14677 matches found
Amelia < 1.0.99 - Missing Authorization
Description The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...
12 Step Meeting List < 3.14.29 - Subscriber+ CSV Download
Description The plugin does not have authorisation in its csv AJAX action, allowing any authenticated users, such a subscriber to export meetings and gain access to sensitive information...
WP Mail Log < 1.1.3 - Editor+ SQL Injection via id
Description The plugin is vulnerable to SQL Injection via the ‘id’ parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
Advanced Database Cleaner < 3.1.4 - Administrator+ PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the 'processbulkaction' function. This makes it possible for authenticated attacker, with administrator access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin...
Auto Affiliate Links < 6.4.2.6 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
File Manager Pro < 8.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
Description The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mkcheckfilemanagerphpsyntax AJAX function. This makes it possible for authenticated attackers, with subscriber access and above, to execute code on the...
Paid Memberships Pro < 2.12.8 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Views for WPForms < 3.2.3 - Missing Authorization via save_view
Description The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveview' function in all versions up to, and including, 3.2.2. This makes it possible for...
Views for WPForms < 3.2.3 - Missing Authorization via create_view
Description The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'createview' function in all versions up to, and including, 3.2.2. This makes it possible for...
SalesKing < 1.6.30 - Unauthenticated Privilege Escalation
Description The plugin is vulnerable to privilege escalation. This allows unauthenticated attackers to create arbitrary malicious administrator accounts...
CBX Map for Google Map & OpenStreetMap < 1.1.12 - Contributor+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user...
GS Team Members < 2.2.4 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...
FileBird < 5.6.1 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Ninja Tables < 5.0.7 - Contributor+ Table Data Access
Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the dragAndDropExport function. This makes it possible for authenticated attackers, with contributor-level access and above, to export table data...
ChatBot < 5.1.1 - Unauthenticated PHP Object Injection
Description The ChatBot with AI plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.0 via deserialization of untrusted input via the lastfiveprompt cookies. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain i...
Formzu WP < 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Formzu WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
WP-Lister Lite for eBay < 3.5.8 - Reflected Cross-Site Scripting via 's'
Description The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Content Views < 3.6.3 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Photo Gallery by 10Web - Mobile-Friendly Image Gallery < 1.8.20 - Directory Traversal to Arbitrary File Rename
Description The plugin is vulnerable to Directory Traversal attacks via the renameitem function. This makes it possible for authenticated attackers to rename arbitrary files on the server. Note: By default this can be exploited by administrators only. In the premium version of the plugin,...
Contact Form builder with drag & drop - Kali Forms < 2.3.37 - Insecure Direct Object Reference
Description The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.38 due to missing validation on a user controlled key. This makes it possible for unauthenticated...
WooCommerce Parcel Pro < 1.6.12 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
ARI Stream Quiz < 1.3.0 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Shield Security < 18.5.8 - Unauthenticated Stored Cross-Site Scripting
Description The plugin is vulnerable to Stored Cross-Site Scripting via the getColumnContentPage function due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...
ColorMag < 3.1.3 - Missing Authorization to Arbitrary Plugin Installation
Description The plugin is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up to, allowing authenticated attackers, with subscriber-level access and above, to install and activate arbitrary plugins...
Simple Membership < 4.4.2 - Open Redirect
Description The plugin is vulnerable to Open Redirect. This is due to insufficient validation on the redirect url supplied via the swpmpageurl parameter, making it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into...
WP Go Maps (formerly WP Google Maps) < 9.0.29 - Unauthenticated Reflected Cross-Site Scripting
Description The plugin is vulnerable to Reflected Cross-Site Scripting via the map id parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...
Views for WPForms < 3.2.3 - Cross-Site Request Forgery via create_view
Description The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'createview' function. This makes it...
Better Search Replace < 1.4.5 - Unauthenticated PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed...
Category Discount Woocommerce < 4.13 - Missing Authorization via wpcd_save_discount()
Description The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcdsavediscount function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify produ...
WPFront Notification Bar < 3.4 - Admin+ Stored XSS
Description The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
FreshMail For WordPress <= 2.3.2 - Cross-Site Request Forgery
Description The FreshMail For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.2. This is due to missing nonce validation function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...
Floating Action Button < 1.2.2 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
GS Pins for Pinterest Lite < 1.8.1 - Missing Authorization via _update_shortcode
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check and a misconfigured nonce check on the updateshortcode function, allowing authenticated attackers, with subscriber access and above, to update the plugin's shortcodes...
Robo Gallery < 3.2.18 - Author+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting idue to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user...
Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack PoC Have an admin open an HTML file containing the following:...
Better Follow Button for Jetpack <= 8.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Navigate to:...
illi Link Party! <= 1.0 - Unauthenticated Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow unauthenticated vistors to perform Cross-Site Scripting attacks. PoC 1. Add a new link party and add its shortcode to a new post. 2. In a new private window, navigate to the post where you added the shortcode...
Advanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Visit the "Settings" interface...
WP-Reply Notify <= 1.1 - Settings Update via CSRF
Description The plugin does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. PoC Make an admin open an HTML page containing the following:...
aBitGone CommentSafe <= 1.0.0 - Settings Update to Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. PoC Make an admin open an HTML file containing the following:...
illi Link Party! <= 1.0 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitize and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks. PoC 1. Go to "Settings Link Party!". 2. Under "Add a New Party", enter the payload for either the "Party Name" or "Party Description":...
illi Link Party! <= 1.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC Make an admin open the following HTML: See that the support the plugin option is toggled on/off...
WolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. In the settings of the plugin,...
Add SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG
Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC Upload an SVG with the following code: Access the uploaded file directly to see the XSS...
Travelpayouts < 1.1.14 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below:...
Advanced Schedule Posts <= 2.1.8 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins. PoC...
WP Customer Area < 8.2.3 - Reflected Cross-Site Scripting
Description The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
illi Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletion
Description The plugin lacks proper access controls, allowing unauthenticated visitors to delete links. PoC http://example.com/?page=illi3/includes/functions.php=deletesubmission=INSERTID Replace "INSERTID" with an ID of a link and hit enter. The link will be deleted...
Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC Have an admin open an HTML page containing the following:...
SVG Uploads Support <= 2.1.1 - Author+ Stored XSS via SVG
Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC Upload an SVG with the following code: Access the uploaded file directly to see the XSS...