14653 matches found
WP Tabs < 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The WP Tabs – Responsive Tabs Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...
WP Review Slider < 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The WP Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
WP Frontend Profile < 1.3.2 - Unauthenticated Privilege Escalation
Description The plugin is vulnerable to privilege, allowing unauthenticated attackers to take over arbitrary accounts on the site...
Automation By Autonami < 2.7.0 - Authenticated(Administrator+) SQL Injection
Description The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 2.7.0 exclusive due to insufficient escaping on the user supplied parameter and...
WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload
Description The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may...
WP MLM Unilevel <= 4.0 - Unauthenticated Privilege Escalation
Description The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to privilege in all versions up to, and including, 4.0. This makes it possible for unauthenticated attackers to take over arbitrary accounts on the site...
WP Job Portal < 2.0.7 - Cross-Site Request Forgery
Description The WP Job Portal – A Complete Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to...
WP Remote Site Search < 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The WP Remote Site Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on the 'maxresults' user supplied attribute. This makes it...
WP Simple Booking Calendar < 2.0.8.5 - Cross-Site Request Forgery
Description The WP Simple Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.8.4. This is due to missing or incorrect nonce validation on the wpsbcrefreshcalendareditor function. This makes it possible for unauthenticated...
WP Stripe Checkout < 1.2.2.38 - Sensitive Information Exposure via Debug Log
Description The WP Stripe Checkout plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.2.37 via the debug log file. This makes it possible for unauthenticated attackers to extract sensitive data including stripe checkout debug information...
WP Chat App < 3.4.5 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
wpDiscuz < 7.6.13 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WS Form LITE < 1.9.171 - Authenticated(Administrator+) SQL Injection
Description The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.9.171 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
Depicter Slider < 2.0.7 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Happy Addons for Elementor (Free < 3.10.0, Pro < 2.10.0) - Reflected Cross-Site Scripting
Description The plugins are vulnerable to Reflected Cross-Site Scripting via DOM due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into...
Weaver Xtreme < 6.4 - Contributor+ Stored XSS
Description The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta page-head-code. This makes it possible for authenticated...
Hostinger < 1.9.8 - Unauthenticated Maintenance Mode Toggle
Description The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publishwebsite in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance...
Oxygen Builder < 4.8.1 - Contributor+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via a custom field due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut...
Orbit Fox Companion < 2.10.27 - Contributor+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields due to insufficient input sanitization and output escaping on user supplied values, allowing authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in...
Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC 1. Access the "Restrict Usernames Emails Characters" settings 2. For the field "The...
EventON < 4.4.1 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page containing one of the code below: 2.6.x the cmon...
Profile Builder < 3.10.8 - Contributor+ User Metadata Disclosure
Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the wppbtoolboxusermetahandler function allowing authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata...
Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS
Description The plugin does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name PoC Login as subscriber, open...
LightStart < 2.6.9 - Subscriber+ Page design Update
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the inserttemplate function, allowing authenticated attackers, with subscriber-level access and above, to change page designs...
WP STAGING WordPress Backup Plugin – Migration Backup Restore < 3.2.0 - Unauthorized Sensitive Data Exposure
Description The plugin allows access to cache files during the cloning process which provides unauthorized access to sensitive data PoC 1 When an admin creates a staging site, an attacker can capture a .cache file which reveals sensitive information including: DBname, DBtables, DBcolumns. 2 These...
WP Optin Wheel < 1.4.3 - Sensitive Information Exposure via Log File
Description The WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the plugin's debug log file. This makes it possible for unauthenticated attackers...
WordPress Infinite Scroll - Ajax Load More < 6.2 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
RegistrationMagic < 5.2.5.1 - Form Submission Limit Bypass
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to form submission limit bypass in all versions up to, and including, 5.2.5.0 due to insufficient protection logic. This makes it possible for unauthenticat...
Icegram < 3.1.19 - Cross-Site Request Forgery via save_campaign_preview
Description The Icegram plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.18. This is due to missing or incorrect nonce validation on the savecampaignpreview function. This makes it possible for unauthenticated attackers to save campaign previe...
Icegram < 3.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message
Description The Icegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the campaign message field in versions up to, and including, 3.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
Happy Addons for Elementor < 3.10.0 - Contributor+ SSRF
Description The plugin is vulnerable to Server-Side Request Forgery, allowing authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services...
LA-Studio Element Kit for Elementor < 1.1.6 - Missing Authorization
Description The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a REST-API endpoint in versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the plugin's...
Inline Image Upload for BBPress < 1.1.19 - Cross-Site Request Forgery via hm_bbpui_admin_page
Description The Inline Image Upload for BBPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the hmbbpuiadminpage function. This makes it possible for unauthenticated attackers to...
Rate my Post < 3.4.3 - IP Spoofing
Description The Rate my Post – WP Rating System plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.4.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for...
Schema & Structured Data for WP & AMP < 1.24 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
Block IPs for Gravity Forms < 1.0.2 - Cross-Site Request Forgery
Description The Block IPs for Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an...
Add Any Extension to Pages < 1.5 - Cross-Site Request Forgery via aaetp_options_page
Description The Add Any Extension to Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'aaetpoptionspage' function. This makes it possible for unauthenticated attackers to...
weForms < 1.6.19 - Missing Authorization via export_form_entries
Description The weForms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportformentries' function in versions up to, and including, 1.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
weForms – Easy Drag & Drop Contact Form Builder For WordPress < 1.6.18 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 1.6.18 exclusive due to insufficient input sanitization and output escaping. This makes it possible for...
Ecwid Ecommerce Shopping Cart < 6.12.5 - Cross-Site Request Forgery
Description The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.4. This is due to missing nonce validation on several functions hooked via AJAX in the /includes/class-ecwid-admin-storefront-page.php. This...
Spam protection, AntiSpam, FireWall by CleanTalk < 6.21 - Counters Reset/Creation via CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as reset/create counters...
Spam protection, AntiSpam, FireWall by CleanTalk < 6.21 - Email Update via CSRF
Description The plugin does not have CSRF check in its apbctsettingsupdateaccountemail function, which could allow attackers to make logged in admins update email address via a CSRF attack...
WooCommerce Easy Duplicate Product < 0.3.0.8 - Missing Authorization via wedp_duplicate_product_action
Description The WooCommerce Easy Duplicate Product plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wedpduplicateproductaction function hooked via AJAX in versions up to, and including, 0.3.0.7. This makes it possible for authenticat...
Duplicator < 1.5.7.1 - Settings Removal via CSRF
Description The plugin does not have CSRF checks when remove some of its options, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Dynamic Content for Elementor < 2.12.5 - Cross-Site Request Forgery
Description The Dynamic Content for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 2.12.5. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized...
EnvíaloSimple < 2.2 Unauthenticated PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed...
EnvíaloSimple <= 2.4 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
AI Power: Complete AI Pack – Powered by GPT-4 < 1.8.3 - Missing Authorization to Sensitive Data Exposure
Description The AI Power: Complete AI Pack – Powered by GPT-4 plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicgexportlogscallback function in all versions up to, and including, 1.8.2. This makes it possible for unauthenticated attackers to...
GPT3 AI Content Writer < 1.8.13 - Cross-Site Request Forgery
Description The GPT3 AI Content Writer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.12. This is due to missing or incorrect nonce validation on the wpaicgexportlogscallback function. This makes it possible for unauthenticated attackers to...
GS Logo Slider < 3.5.2 - Cross-Site Request Forgery
Description The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on an unknown function. This mak...