14652 matches found
Simple Staff List < 2.2.5 - Missing Authorization via ajax_flush_rewrite_rules and staff_member_export
Description The Simple Staff List plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the ajaxflushrewriterules and staffmemberexport functions in versions up to, and including, 2.2.4. This makes it possible for...
Poll Maker < 4.8.1 - Missing Authorization
Description The Poll Maker plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 4.8.0. This makes it possible for unauthenticated attackers to perform unauthorized actions...
Sirv < 7.1.3 - Missing Authorization via sirv_disconnect
Description The Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sirvdisconnect function hooked via AJAX in versions up to, and including, 7.1.2. This makes it possible for authenticated attackers, with subscriber-level access a...
Product Filter by WBW < 2.5.1 - Subscriber+ Table Data Access
Description The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getListForTbl function hooked via AJAX in versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with subscriber-leve...
Booster Elite for WooCommerce < 7.1.3 - Subscriber+ Content Injection
Description The Booster Elite for WooCommerce plugin for WordPress is vulnerable to content injection via an unknown parameter in all versions up to and including 7.1.2 due to insufficient capability checks. This makes it possible for authenticated attackers, with subscriber access and above, to...
Branda < 3.4.15 - IP Spoofing
Description The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.4.14 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval...
Export Media URLs < 2.0 - Cross-Site Request Forgery
Description The Export Media URLs plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via ...
All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action
Description The plugin does not have authorisation check in a function, which could allow unauthenticated users to perform an unauthorised action...
WooCommerce Product Vendors < 2.2.2 - Missing Authorization
Description The WooCommerce Product Vendors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to perform an unauthorized action...
WooCommerce Ship to Multiple Addresses < 3.8.10 - Missing Authorization
Description The WooCommerce Ship to Multiple Addresses plugin for WordPress is vulnerable to unauthorized action due to a missing capability check on a function in versions up to, and including, 3.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
WooCommerce Canada Post Shipping < 2.8.4 - Unauthenticated Unauthorised Action
Description The plugin does not have authorisation check in an action, which could allow unauthenticated users to perform an unauthorised action...
WooCommerce Warranty Requests < 2.3.0 - Missing Authorization
Description The WooCommerce Warranty Requests plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to perform an unauthorized action...
WooCommerce Warranty Requests < 2.3.0 - Missing Authorization
Description The WooCommerce Warranty Requests plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to perform an unauthorized action...
Slider by Soliloquy < 2.7.3 - Subscriber+ Slider Data Access
Description The Slider by Soliloquy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on a function in versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to view draft...
WooCommerce Shipping Per Product < 2.5.5 - Missing Authorization
Description The WooCommerce Shipping Per Product plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.5.4. This makes it possible for authenticated attackers, with customer-level access and above, to perform ...
BulkGate SMS Plugin for WooCommerce < 3.0.3 - Missing Authorization via Multiple AJAX Actions
Description The BulkGate SMS Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with subscriber-level...
Anti Hacker < 4.35 - Cross-Site Request Forgery via antihacker_ajax_scan
Description The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 4.35 exclusive. This is due to missing or incorrect nonce validation on the 'antihackerajaxscan'...
Apollo13 Framework Extensions < 1.9.2 - Cross-Site Request Forgery
Description The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.1. This is due to missing or incorrect nonce validation on the a13fenavaaddpost and a13fenavadeletepost functions. This makes it possible for...
RegistrationMagic Plugin < 5.2.4.6 - Authenticated(Administrator+) SQL Injection
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to and including 5.2.4.5 due to insufficient escaping on the user supplied parameter and lack o...
RegistrationMagic < 5.2.5.1 - IP Spoofing
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.5.0 due to use of user-supplied HTTP headers as a primary method for IP retrieval. This mak...
Stylish Price List < 7.0.18 - Missing Authorization
Description The Stylish Price List plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on multiple functions in versions up to, and including, 7.0.17. This makes it possible for authenticated attackers, with contributor-level access a...
ProfileGrid < 5.6.7 - Missing Authorization
Description The ProfileGrid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.6.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized action...
ProjectHuddle Client Site < 1.0.35 - Missing Authorization via ph_child_ajax_notice_handler
Description The ProjectHuddle Client Site plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'phchildajaxnoticehandler' function in versions up to, and including, 1.0.34. This makes it possible for authenticated attackers, with...
Customize My Account for WooCommerce < 1.8.4 - Cross-Site Request Forgery via restore_my_account_tabs
Description The Customize My Account for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.3. This is due to missing or incorrect nonce validation on the restoremyaccounttabs function. This makes it possible for unauthenticated...
Awesome Support < 6.1.6 - Missing Authorization via wpas_load_reply_history
Description The Awesome Support plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpasloadreplyhistory function in versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to load reply history...
Awesome Support < 6.1.6 - Cross-Site Request Forgery
Description The Awesome Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1.5. This is due to missing or incorrect nonce validation on the wpasgetticketrepliesajax and ajaxdeleteattachment functions. This makes it possible for...
HT Mega < 2.3.9 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape the regbio parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
iFrame < 4.9 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape the srcdoc parameter, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, however given that the malicious JS is limited to the scope of the iframe, there is no practical way to make users su...
Advanced Access Manager < 6.9.16 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
Advanced Access Manager < 6.9.19 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Advanced Access Manager < 6.9.19 - Open Redirect
Description The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect url supplied via params-redirect parameter. This makes it possible for authenticated attackers author and higher to redirect users to potentially malicious sites if they can successfully trick the...
Crowdsignal Dashboard < 3.1.0 - Rating Update via CSRF
Description The plugin does not have CSRF check in its updaterating function, which could allow attackers to make logged in users admins update ratings via a CSRF attack...
Crowdsignal Dashboard < 3.1.0 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Malware Scanner < 4.7.2 - IP Spoofing
Description The Malware Scanner plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 4.7.1 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated...
BuddyPress < 11.3.2 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its Members/Groups block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WooCommerce Stripe Payment Gateway < 7.6.2 - Unauthenticated Order Deletion via IDOR
Description The plugin doe snot properly check for ownership of completed/pending orders, allowing unauthenticated users to put such order in the trash and delete them...
WooCommerce Product Vendors < 2.2.3 - Missing Authorization
Description The WooCommerce Product Vendors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to perform an unauthorized action...
Strong Testimonials < 3.1.11 - Settings Update via CSRF
Description The plugin does not have CSRF checks in various functions, which could allow attackers to make logged in admins perform unwanted actions via CSRF attacks, such as update the plugin's settings...
Custom Twitter Feeds (Tweets Widget) < 2.2 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
LearnPress < 4.2.5.8 - Unauthenticated Command Injection
Description The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to...
Essential Addons for Elementor < 5.9.3 - Contributor+ Stored XSS
Description The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping...
My Sticky Bar < 2.6.7 - CSV Export via CSRF to Sensitive Information Disclosure
Description The My Sticky Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.6. This is due to missing or incorrect nonce validation in mystickymenu-contact-leads.php. This makes it possible for unauthenticated attackers to trigger the...
Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure
Description The plugin allows any unauthenticated user to read draft and private posts via a crafted request PoC https://example.com/?poststatus=draft https://example.com/?poststatus=private...
Quotes for WooCommerce < 2.0.2 - Missing Authorization
Description The Quotes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the qwcupdatestatus and qwcsendquote functions hooked via AJAX in all versions up to, and including, 2.0.2. This makes it possible for authenticated...
Floating Button < 6.0.1 - Cross-Site Request Forgery via process_bulk_action
Description The Floating Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.0. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to process bulk...
Verge3D < 4.5.3 - Subscriber+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'v3duploadappfile' function, allowing any authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code executi...
WC Marketplace < 4.0.24 - Missing Authorization via mvx_save_dashpages
Description The WC Marketplace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvxsavedashpages' function in versions up to, and including, 4.0.23. This makes it possible for unauthenticated attackers to update the plugin's setting...
Ultimate Addons for Beaver Builder < 1.35.15 - Contributor+ Privilege Escalation
Description The Ultimate Addons for Beaver Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.35.14. This makes it possible for authenticated attackers, with contributor access and above, to escalate their privileges to those of a higher lev...
Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaxaddattachment' function, allowing unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible...
Ultimate Addons for Beaver Builder < 1.35.14 - Contributor+ Arbitrary File Download
Description The Ultimate Addons for Beaver Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.35.13. This makes it possible for authenticated attackers, with Contributor access and above, to read the contents of a limited subset of arbitrary...