14652 matches found
User Activity Log Pro <= 2.3.4 - Authenticated (Subscriber+) SQL Injection
Description The User Activity Log Pro plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Essential Blocks < 4.5.10 - Contributor+ DOM-Based XSS via Social Icons Block
Description The plugin is vulnerable to Stored Cross-Site Scripting via the "Social Icons" block due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary...
Jotform Online Forms < 1.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on use...
Find Duplicates <= 1.4.6 - Authenticated (Subscriber+) SQL Injection
Description The Find Duplicates plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
LearnPress – WordPress LMS Plugin < 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
Freshdesk (official) < 2.4.0 - Open Redirect
Description The plugin is vulnerable to Open Redirect due to insufficient validation on a redirect url. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action...
Add Custom CSS and JS <= 1.20 - Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack PoC Make an author or above role open the following HTML:...
Save as PDF < 3.2.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. On the "Settings Save as PDF...
FV Flowplayer Video Player < 7.5.45.7212 - Authenticated (Contributor+) Arbitrary Redirect
Description The FV Flowplayer Video Player plugin for WordPress is vulnerable to unauthorized redirects in all versions up to, and including, 7.5.44.7212. This is due to the plugin not restricting contributor and above users from being able to add redirects at the end of videos. This makes it...
Element Pack Elementor Addons < 5.6.1 - Contributor+ Stored XSS via Panel Slider Widget
Description The plugin is vulnerable to Stored Cross-Site Scripting via the ‘tablink’ attribute of the Panel Slider widget due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary w...
Disable Comments | WPZest <= 1.51 - Authenticated (Administrator+) SQL Injection
Description The Disable Comments | WPZest plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.51 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure
Description The Citadela Directory plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.18.1. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data...
Easy Custom Auto Excerpt < 2.5.0 - Sensitive Information Exposure
Description The Easy Custom Auto Excerpt plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12. This makes it possible for unauthenticated attackers to obtain excerpts of password-protected posts...
Convert Post Types <= 1.4 - Cross-Site Request Forgery
Description The Convert Post Types plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown...
FileBird < 5.6.4 - Author+ Users Folder Deletion
Description The plugin is vulnerable to Insecure Direct Object Reference via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads...
Ovic Addon Toolkit <= 2.6.1 - Missing Authorization
Description The Ovic Addon Toolkit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an...
Podlove Podcast Publisher < 4.0.14 - Authenticated (Contributor+) SQL Injection
Description The Podlove Podcast Publisher plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Libsyn Publisher Hub <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Libsyn Publisher Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, t...
Essential Addons for Elementor < 5.9.15 - Contributor+ Store XSS via Widget URL
Description The plugin is vulnerable to Stored Cross-Site Scripting via the URL attributes of widgets due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...
Libsyn Publisher Hub <= 1.4.4 - Cross-Site Request Forgery
Description The Libsyn Publisher Hub plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknow...
Kimili Flash Embed <= 2.5.3 - Cross-Site Request Forgery
Description The Kimili Flash Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.3. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown...
SEO Booster < 3.8.10 - Cross-Site Request Forgery
Description The SEO Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.9. This is due to missing or incorrect nonce validation on the deleteall and delete actions. This makes it possible for unauthenticated attackers to delete data in bu...
Zoho Campaigns < 2.0.8 - Cross-Site Request Forgery via zcwc_optin_save
Description The Zoho Campaigns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the zcwcoptinsave function. This makes it possible for unauthenticated attackers to update the optin...
Ads.txt Admin <= 1.3 - Cross-Site Request Forgery
Description The Ads.txt Admin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a...
WP Client Reports < 1.0.23 - Cross-Site Request Forgery
Description The WP Client Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.22. This is due to missing or incorrect nonce validation on the wpclientreportssendemailreportfromajax function. This makes it possible for unauthenticated...
WP EasyCart < 5.6.0 - Cross-Site Request Forgery
Description The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.19. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perfo...
Advanced iFrame < 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2024.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to...
Smash Balloon Social Post Feed < 4.2.2 - Facebook Token Reset/Update via CSRF
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the maybesourceconnectiondata function, allowing attacker to reset and set an arbitrary Facebook Token via a CSRF attack...
RestroPress < 3.1.2.1 - Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions
Description The RestroPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.2. This is due to missing or incorrect nonce validation on the rpressorderslisttableprocessbulkactions function. This makes it possible for unauthenticated attackers ...
Remove Footer Credit < 1.0.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Remove Footer Credit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EAN for WooCommerce < 4.9.3 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode
Description The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'algwceanproductmeta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers...
Welcart e-Commerce < 2.10.0 - Missing Authorization
Description The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the uscesitemduplicate function in versions up to, and including, 2.9.14. This makes it possible for authenticated attackers, with author-level access and above, to...
Digital Publications by Supsystic < 1.7.8 - Cross-Site Request Forgery
Description The WordPress Flipbook by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.7. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perfor...
SSL Zen <= 4.5.3 - Unauthenticated Private Keys Access
Description The plugin only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX. PoC Install the plugin on a server that doesn't...
Sync Post With Other Site < 1.5.2 - Cross-Site Request Forgery
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as...
Jobs for WordPress < 2.7.6 - Reflected Cross-Site Scripting
Description The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
Filter Custom Fields & Taxonomies Light <= 1.05 - Missing Authorization
Description The Filter Custom Fields & Taxonomies Light plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.05. This makes it possible for authenticated attackers, with subscriber-level access and above,...
Asgaros Forum < 2.9.0 - Cross-Site Request Forgery
Description The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.0. This is due to missing or incorrect nonce validation on the markallread function. This makes it possible for unauthenticated attackers to mark post topics as rea...
Church Admin < 4.0.28 - Cross-Site Request Forgery
Description The Church Admin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.27. This is due to missing or incorrect nonce validation on the cadebugmode function. This makes it possible for unauthenticated attackers to enable debug mode via a...
HT Mega < 2.4.7 - Contributor+ Stored XSS via size
Description The plugin is vulnerable to Stored Cross-Site Scripting via the 'size' value in several widgets due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to...
POEditor < 0.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The POEditor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
Download IP2Location Country Blocker < 2.34.3 - Cross-Site Request Forgery
Description The Download IP2Location Country Blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.34.2. This is due to missing or incorrect nonce validation on the validateapikey function. This makes it possible for unauthenticated attackers...
MWW Disclaimer Buttons < 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The MWW Disclaimer Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
HT Mega < 2.5.0 - Contributor+ Stored XSS via Image Grid Widget
Description The plugin is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's attributes due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages th...
WP Mail Catcher < 2.1.7 - Cross-Site Request Forgery
Description The WP Mail Catcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.6. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform unauthorized actions...
Clone < 2.4.4 - Subscriber+ Unauthorised Action Calls
Description The plugin is vulnerable to unauthorized access due to a missing capability check on several functions, allowing authenticated attackers, with subscriber-level access and above, to perform unauthorized actions...
HT Mega < 2.4.9 - Contributor+ Stored XSS via Accordion/FAQ
Description The plugin is vulnerable to Stored Cross-Site Scripting via Accordion widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...
Aspose.Words Exporter <= 6.3.1 - Missing Authorization
Description The Aspose.Words – Import and Export word documents plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.3.1. This makes it possible for authenticated attackers, with subscriber-level access a...
Short URL <= 1.6.8 - Reflected Cross-Site Scripting
Description The Short URL plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Church Content – Sermons, Events and More < 2.6.1 - Cross-Site Request Forgery to Notice Dismissal
Description The Church Content – Sermons, Events and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the ctchidethemesupportnotice function. This makes it possible for...