, as well as other AJAX actions. Furthermore, capability checks were also missing, resulting in any authenticated users as low as subscriber being able to call those actions and modify t...

WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF

The plugin does not properly check for CSRF in its delfield and savealldata AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a field from the Registration Form: To change the whole Registration Form:...

KONTXT Improves WordPress Search <= 1.4.6 - CSRF Bypass

The plugin does not properly check for CSRF in its kontxtanalyzeresults, kontxtanalyzeresults and kontxtsendevent functions, allowing attacker to make logged in users call them them via CSRF attacks...

TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue. PoC Add or edit a Taximony...

Journey Analytics < 1.0.13 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in some of its function, allowing attacker to make users do unwanted actions...

Profile Builder < 3.4.8 - Authenticated Stored XSS

The plugin does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue PoC As admin, put the followin...

ReviewX < 1.2.9 - Unauthorised AJAX call via CSRF

Some of the plugin AJAX actions did not properly check for CRSF nonce, allowing attacker to make users call them and perform unwanted actions...

YITH Request a Quote for WooCommerce < 1.6.4 - Unauthorised AJAX call via CSRF

The ajax method did not properly check for CSRF, allowing attackers to make users call the ajaxadditem, ajaxremoveitem or ajaxvariationexist actions, which will tamper with their session quote. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

Title Field Validation <= 1.1 - Unauthorised AJAX Calls

The plugin does not properly check for CSRF in its findposttype, savevalidation, editvalidation, updatevalidation and deletevalidation AJAX actions. Additionally, the actions were also missing any capability checks. As a result, any authenticated user such as subscriber could call them to create,...

Intimate Payments <= 1.3.1 - CSRF Bypass

The plugin does not properly check for CSRF in its handleselectcurrency and handleupdatetrx AJAX actions, allowing attacker to make logged in admin call them them via CSRF attacks...

Global Multisite Search <= 1.0.1 - CSRF Bypass

The plugin does not properly check for CSRF in its wpgmsajaxresultfunction AJAX action, allowing attacker to make logged in user call them it a CSRF attack...

SEO Wizard <= 4.0.2 - Unauthorised robots.txt & .htaccess Edit via CSRF

The plugin does not properly check for CSRF in its wswedithtaccessfile, wswcreaterobotstext and wswupdatecontentrobots AJAX actions, allowing attackers to make logged in admin write arbitrary data to the robots.txt and .htaccess files PoC...

BuddyPress Customer.io Analytics Integration <= 1.1.6 - Arbitrary Plugin Settings Update via CSRF

The plugin does not properly perform the CSRF check when saving its settings, allowing attackers to make logged in admin change them to arbitrary values PoC...

Newspaper < 11 - Reflected Cross-Site Scripting (XSS)

Description The theme does not sanitise the tdatts.modulescategory parameter in its tdajaxsearch AJAX action, leading to a Reflected Cross-Site Scripting XSS vulnerability. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate...

WP SMS < 5.4.9.1 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape some of its parameter before outputting them back in the pages, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in admin. PoC...

Fontsampler < 0.4.13 - CSRF to Authenticated Reflected Cross-Site Scripting (XSS)

The plugin did not properly check for CSRF and authorisation in its ajaxgetmockfontsampler AJAX action, which could lead to an authenticated reflected XSS issue as user input was then output without being sanitised first. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...

Cognitive Content Analyzer < 2.3 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its blobinatoranalyze AJAX action, allowing attacker to make a logged in administrator call the blobinatorprocesstext method with arbitrary parameters and update the related post with the results. PoC POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1...

Booking Calendar | Appointment Booking | BookIt < 2.1.6 - Authorised AJAX Calls

The plugin does not properly check for CSRF in some of its AJAX actions, allowing them to be bypassed. Attackers could make logged in users call them and perform unwanted actions...

Express Shop < 4.0.3 - CSRF Bypass

The plugin did not properly check for CSRF in its qcldexpressvariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...

WP Prayer < 1.5.5 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its wpeajaxcall AJAX action, which then call other method dynamically, allowing attacker to make user perform unwanted actions...

Alkubot < 3.0.0 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its successfulBargain AJAX action, allowing attacker to make users place arbitrary product in their cart...

Food Store < 1.3.7 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its AJAX actions, allowing attackers to make users perform unwanted actions via a CSRF attack, such as add product add-on for users with the editproducts capability, as well as add/remove arbitrary products to the basket of the targeted user...

MZ MBO Access < 2.0.9 - Unauthorised AJAX call

The plugin did not properly check for CSRF in some of its AJAX action, allowing attackers to make users unwanted actions...

MailOptin < 1.2.35.2 - Unauthorised AJAX Call

The fetchcustomfields and fetchtags function did not have proper CSRF check and authorisation, allowing unauthorised users to call the related AJAX action via either low privilege account or CSRF attack PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.0...

Portfolio Responsive Gallery < 1.1.8 - Authenticated Blind SQL Injections

The getportfolios and getportfolioattributes functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to...

Super Progressive Web Apps < 2.1.13 - Authenticated (High Privileged) Arbitrary File Upload to RCE

When the Apple Touch Icons & Splash Screen add-on is active, its superpwasplashscreenuploader AJAX action, did not properly check for authorisation and the content of the uploaded archive file. This allows high privilege users admin+ to upload an archive with a PHP file, leading to RCE. v2.1.12...

Super Progressive Web Apps < 2.1.12 - Authenticated (Low Privileged) Arbitrary File Upload to RCE

When the Apple Touch Icons & Splash Screen add-on is active, its superpwasplashscreenuploader AJAX action, does not properly check for CSRF, authorisation and the content of the uploaded archive file. This allows attackers to upload an archive with a PHP file, leading to RCE by either using a low...

Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL Injections

The plugin did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard When we WPScanTeam confirmed the issues, more SQL Injections were identified, reported and fixed by the vendor but have not...

Popup Like box - Page Plugin < 3.5.3 - Authenticated Blind SQL Injections

The getfblikeboxes function in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC SQLMAP: python sqlmap.py -r r.txt -p orderby --level 5 --risk 3 --dbms...

RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF

The Import feature of the plugin /wp-admin/tools.php?page=rsvpmakerexportscreen takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack. PoC Go to the...

Multiple Plugins from AYS Pro - Reflected Cross-Site Scripting (XSS)

The plugins did not properly sanitise and escape some GET parameters before outputting them back in attributes, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in administrator PoC...

WP Offload SES Lite < 1.4.5 - Stored Cross-Site Scripting (XSS)

The plugin did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for exampl...

Popup box < 2.3.4 - Authenticated Blind SQL Injections

The getayspopupboxes and getpopupcategories functions of the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC Exploit All of them with same technique...

Photo Gallery by Ays - Responsive Image Gallery < 4.4.4 - Authenticated Blind SQL Injections

The getgallerycategories and getgalleries functions in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC SQLMAP: python sqlmap.py -r r.txt -p orderby...

Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL Injection

The hndtstactioninstancecallback AJAX call of the plugin, available to any authenticated users, does not sanitise, validate or escape the hndtstpreviewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue. PoC curl -i -s -k -X $'POST' \ -H...

Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection

The getsliders function in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard PoC SQLMAP: python sqlmap.py -r r.txt -p orderby --level 5 --risk 3 --dbms MySQ...

Survey Maker < 1.5.6 - Authenticated Blind SQL Injections

The getresults and getitems functions in the plugin did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard Note WPScanTeam: Other SQLi were identified when confirming the...