WPCS – WordPress Currency Switcher Professional < 1.2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WebinarIgnition < 3.05.1 - Missing Authorization to Unauthenticated Privilege Escalation

Description The Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.05.0. This makes it possible...

Product Feed Manager < 7.3.16 - Authenticated (Admin+) Directory Traversal

Description The Product Feed Manager – WooCommerce to Google Shopping, Social Catalogs, and 170+ Popular Marketplaces plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.3.15 via the vulnerable parameter 'logKey'. This makes it possible for authenticated...

ZeroBounce Email Verification & Validation < 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The ZeroBounce Email Verification & Validation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Active Products Tables for WooCommerce < 1.0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output...

Events Shortcodes & Templates For The Events Calendar < 2.3.2 - Authenticated (Contributor+) SQL Injection via shortcode

Description The Events Shortcodes & Templates For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 2.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection

Description The Clockwork SMS Notfications plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

Advanced Form Integration < 1.76.0 - Authenticated(Administrator+) SQL Injection

Description The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.76.0 exclusive due to insufficient escaping on the user supplied parameter a...

WP Review Slider < 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The WP Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

Checkout Mestres WP < 7.1.9.8 - Authentication Bypass via Password Reset

Description The plugin is vulnerable to authentication bypass due to a weak password reset functionality, allowing unauthenticated attackers to reset the password of arbitrary users to a guessable value based on the current time...

WP Frontend Profile < 1.3.2 - Unauthenticated Privilege Escalation

Description The plugin is vulnerable to privilege, allowing unauthenticated attackers to take over arbitrary accounts on the site...

Sensei LMS < 4.18.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its block attributes before outputting them back in a page/post where the block is rendered, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Back Button Widget < 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Back Button Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Rencontre – Dating Site < 3.11 - Unauthenticated Arbitrary File Upload

Description The Rencontre – Dating Site plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 3.10.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution...

WooCommerce PDF Invoices < 4.3.0 - Shop Manager+ Arbitrary Options Update

Description The plugin does not have proper authorisation in its JSON import feature, which could allow Shop Manager and above roles to update arbitrary blog options...

Rencontre – Dating Site < 3.11.2 - Subscriber+ PHP Object Injection

Description The plugin unserializes user input, which could allow any authenticated users, such as subscribers to perform PHP Object Injection when a suitable gadget is present on the blog...

BuddyBoss Theme < 2.4.61 - Missing Authorization

Description The BuddyBoss Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unspecified function in all versions up to, and including, 2.4.60. This makes it possible for unauthenticated attackers to change the plugin's settings...

Login Lockdown < 2.07 - Admin+ SQLi

Description The plugin does not properly sanitise and escape the iDisplayStart parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Simply Schedule Appointments < 1.6.6.1 - Authenticated(Administrator+) SQL Injection

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.6.6.1 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient...

Orbit Fox Companion < 2.10.27 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields due to insufficient input sanitization and output escaping on user supplied values, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in...

WooCommerce PDF Invoice Builder < 1.2.102 - Cross-Site Request Forgery

Description The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.101. This is due to missing or incorrect nonce validation in the /pages/invoicelist.php file. This makes it possible for unauthenticated attackers...

Checkout Mestres WP < 7.1.9.8 - Unauthenticated SQL Injection

Description The Checkout Mestres WP plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 7.1.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Paid Member Subscriptions < 2.10.5 - Cross-Site Request Forgery via ajax_add_log_entry

Description The Paid Member Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce validation on the ajaxaddlogentry function. This makes it possible for unauthenticated attackers to modify...

HUSKY < 1.3.4.4 - Multiple Connections/Stats CSRF

Description The plugin does not have CSRF checks in various functions, which could allow attackers to make logged in admins perform unwanted actions related to connections and stats features via CSRF attacks...

Eazy Plugin Manager < 4.1.3 - Missing Authorization via update_options

Description The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateoptions' function in all versions up to, and including, 4.1.2. This makes it possible for...

Hostinger < 1.9.8 - Unauthenticated Maintenance Mode Toggle

Description The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publishwebsite in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance...

GEO my WordPress < 4.0.3 - Authenticated(Administrator+) SQL Injection

Description The GEO my WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to 4.0.3 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

NitroPack < 1.10.3 - Multiple CSRF

Description The plugin does not have CSRF checks in various functions places, which could allow attackers to make logged in admins perform unwanted actions via CSRF attacks...

Stock Ticker < 3.23.5 - Authenticated (Contributor+) Stored Cross-Site Scritping

Description The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

Checkout Mestres WP < 7.1.9.8 - Missing Authorization to Unauthenticated Arbitrary Options Update

Description The Checkout Mestres WP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.1.9.6. This makes it possible for unauthenticated attackers to update arbitrary site options...

Rise Blocks – A Complete Gutenberg Page Builder < 3.2 - Cross-Site Request Forgery

Description The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated...

Easy Digital Downloads < 3.2.6 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

SlickNav Mobile Menu < 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The SlickNav Mobile Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WP STAGING WordPress Backup Plugin – Migration Backup Restore < 3.2.0 - Unauthorized Sensitive Data Exposure

Description The plugin allows access to cache files during the cloning process which provides unauthorized access to sensitive data PoC 1 When an admin creates a staging site, an attacker can capture a .cache file which reveals sensitive information including: DBname, DBtables, DBcolumns. 2 These...

Brave Popup Builder < 0.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping...

Send Users Email < 1.4.4 - Sensitive Information Exposure via Error Logs

Description The Send Users Email plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.3 via the plugin's error logs. This makes it possible for unauthenticated attackers to extract sensitive data about the plugin and site configuration...

Build App Online <= 1.0.19 - Unauthenticated Account Takeover via Weak Password Reset Mechanism

Description The plugin is vulnerable to account takeover due to a weak password reset mechanism, allowing unauthenticated attackers to reset the password of arbitrary users by guessing an 8-digit numeric reset code...

Webba Booking < 5.0 - Cross-Site Request Forgery

Description The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.33. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for...

Database Cleaner < 0.9.9 - Sensitive Information Exposure via Log File

Description The Database Cleaner: Clean, Optimize & Repair plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.8 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data including system an...

Build App Online <= 1.0.19 - Subscriber+ Privilege Escalation

Description The plugin does not have authorisation in its updateusermetavalue function, allowing any authenticated users, such as subscriber to update arbitrary user metadata and grand themselves administrator privileges...

Product Catalog Simple < 1.7.7 - Sensitive Information Exposure via Product CSV

Description The Product Catalog Simple plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.7.7 exclusive via Import and Export Product CSV files. This makes it possible for unauthenticated attackers access and above, to extract sensitive data including ful...

eCommerce Product Catalog < 3.3.27 - Sensitive Information Exposure via CSV Files

Description The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 3.3.27 exclusive via import and export CSV files. This makes it possible for unauthenticated attackers to extract sensitive data including full...

Uncanny Automator < 5.1.0.3 - Sensitive Information Exposure via Log File

Description The Uncanny Automator – Automate everything with the 1 no-code automation and integration plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.0.2 via the plugin's log file. This makes it possible for unauthenticated...

WP MLM Unilevel <= 4.0 - Unauthenticated Privilege Escalation

Description The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to privilege in all versions up to, and including, 4.0. This makes it possible for unauthenticated attackers to take over arbitrary accounts on the site...

Booking Manager < 2.1.6 - Authenticated(Contributor+) SQL Injection via Shortcode

Description The Booking Manager plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode attributes in all versions up to 2.1.6 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

WebinarIgnition < 3.05.1 - Unauthenticated SQL Injection

Description The Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 3.05.0 due to insufficient escaping on the user supplied...

WP Chat App < 3.4.5 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Login as User or Customer (User Switching) <= 3.8 - Authentication Bypass

Description The Login as User or Customer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.8. This makes it possible for unauthenticated attackers to login as another user and escalate their privileges...

Easy PayPal Buy Now Button < 1.8.2 - Cross-Site Request Forgery

Description The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this...

Auto Amazon Links < 5.1.2 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user...