Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC 1. Access the "Restrict Usernames Emails Characters" settings 2. For the field "The...

BookingPress < 1.0.75 - Unauthenticated Booking Price Manipulation

Description The plugin does not have proper validation in its bookingpressconfirmbooking, allowing unauthenticated user to modify the price of an appointment...

Webba Booking < 5.0 - Cross-Site Request Forgery

Description The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.33. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for...

GEO my WordPress < 4.0.3 - Authenticated(Administrator+) SQL Injection

Description The GEO my WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to 4.0.3 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

Uncanny Automator < 5.1.0.3 - Sensitive Information Exposure via Log File

Description The Uncanny Automator – Automate everything with the 1 no-code automation and integration plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.0.2 via the plugin's log file. This makes it possible for unauthenticated...

Uncode Core < 2.8.7 - Reflected Cross-Site Scripting

Description The uncode-core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

Brizy < 2.4.30 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Quotes for WooCommerce < 2.0.2 - Missing Authorization

Description The Quotes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the qwcupdatestatus and qwcsendquote functions hooked via AJAX in all versions up to, and including, 2.0.2. This makes it possible for authenticated...

Branda < 3.4.15 - IP Spoofing

Description The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.4.14 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval...

WooCommerce Easy Duplicate Product < 0.3.0.8 - Missing Authorization via wedp_duplicate_product_action

Description The WooCommerce Easy Duplicate Product plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wedpduplicateproductaction function hooked via AJAX in versions up to, and including, 0.3.0.7. This makes it possible for authenticat...

Export Media URLs < 2.0 - Cross-Site Request Forgery

Description The Export Media URLs plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via ...

Floating Button < 6.0.1 - Cross-Site Request Forgery via process_bulk_action

Description The Floating Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.0. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to process bulk...

Customize My Account for WooCommerce < 1.8.4 - Cross-Site Request Forgery via restore_my_account_tabs

Description The Customize My Account for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.3. This is due to missing or incorrect nonce validation on the restoremyaccounttabs function. This makes it possible for unauthenticated...

WooCommerce Product Vendors < 2.2.3 - Missing Authorization

Description The WooCommerce Product Vendors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Icegram < 3.1.19 - Cross-Site Request Forgery via save_campaign_preview

Description The Icegram plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.18. This is due to missing or incorrect nonce validation on the savecampaignpreview function. This makes it possible for unauthenticated attackers to save campaign previe...

Spam protection, AntiSpam, FireWall by CleanTalk < 6.21 - Email Update via CSRF

Description The plugin does not have CSRF check in its apbctsettingsupdateaccountemail function, which could allow attackers to make logged in admins update email address via a CSRF attack...

Poll Maker < 4.8.1 - Missing Authorization

Description The Poll Maker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 4.8.0. This makes it possible for unauthenticated attackers to perform unauthorized actions...

Essential Addons for Elementor < 5.9.3 - Contributor+ Stored XSS

Description The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping...

WooCommerce Warranty Requests < 2.3.0 - Missing Authorization

Description The WooCommerce Warranty Requests plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to perform an unauthorized action...

BulkGate SMS Plugin for WooCommerce < 3.0.3 - Missing Authorization via Multiple AJAX Actions

Description The BulkGate SMS Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with subscriber-level...

GS Logo Slider < 3.5.2 - Cross-Site Request Forgery

Description The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on an unknown function. This mak...

iFrame < 4.9 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape the srcdoc parameter, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, however given that the malicious JS is limited to the scope of the iframe, there is no practical way to make users su...

Advanced Access Manager < 6.9.19 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

EnvíaloSimple <= 2.4 - Cross-Site Request Forgery

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

weForms < 1.6.19 - Missing Authorization via export_form_entries

Description The weForms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportformentries' function in versions up to, and including, 1.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

WooCommerce Ship to Multiple Addresses < 3.8.10 - Missing Authorization

Description The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to unauthorized action due to a missing capability check on a function in versions up to, and including, 3.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

weForms – Easy Drag & Drop Contact Form Builder For WordPress < 1.6.18 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 1.6.18 exclusive due to insufficient input sanitization and output escaping. This makes it possible for...

WooCommerce Canada Post Shipping < 2.8.4 - Unauthenticated Unauthorised Action

Description The plugin does not have authorisation check in an action, which could allow unauthenticated users to perform an unauthorised action...

Block IPs for Gravity Forms < 1.0.2 - Cross-Site Request Forgery

Description The Block IPs for Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an...

Rate my Post < 3.4.3 - IP Spoofing

Description The Rate my Post – WP Rating System plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.4.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for...

My Sticky Bar < 2.6.7 - CSV Export via CSRF to Sensitive Information Disclosure

Description The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated attackers to trigger the...

Molongui < 4.7.4 - Missing Authorization

Description The Molongui plugin for WordPress is vulnerable to unauthorized modification and access of data due to missing capability checks on the authorshipexportoptions and authorshipsaveoptions functions hooked via AJAX in versions up to, and including, 4.7.3. This makes it possible for...

ProjectHuddle Client Site < 1.0.35 - Missing Authorization via ph_child_ajax_notice_handler

Description The ProjectHuddle Client Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'phchildajaxnoticehandler' function in versions up to, and including, 1.0.34. This makes it possible for authenticated attackers, with...

Awesome Support < 6.1.6 - Missing Authorization via wpas_load_reply_history

Description The Awesome Support plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpasloadreplyhistory function in versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to load reply history...

Crowdsignal Dashboard < 3.1.0 - Rating Update via CSRF

Description The plugin does not have CSRF check in its updaterating function, which could allow attackers to make logged in users admins update ratings via a CSRF attack...

Schema & Structured Data for WP & AMP < 1.24 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

Spam protection, AntiSpam, FireWall by CleanTalk < 6.21 - Counters Reset/Creation via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as reset/create counters...

Anti Hacker < 4.35 - Cross-Site Request Forgery via antihacker_ajax_scan

Description The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 4.35 exclusive. This is due to missing or incorrect nonce validation on the 'antihackerajaxscan'...

HT Mega < 2.3.9 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape the regbio parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Slider by Soliloquy < 2.7.3 - Subscriber+ Slider Data Access

Description The Slider by Soliloquy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on a function in versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to view draft...

WooCommerce Product Vendors < 2.2.2 - Missing Authorization

Description The WooCommerce Product Vendors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to perform an unauthorized action...

Malware Scanner < 4.7.2 - IP Spoofing

Description The Malware Scanner plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 4.7.1 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated...

LearnPress < 4.2.5.8 - Unauthenticated Command Injection

Description The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to...

Add Any Extension to Pages < 1.5 - Cross-Site Request Forgery via aaetp_options_page

Description The Add Any Extension to Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'aaetpoptionspage' function. This makes it possible for unauthenticated attackers to...

Inline Image Upload for BBPress < 1.1.19 - Cross-Site Request Forgery via hm_bbpui_admin_page

Description The Inline Image Upload for BBPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the hmbbpuiadminpage function. This makes it possible for unauthenticated attackers to...

Advanced Access Manager < 6.9.16 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

Icegram < 3.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message

Description The Icegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the campaign message field in versions up to, and including, 3.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

Crowdsignal Dashboard < 3.1.0 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Awesome Support < 6.1.6 - Cross-Site Request Forgery

Description The Awesome Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1.5. This is due to missing or incorrect nonce validation on the wpasgetticketrepliesajax and ajaxdeleteattachment functions. This makes it possible for...

Stylish Price List < 7.0.18 - Missing Authorization

Description The Stylish Price List plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on multiple functions in versions up to, and including, 7.0.17. This makes it possible for authenticated attackers, with contributor-level access a...