14676 matches found
WP 6.6 - 7.1.3 - Contributor+ Stored XSS via Script Module Data Shadowing
Description WordPress reads JSON configuration from a DOM element by id in some cases without constraining it to the intended script element, which could allow users with contributor-level access and above to shadow that data and perform Stored Cross-Site Scripting attacks. This also affects the...
WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Next Block
Description WordPress does not escape a block attribute in a comments pagination block in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against site visitors. This also affects the Gutenberg plugin...
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Playlist and Image Blocks
Description WordPress does not properly sanitise user-controlled block attributes in the Playlist and Image blocks in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks. This also affects the Gutenberg plugin...
WP 6.7 - 7.1.3 - Contributor+ Stored XSS via Categories Block
Description WordPress does not properly sanitise a block attribute in the Categories block in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks. This also affects the Gutenberg plugin...
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Bind Directive Prototype Pollution
Description WordPress does not reject prototype-mutating property names in Interactivity API bind directives in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the...
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Style Directive Object Write
Description WordPress does not restrict the target of Interactivity API style directives to style objects in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute, without requiring a click, in the session of anyone...
WP < 7.1.4 - Stored XSS in Multisite Network Users Screen (Defense-in-Depth)
Description WordPress does not escape a user login value in all cases before outputting it on a multisite network administration screen, which could allow Stored Cross-Site Scripting where that value was populated by a means that bypasses the normal username sanitisation. This is a defence-in-dep...
WP 4.9 - 7.1.3 - Editor+ Stored XSS via Data Erasure Requests
Description WordPress does not escape a user-supplied value before outputting it on an administrative screen in some cases, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks that run in the context of a logged-in administrator...
WP 4.9 - 7.1.3 - Unauthenticated Customizer Changeset Disclosure
Description WordPress does not correctly restrict access to unpublished Customizer changesets in some cases, which could allow unauthenticated users to disclose draft Customizer state and the preview identifier...
WP 6.9 - 7.1.3 - Post Note Disclosure, Modification and Deletion via Comment Moderation Capability
Description WordPress does not correctly enforce access control on post notes in some cases, which could allow users holding only the comment-moderation capability to read, modify and delete private notes on posts they cannot otherwise edit...
WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Customizer Selective Refresh
Description WordPress does not safely handle a stored selector value during Customizer selective refresh in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks in an administrator's Customizer session on sites using a classic...
WP 6.5 - 7.1.3 - Contributor+ Stored DoS via Interactivity API Bindings
Description WordPress does not safely handle certain Interactivity API binding values in some cases, which could allow users with contributor-level access and above to break page interactivity for users viewing the affected content. This also affects the Gutenberg plugin...
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API href Binding
Description WordPress does not prevent unsafe URL protocols in Interactivity API href bindings in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against users who follow a crafted link. This also affects the Gutenberg...
WP 5.0 - 7.1.3 - Contributor+ Stored XSS via Block Markup Parsing
Description WordPress does not correctly sanitise block attribute content in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against higher-privileged users such as administrators. This also affects the Gutenberg plugin...
WP 6.6 - 7.1.3 - Contributor+ KSES Restriction Bypass via Interactivity API Object Bindings
Description WordPress does not re-validate object element attributes after Interactivity API directive processing in some cases, which could allow users with contributor-level access and above to bypass the restrictions on object elements and load arbitrary same-origin content, up to capturing an...
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Event Handler Bindings
Description WordPress does not sanitise event-handler values bound through Interactivity API directives in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session. This also affec...
WP 6.6 - 7.1.3 - Author+ Stored XSS via Interactivity Router
Description WordPress does not verify that a fetched response was produced as a navigation page before processing it in some cases, which could allow users with author-level access and above to perform Stored Cross-Site Scripting attacks against users who follow a crafted link. This also affects...
WP 6.4 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Prototype-Chain Property Injection
Description WordPress does not restrict Interactivity API property lookups to safe own properties in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the content is...
WP 6.5 - 7.1.3 - Contributor+ Stored XSS via Interactivity API Context Namespace Pollution
Description WordPress does not correctly isolate Interactivity API context data in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks that execute in a higher-privileged user's session when the content is previewed. This also...
WP < 7.1.4 - Unauthenticated RCE During Core Update
Description WordPress does not adequately restrict access to the core update process in some cases, which could allow an unauthenticated attacker to take over the site while an update is in progress...
WP 5.9 - 7.1.3 - Contributor+ Stored XSS via Comments Pagination Previous Block
Description WordPress does not escape a block attribute in a comments pagination block in some cases, which could allow users with contributor-level access and above to perform Stored Cross-Site Scripting attacks against site visitors. This also affects the Gutenberg plugin...
Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE
Description The plugin does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. PoC The PoC will be...
Avada | Website Builder For WordPress & WooCommerce < 7.16.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in...
WP < 7.1.3 - Unauthenticated Private Post Comment Disclosure via RSS Feed
Description WordPress does not properly restrict access to the comments associated with private and unpublished posts in some cases, which could allow unauthenticated users to read those comments through a feed...
WP < 7.1.3 - Contributor+ Stored XSS via Imgur Embed
Description WordPress does not escape some of the HTML returned by a trusted third-party oEmbed provider before outputting it in some cases, which could allow users with Contributor-level access and above to perform Stored Cross-Site Scripting attacks through a crafted embed...
WP < 7.1.3 - Action Injection via Post Status Transition Dynamic Hooks
Description WordPress does not restrict some dynamically generated action hook names to registered post statuses and types during a status transition in some cases, which could allow an attacker who can introduce a post with attacker-controlled status or type through a separate vulnerability to...
WP < 7.1.3 - Author+ Sticky Post via REST API
Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...
WP < 7.1.3 - Unauthenticated Stored XSS via Comment Moderation
Description WordPress does not properly sanitize and escape some malformed comment content in some cases, which could allow unauthenticated users to store comments that perform Stored Cross-Site Scripting attacks in the context of an administrator moderating them...
WP < 7.1.3 - Contributor+ DoS via Block Editor URL Details
Description WordPress does not correctly handle some malformed relative URL paths while resolving them in some cases, which could allow users with Contributor-level access and above to trigger an uncontrolled loop and cause a denial of service through server worker exhaustion...
WP < 7.1.3 - Author+ SQLi via WXR Export
Description WordPress does not properly validate some post meta values before using them in a database query when exporting content in some cases, which could allow users with Author-level access and above to store a crafted value that results in SQL injection executed when an administrator later...
Avada | Website Builder For WordPress & WooCommerce < 7.16.2 - Reflected Cross-Site Scripting via 'lang' Parameter
Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for...
WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution
Description WordPress does not properly validate a request parameter used when resolving page templates in some cases, which could allow unauthenticated attackers to include an existing local PHP file from outside the theme directories, potentially leading to remote code execution depending on th...
WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen
Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...
WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API
Description WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit...
WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite
Description WordPress does not properly restrict plugin activation on Multisite in some cases, which could allow site administrators to activate an installed plugin network-wide...
WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC
Description WordPress does not properly enforce the capability required to edit custom CSS when publishing customizer changes through XML-RPC in some cases, which could allow site administrators on Multisite, who are denied that capability, to inject arbitrary CSS into the site...
WP < 7.1.1 - Author+ Path Traversal via Templates REST API
Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...
WP < 7.1.1 - Contributor+ Arbitrary Post Modification
Description WordPress does not properly verify that a user is allowed to edit a post when handling a post creation request that names an existing post in some cases, which could allow users with a role as low as contributor to overwrite the title, content and author of any post, including those...
WP < 7.1.1 - Admin+ Stored XSS via Custom Header
Description WordPress does not sanitise and escape some custom header settings before outputting them back in an admin screen in some cases, which could allow users with a high role, such as site administrators on Multisite, to perform Stored XSS attacks against other users, such as super...
WP < 7.1.1 - Theme Installation via CSRF
Description WordPress does not properly handle a parameter of the theme installer screen in some cases, which could allow attackers to make a logged in administrator install a theme from the WordPress.org directory via a crafted link...
WP < 7.1.1 - Unauthenticated Stored XSS via Comments
Description WordPress does not properly sanitise and format comment content in some cases, which could allow unauthenticated visitors to perform Stored XSS attacks against anyone viewing the post once the comment is approved...
Divi < 5.12.0 - Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Description The theme is vulnerable to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force...
Divi < 4.27.7 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Description The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict...
Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and...
Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization...
Divi < 4.27.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Description The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which onl...
Divi < 4.27.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
Description The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the skypeurl shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: 1 the skypeurl field is not included in the...
Divi < 4.27.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
Description The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being...
Divi < 4.27.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
Description The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields...