14623 matches found
Custom 404 Pro < 3.10.1 - Unauthenticated Stored Cross-Site Scripting via logging
Description The Custom 404 Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several logged parameters in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Product Table by WBW < 1.8.7 - Cross-Site Request Forgery via saveGroup
Description The Product Table by WBW plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on the saveGroup function. This makes it possible for unauthenticated attackers to modify product...
BookIt < 2.4.4 - Authenticated(Administrator+) SQL Injection
Description The Booking Calendar | Appointment Booking | BookIt plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 2.4.4 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
WebinarIgnition < 3.05.1 - Unauthenticated SQL Injection
Description The Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 3.05.0 due to insufficient escaping on the user supplied...
Rencontre – Dating Site < 3.11 - Privilege Escalation
Description The Rencontre plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.10.1. This is due to an unknown issue. This makes it possible for unauthenticated attackers to gain elevated privileges...
Uncode Core < 2.8.9 - Privilege Escalation
Description The Uncode Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.8.8. This makes it possible for subscribers to escalate their privileges to those of a higher level account...
Beaver Builder < 2.7.2.1 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape some of its settings available to Contributor and above roles, which could allow them to perform Stored Cross-Site Scripting attacks...
Easy Digital Downloads < 3.2.0 - Missing Authorization
Description The plugin is vulnerable to unauthorized access due to a missing capability check on a function, allowing unauthenticated attackers to perform an unauthorized action...
ARMember < 4.0.11 - Subscriber+ Privilege Escalation
Description The plugin is vulnerable to privilege escalation due to insufficient input validation, allowing subscriber users and above to escalate their privileges...
Webba Booking < 5.0 - Cross-Site Request Forgery
Description The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.33. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for...
Thrive Automator < 1.17.1 - Cross-Site Request Forgery
Description The Thrive Automator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.17. This is due to missing or incorrect nonce validation on the factoryreset function. This makes it possible for unauthenticated attackers to reset plugin setting...
Affiliates Manager < 2.9.31 - Sensitive Information Exposure via Log File
Description The Affiliates Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.30 via the plugin's log files. This makes it possible for unauthenticated attackers to extract sensitive data including plugin configuration and debug...
LightStart < 2.6.9 - Subscriber+ Page design Update
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the inserttemplate function, allowing authenticated attackers, with subscriber-level access and above, to change page designs...
Image Source Control < 2.17.1 - Sensitive Information Exposure via Log File
Description The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.0 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data...
CBX Bookmark & Favorite < 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The CBX Bookmark & Favorite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and abov...
ARI Stream Quiz < 1.3.0 - Cross-Site Request Forgery
Description The ARI Stream Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.32. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions against classes and...
Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC 1. Access the "Restrict Usernames Emails Characters" settings 2. For the field "The...
Happy Addons for Elementor (Free < 3.10.0, Pro < 2.10.0) - Reflected Cross-Site Scripting
Description The plugins are vulnerable to Reflected Cross-Site Scripting via DOM due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into...
Brizy < 2.4.30 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Defender Security < 4.2.0 - Sensitive Information Exposure via Log File
Description The Defender Security – Malware Scanner, Login Security & Firewall plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.0 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data...
Related Post < 2.0.54 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Related Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.53 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
Checkout Mestres WP < 7.1.9.8 - Missing Authorization to Unauthenticated Arbitrary Options Update
Description The Checkout Mestres WP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 7.1.9.6. This makes it possible for unauthenticated attackers to update arbitrary site options...
Restaurant Reservations < 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Restaurant Reservations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, ...
Rencontre – Dating Site < 3.11 - Unauthenticated Arbitrary File Upload
Description The Rencontre – Dating Site plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 3.10.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution...
Active Products Tables for WooCommerce < 1.0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output...
NEX-Forms – Ultimate Form Builder – Contact forms and much more < 8.5.6 - Authenticated (Admin+) SQL Injection
Description The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 8.5.6 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
MStore API < 4.10.2 - Cross-Site Request Forgery
Description The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 4.10.2 exclusive. This is due to missing or incorrect nonce validation in the templates/admin/mstore-api-admin-dashboard.php file. This makes it possible for unauthenticated attackers...
BookingPress < 1.0.75 - Unauthenticated Booking Price Manipulation
Description The plugin does not have proper validation in its bookingpressconfirmbooking, allowing unauthenticated user to modify the price of an appointment...
Job Manager & Career – Manage job board listings, and recruitments < 1.4.5 - Cross-Site Request Forgery to PHP Object Injection
Description The Job Manager & Career – Manage job board listings, and recruitments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the savepluginsettings function. This makes it...
Eazy Plugin Manager < 4.1.3 - Missing Authorization via update_options
Description The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateoptions' function in all versions up to, and including, 4.1.2. This makes it possible for...
NitroPack < 1.10.3 - Multiple CSRF
Description The plugin does not have CSRF checks in various functions places, which could allow attackers to make logged in admins perform unwanted actions via CSRF attacks...
Uncanny Automator < 5.1.0.3 - Sensitive Information Exposure via Log File
Description The Uncanny Automator – Automate everything with the 1 no-code automation and integration plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.0.2 via the plugin's log file. This makes it possible for unauthenticated...
Send Users Email < 1.4.4 - Sensitive Information Exposure via Error Logs
Description The Send Users Email plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.3 via the plugin's error logs. This makes it possible for unauthenticated attackers to extract sensitive data about the plugin and site configuration...
WP Job Portal < 2.0.7 - Cross-Site Request Forgery
Description The WP Job Portal – A Complete Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to...
WordPress.com Editing Toolkit < 3.79150 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its block attributes before outputting them back in a page/post where the block is rendered, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Simple Job Board < 2.10.7 - Cross-Site Request Forgery
Description The Simple Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown...
Theme per user < 1.0.2 - Unauthenticated PHP Object Injection
Description The Theme per user plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 1.0.2 exclusive via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If...
YITH WooCommerce Product Add-Ons < 4.3.1 - Authenticated(Shop Manager+) PHP Object Injection
Description The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 4.3.1 exclusive via deserialization of untrusted input in the 'saveaddon' function. This makes it possible for authenticated attackers, with Shop Manager access and...
WP STAGING WordPress Backup Plugin – Migration Backup Restore < 3.2.0 - Unauthorized Sensitive Data Exposure
Description The plugin allows access to cache files during the cloning process which provides unauthorized access to sensitive data PoC 1 When an admin creates a staging site, an attacker can capture a .cache file which reveals sensitive information including: DBname, DBtables, DBcolumns. 2 These...
Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS
Description The plugin does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name PoC Login as subscriber, open...
GEO my WordPress < 4.0.3 - Authenticated(Administrator+) SQL Injection
Description The GEO my WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to 4.0.3 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
Build App Online <= 1.0.19 - Subscriber+ Privilege Escalation
Description The plugin does not have authorisation in its updateusermetavalue function, allowing any authenticated users, such as subscriber to update arbitrary user metadata and grand themselves administrator privileges...
My Agile Privacy < 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode
Description The My Agile Privacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
Uncode Core < 2.8.7 - Reflected Cross-Site Scripting
Description The uncode-core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
E2Pdf < 1.20.24 - Authenticated(Administrator+) SQL Injection
Description The E2Pdf – Export To Pdf Tool for WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.20.24 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
Squirrly SEO - Advanced Pack <= 2.3.8 - Authenticated(Administrator+) SQL Injection
Description The Squirrly SEO - Advanced Pack plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 2.3.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
wpDiscuz < 7.6.13 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WooCommerce Easy Duplicate Product < 0.3.0.8 - Missing Authorization via wedp_duplicate_product_action
Description The WooCommerce Easy Duplicate Product plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wedpduplicateproductaction function hooked via AJAX in versions up to, and including, 0.3.0.7. This makes it possible for authenticat...
weForms < 1.6.19 - Missing Authorization via export_form_entries
Description The weForms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportformentries' function in versions up to, and including, 1.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
WooCommerce Ship to Multiple Addresses < 3.8.10 - Missing Authorization
Description The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to unauthorized action due to a missing capability check on a function in versions up to, and including, 3.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to...