14633 matches found
WooCommerce Stripe Payment Gateway < 7.6.2 - Unauthenticated Order Deletion via IDOR
Description The plugin doe snot properly check for ownership of completed/pending orders, allowing unauthenticated users to put such order in the trash and delete them...
Product Filter by WBW < 2.5.1 - Subscriber+ Table Data Access
Description The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getListForTbl function hooked via AJAX in versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with subscriber-leve...
LA-Studio Element Kit for Elementor < 1.1.6 - Missing Authorization
Description The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a REST-API endpoint in versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the plugin's...
Happy Addons for Elementor < 3.10.0 - Contributor+ SSRF
Description The plugin is vulnerable to Server-Side Request Forgery, allowing authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services...
Booster Elite for WooCommerce < 7.1.3 - Subscriber+ Content Injection
Description The Booster Elite for WooCommerce plugin for WordPress is vulnerable to content injection via an unknown parameter in all versions up to and including 7.1.2 due to insufficient capability checks. This makes it possible for authenticated attackers, with subscriber access and above, to...
RegistrationMagic < 5.2.5.1 - Form Submission Limit Bypass
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to form submission limit bypass in all versions up to, and including, 5.2.5.0 due to insufficient protection logic. This makes it possible for unauthenticat...
Ecwid Ecommerce Shopping Cart < 6.12.5 - Cross-Site Request Forgery
Description The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.4. This is due to missing nonce validation on several functions hooked via AJAX in the /includes/class-ecwid-admin-storefront-page.php. This...
ProfileGrid < 5.6.7 - Missing Authorization
Description The ProfileGrid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.6.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized action...
BuddyPress < 11.3.2 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its Members/Groups block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Dynamic Content for Elementor < 2.12.5 - Cross-Site Request Forgery
Description The Dynamic Content for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 2.12.5. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized...
Apollo13 Framework Extensions < 1.9.2 - Cross-Site Request Forgery
Description The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.1. This is due to missing or incorrect nonce validation on the a13fenavaaddpost and a13fenavadeletepost functions. This makes it possible for...
WooCommerce Warranty Requests < 2.3.0 - Missing Authorization
Description The WooCommerce Warranty Requests plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to perform an unauthorized action...
GPT3 AI Content Writer < 1.8.13 - Cross-Site Request Forgery
Description The GPT3 AI Content Writer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.12. This is due to missing or incorrect nonce validation on the wpaicgexportlogscallback function. This makes it possible for unauthenticated attackers to...
Sirv < 7.1.3 - Missing Authorization via sirv_disconnect
Description The Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sirvdisconnect function hooked via AJAX in versions up to, and including, 7.1.2. This makes it possible for authenticated attackers, with subscriber-level access a...
Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure
Description The plugin allows any unauthenticated user to read draft and private posts via a crafted request PoC https://example.com/?poststatus=draft https://example.com/?poststatus=private...
Duplicator < 1.5.7.1 - Settings Removal via CSRF
Description The plugin does not have CSRF checks when remove some of its options, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Custom Twitter Feeds (Tweets Widget) < 2.2 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
Advanced Access Manager < 6.9.19 - Open Redirect
Description The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect url supplied via params-redirect parameter. This makes it possible for authenticated attackers author and higher to redirect users to potentially malicious sites if they can successfully trick the...
Simple Staff List < 2.2.5 - Missing Authorization via ajax_flush_rewrite_rules and staff_member_export
Description The Simple Staff List plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the ajaxflushrewriterules and staffmemberexport functions in versions up to, and including, 2.2.4. This makes it possible for...
All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action
Description The plugin does not have authorisation check in a function, which could allow unauthenticated users to perform an unauthorised action...
Strong Testimonials < 3.1.11 - Settings Update via CSRF
Description The plugin does not have CSRF checks in various functions, which could allow attackers to make logged in admins perform unwanted actions via CSRF attacks, such as update the plugin's settings...
WooCommerce Shipping Per Product < 2.5.5 - Missing Authorization
Description The WooCommerce Shipping Per Product plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.5.4. This makes it possible for authenticated attackers, with customer-level access and above, to perform ...
RegistrationMagic Plugin < 5.2.4.6 - Authenticated(Administrator+) SQL Injection
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to and including 5.2.4.5 due to insufficient escaping on the user supplied parameter and lack o...
AI Power: Complete AI Pack – Powered by GPT-4 < 1.8.3 - Missing Authorization to Sensitive Data Exposure
Description The AI Power: Complete AI Pack – Powered by GPT-4 plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicgexportlogscallback function in all versions up to, and including, 1.8.2. This makes it possible for unauthenticated attackers to...
RegistrationMagic < 5.2.5.1 - IP Spoofing
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.5.0 due to use of user-supplied HTTP headers as a primary method for IP retrieval. This mak...
EnvíaloSimple < 2.2 Unauthenticated PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed...
Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaxaddattachment' function, allowing unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible...
MC4WP < 4.9.10 - Unauthenticated Unpublished Form Preview
Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the 'listen' function, allowing unauthenticated attackers to preview unpublished forms...
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) < 2.7.14 - Settings Reset/Update via CSRF
Description The plugin does not have CSRF checks when resetting and updating its settings, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
Store Locator WordPress < 1.4.15 - Admin+ Arbitrary File Deletion
Description The plugin is vulnerable to Directory Traversal, allowing authenticated attackers, with administrator access and above, to delete arbitrary files...
Integrate Google Drive < 1.3.4 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Inquiry Saving & Sensitive Information Disclosure
Description The plugin is vulnerable to unauthorized access and modification of data due to an improper capability check on the catalogrestroutesreactmodule REST endpoints, allowing unauthenticated attackers to view data from admin tabs and save enquiries...
WordPress Toolbar <= 2.2.6 - Open Redirect
Description The plugin redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. PoC...
Wp-Adv-Quiz <= 1.0.4 - Admin+ Stored XSS in Quiz Overview
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Under "WP Adv Quiz - WP Adv...
FunnelKit Checkout < 3.11.0 - Subscriber+ Arbitrary Plugin Activation
Description The FunnelKit Checkout plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in all versions up to, and including, 3.10.3. This makes it possible for authenticated attackers, with subscriber access and above, t...
WP 2FA < 2.6.0 - Arbitrary Email Sending via CSRF
Description The plugin has a flawed CSRF check when sending emails to registered users, which could allow attackers to make logged in admins perform such action via a CSRF attack...
Easy Social Feed < 6.5.3 - Subscriber+ Settings Update
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's...
EmbedPress < 3.9.6 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its embedoembedhtml shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WP SMS < 6.5.1 - Contributor+ SQLi to Reflected XSS
Description The plugin is vulnerable to SQL Injection via the 'groupid' parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, ...
Product Expiry for WooCommerce < 2.6 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
MapPress Maps for WordPress < 2.88.14 - Contributor+ Stored XSS
Description The plugin does not sanitize and escape the Point of Interest Title and Description options in a map, allowing Contributor and above role to perform Stored Cross-Site Scripting attacks PoC As a contributor, add/edit a Map and search any location you want. Add XSS Payload on Location’s...
FooGallery Premium < 2.4.6 - Contributor+ Stored XSS
Description The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors an...
Business Directory Plugin < 6.3.10 - Contributor+ Arbitrary Listing Deletion
Description The plugin is vulnerable to unauthorized loss of data due to a missing capability check on the 'dispatch' function, allowing authenticated attackers, with contributor-level access and above, to delete listings...
3D Flipbook < 1.15.3 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape the Ready Function field, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape the biteshiperror and biteshipmessage parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open one of the URLs...
TJ Shortcodes <= 0.1.3 - Contributor+ Stored XSS via Shortcodes
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC junkie-button...
FunnelKit Checkout < 3.11.0 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
ARForms < 1.5.9 - Unauthenticated Stored XSS
Description The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arfhttpreferrerurl’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output...
JVM rich text icons < 1.2.7 - Subscriber+ Arbitrary File Deletion
Description The JVM Gutenberg Rich Text Icons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the 'file' parameter. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary files...
Ultimate Addons for Beaver Builder < 1.35.14 - Contributor+ Arbitrary File Download
Description The Ultimate Addons for Beaver Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.35.13. This makes it possible for authenticated attackers, with Contributor access and above, to read the contents of a limited subset of arbitrary...