14623 matches found
RegistrationMagic < 5.2.5.1 - Form Submission Limit Bypass
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to form submission limit bypass in all versions up to, and including, 5.2.5.0 due to insufficient protection logic. This makes it possible for unauthenticat...
ProfileGrid < 5.6.7 - Missing Authorization
Description The ProfileGrid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.6.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized action...
Ecwid Ecommerce Shopping Cart < 6.12.5 - Cross-Site Request Forgery
Description The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.4. This is due to missing nonce validation on several functions hooked via AJAX in the /includes/class-ecwid-admin-storefront-page.php. This...
EnvíaloSimple < 2.2 Unauthenticated PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed...
Strong Testimonials < 3.1.11 - Settings Update via CSRF
Description The plugin does not have CSRF checks in various functions, which could allow attackers to make logged in admins perform unwanted actions via CSRF attacks, such as update the plugin's settings...
Duplicator < 1.5.7.1 - Settings Removal via CSRF
Description The plugin does not have CSRF checks when remove some of its options, which could allow attackers to make logged in admins perform such action via a CSRF attack...
WooCommerce Warranty Requests < 2.3.0 - Missing Authorization
Description The WooCommerce Warranty Requests plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to perform an unauthorized action...
Simple Staff List < 2.2.5 - Missing Authorization via ajax_flush_rewrite_rules and staff_member_export
Description The Simple Staff List plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the ajaxflushrewriterules and staffmemberexport functions in versions up to, and including, 2.2.4. This makes it possible for...
AI Power: Complete AI Pack – Powered by GPT-4 < 1.8.3 - Missing Authorization to Sensitive Data Exposure
Description The AI Power: Complete AI Pack – Powered by GPT-4 plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicgexportlogscallback function in all versions up to, and including, 1.8.2. This makes it possible for unauthenticated attackers to...
All-in-one Floating Contact Form < 2.1.4 - Unauthenticated Unauthorised Action
Description The plugin does not have authorisation check in a function, which could allow unauthenticated users to perform an unauthorised action...
Advanced Access Manager < 6.9.19 - Open Redirect
Description The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect url supplied via params-redirect parameter. This makes it possible for authenticated attackers author and higher to redirect users to potentially malicious sites if they can successfully trick the...
Happy Addons for Elementor < 3.10.0 - Contributor+ SSRF
Description The plugin is vulnerable to Server-Side Request Forgery, allowing authenticated attackers, with contributor access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services...
BuddyPress < 11.3.2 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its Members/Groups block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
RegistrationMagic Plugin < 5.2.4.6 - Authenticated(Administrator+) SQL Injection
Description The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to and including 5.2.4.5 due to insufficient escaping on the user supplied parameter and lack o...
Sirv < 7.1.3 - Missing Authorization via sirv_disconnect
Description The Sirv plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sirvdisconnect function hooked via AJAX in versions up to, and including, 7.1.2. This makes it possible for authenticated attackers, with subscriber-level access a...
Dynamic Content for Elementor < 2.12.5 - Cross-Site Request Forgery
Description The Dynamic Content for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 2.12.5. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized...
FunnelKit Checkout < 3.11.0 - Subscriber+ Arbitrary Plugin Activation
Description The FunnelKit Checkout plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in all versions up to, and including, 3.10.3. This makes it possible for authenticated attackers, with subscriber access and above, t...
WP SMS < 6.5.1 - Contributor+ SQLi to Reflected XSS
Description The plugin is vulnerable to SQL Injection via the 'groupid' parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, ...
Integrate Google Drive < 1.3.4 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Business Directory Plugin < 6.3.10 - Contributor+ Arbitrary Listing Deletion
Description The plugin is vulnerable to unauthorized loss of data due to a missing capability check on the 'dispatch' function, allowing authenticated attackers, with contributor-level access and above, to delete listings...
MapPress Maps for WordPress < 2.88.14 - Contributor+ Stored XSS
Description The plugin does not sanitize and escape the Point of Interest Title and Description options in a map, allowing Contributor and above role to perform Stored Cross-Site Scripting attacks PoC As a contributor, add/edit a Map and search any location you want. Add XSS Payload on Location’s...
WP 2FA < 2.6.0 - Arbitrary Email Sending via CSRF
Description The plugin has a flawed CSRF check when sending emails to registered users, which could allow attackers to make logged in admins perform such action via a CSRF attack...
MC4WP < 4.9.10 - Unauthenticated Unpublished Form Preview
Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the 'listen' function, allowing unauthenticated attackers to preview unpublished forms...
3D Flipbook < 1.15.3 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape the Ready Function field, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
Product Catalog Enquiry for WooCommerce < 5.0.3 - Unauthenticated Inquiry Saving & Sensitive Information Disclosure
Description The plugin is vulnerable to unauthorized access and modification of data due to an improper capability check on the catalogrestroutesreactmodule REST endpoints, allowing unauthenticated attackers to view data from admin tabs and save enquiries...
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) < 2.7.14 - Settings Reset/Update via CSRF
Description The plugin does not have CSRF checks when resetting and updating its settings, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
WordPress Toolbar <= 2.2.6 - Open Redirect
Description The plugin redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. PoC...
Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajaxaddattachment' function, allowing unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible...
Wp-Adv-Quiz <= 1.0.4 - Admin+ Stored XSS in Quiz Overview
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Under "WP Adv Quiz - WP Adv...
EmbedPress < 3.9.6 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its embedoembedhtml shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Product Expiry for WooCommerce < 2.6 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
FooGallery Premium < 2.4.6 - Contributor+ Stored XSS
Description The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for contributors an...
Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape the biteshiperror and biteshipmessage parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open one of the URLs...
Easy Social Feed < 6.5.3 - Subscriber+ Settings Update
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's...
Store Locator WordPress < 1.4.15 - Admin+ Arbitrary File Deletion
Description The plugin is vulnerable to Directory Traversal, allowing authenticated attackers, with administrator access and above, to delete arbitrary files...
OMGF < 5.7.10 - Unauthenticated Directory Deletion & Stored XSS
Description The plugin is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the updatesettings function hooked via admininit. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used t...
PageLayer < 1.7.9 - Contributor+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via the 'pagelayerheadercode', 'pagelayerbodyopencode', and 'pagelayerfootercode' meta fields due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
ARForms < 1.5.9 - Unauthenticated Stored XSS
Description The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ arfhttpreferrerurl’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output...
Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG
Description The plugin does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC Upload an SVG with the following code: Access the uploaded file directly to trigger the XSS...
TJ Shortcodes <= 0.1.3 - Contributor+ Stored XSS via Shortcodes
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC junkie-button...
LearnPress < 4.2.5.8 - Unauthenticated SQLi
Description The plugin does not properly sanitise and escape the orderby parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
Complianz | GDPR/CCPA Cookie Consent < 6.5.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
JVM rich text icons < 1.2.7 - Subscriber+ Arbitrary File Deletion
Description The JVM Gutenberg Rich Text Icons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the 'file' parameter. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary files...
Site Notes <= 2.0.0 - Admin Note Deletion via CSRF
Description The plugin does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks PoC Have an administrator open the following HTML file:...
WP Mail Log Plugin < 1.1.3 - Contributor+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'sendemail' function. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code...
BERTHA AI Plugin < 1.11.10.8 - Unauthenticated Arbitrary File Upload
Description The BERTHA AI. Your AI co-pilot for WordPress and Chrome plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bthaiwatranslateaudiocallback' function in all versions up to and including 1.11.10.7. This makes it possible for...
Ultimate Addons for Beaver Builder < 1.35.14 - Contributor+ Arbitrary File Download
Description The Ultimate Addons for Beaver Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.35.13. This makes it possible for authenticated attackers, with Contributor access and above, to read the contents of a limited subset of arbitrary...
FunnelKit Checkout < 3.11.0 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
WP Plugin Lister <= 2.1.0 - Settings Update to Stored XSS via CSRF
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. PoC Make an admin open an HTML page containing the following code:...
WordPress Users <= 1.4 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC Create an HTML with the following and open it when logged in as an Editor or above:...