14652 matches found
Currency Converter Calculator < 1.3.2 - Contributor+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitra...
Event post < 5.9.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
RegistrationMagic < 5.2.3.0 - Cross-Site Request Forgery
Description The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.2.2.6. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorize...
WP Event Manager < 3.1.42 - Editor+ Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks...
Automatic Youtube Video Posts Plugin <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Description The Automatic Youtube Video Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
WP Pocket URLs <= 1.0.2 - Reflected Cross-Site Scripting
Description The WP Pocket URLs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...
Social Share Buttons & Analytics Plugin < 4.4 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Advanced Database Cleaner < 3.1.3 - Authenticated (Administrator+) SQL Injection
Description The Advanced Database Cleaner plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
Piotnet Forms < 1.0.29 - Unauthenticated Arbitrary File Upload
Description The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetformsajaxformbuilder' function in versions up to, and including, 1.0.28. This makes it possible for unauthenticated attackers to upload arbitrary file...
SpeedyCache < 1.1.3 - Authenticated (Subscriber+) Server-Side Request Forgery
Description The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.2 via the speedycachecreatetestcache function. This makes it possible for authenticated attackers, subscriber-level access and...
Email Subscription Popup < 1.2.19 - Reflected Cross-Site Scripting
Description The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTPREFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
Post Duplicator < 2.32 - Missing Authorization via mtphr_duplicate_post
Description The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtphrduplicatepost function in versions up to, and including, 2.31. This makes it possible for authenticated attackers, with contributor-level access an...
WOOCS – WooCommerce Currency Switcher < 1.4.1.5 - Cross-Site Request Forgery via delete_profiles_data
Description The WOOCS – WooCommerce Currency Switcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.1.4. This is due to missing or incorrect nonce validation on the deleteprofilesdata function. This makes it possible for unauthenticated...
Quantity Plus Minus Button for WooCommerce by CodeAstrology < 1.2.0 Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WooCommerce Login Redirect <= 2.2.4 - Cross-Site Request Forgery
Description The WooCommerce Login Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.4. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this...
Business Directory Plugin < 6.3.11 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
SVGator – Add Animated SVG Easily < 1.2.5 - API Token Update/Deletion & Import Projects via CSRF
Description The plugin does not have CSRF checks when updating and deleting API token as well as importing projects, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
Elementor < 3.18.2 - Contributor+ Arbitrary File Upload to RCE via Template Import
Description The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server. PoC 1. Edit a post in Elementor. 2. Import a template...
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)
Description The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdphpinfo function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_db_specs)
Description The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sddbspecs function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_global_value)
Description The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdglobalvalue function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_option_value)
Description The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdoptionvalue function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...
System Dashboard < 2.8.8 - Missing Authorization to Information Disclosure (sd_constants)
Description The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sdconstants function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with...
Backup Migration Staging < 1.3.6 - Sensitive Data Exposure
Description The plugin stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups. PoC 1 Run a backup of the site 2 Notice the following files are all publicly available while...
Machic Core <= 1.2.6 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PayHere Payment Gateway < 2.2.12 - Unauthenticated Log Data Disclosure
Description The plugin automatically creates publicly-accessible log files containing sensitive information when transactions occur. PoC https://www.suppliment.lk/wp-content/uploads/payhere-logs/?SD https://www.medic.lk/wp-content/uploads/payhere-logs/?SD...
Manage Notification E-mails < 1.8.6 - Missing Authorization
Description The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the cardfamneexportsettings function. This makes it possible for unauthenticated attackers to obtain plugin settings...
Html5 Video Player < 2.5.19 - Subscriber+ Stored XSS
Description The plugin does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins...
JetEngine < 3.2.5 - Authenticated (Contributor+) Privilege Escalation
Description The JetEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.2.4. This is due to an unknown issue. This makes it possible for authenticated attackers, with contributor-level access and above, to gain elevated privileges...
MSync <= 1.0.0 - Authenticated (Administrator+) SQL Injection
Description The MSync plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...
WP 6.4-6.4.1 - POP Chain
Description WP 6.4 introduced a PHP gadget chain. While the issue is not directly exploitable, it could be used along with a PHP unserialization for example in a plugin or theme installed on the blog to achieve RCE...
Optimize Database after Deleting Revisions < 5.1 - Missing Authorization via 'odb_csv_download'
Description The Optimize Database after Deleting Revisions plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 5.0.110. This is due to a missing capability check on the 'odbcsvdownload' function which is hooked via admininit. This makes it possible for...
Antispam Bee < 2.11.4 - IP Address Spoofing via get_client_ip
Description The Antispam Bee plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.11.3 due to use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass country blocking...
Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization
Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX actions in versions up to, and including, 5.36.0. This makes it possible for authenticated attackers with subscriber level...
RegistrationMagic < 5.2.4.2 - Reflected Cross-Site Scripting via section_id
Description The RegistrationMagic plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘sectionid’ parameter in versions up to, and including, 5.2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
WP Retina 2x < 6.4.6 - Sensitive Information Exposure
Description The Perfect Images Manage Image Sizes, Thumbnails, Replace, Retina plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.5 due to guessable log file names. This makes it possible for unauthenticated attackers to extract sensitiv...
Ocean Extra < 2.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation
Description The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.2. This is due to missing or incorrect nonce validation on the ajaxrequiredpluginsactivate function. This makes it possible for unauthenticated attackers to...
Responsive Lightbox < 2.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via name
Description The Responsive Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...
Media File Renamer < 5.7.0 - Sensitive Information Exposure via Log File
Description The Media File Renamer: Rename Files Manual, Auto & AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.9 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data includi...
CF7 Google Sheets Connector < 5.0.6 - Unauthenticated Sensitive Information Exposure via Debug Log
Description The CF7 Google Sheets Connector plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.5 via the debug log functionality in google-sheet-connector.php. This makes it possible for unauthenticated attackers to extract sensitive dat...
JetFormBuilder < 3.1.5 - Unauthenticated Content Injection
Description The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to content injection in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to inject content onto the site...
Email Address Encoder 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Email Address Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eaeshortcode shortcode in version 1.0.22 due to insufficient input sanitization and output escaping on the 'link' user supplied attribute. This makes it possible for...
Coming soon and Maintenance mode <= 3.7.3 - IP Address Spoofing via get_real_ip
Description The Coming soon and Maintenance mode plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.7.3 due to the use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for attackers to bypass the coming soon...
Enhanced Text Widget <= 1.6.2 - Missing Authorization via etw_hide_admin_notification_callback
Description The Enhanced Text Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the etwhideadminnotificationcallback function in versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to hide adm...
Site Offline < 1.5.7 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
HUSKY – Products Filter for WooCommerce (formerly WOOF) < 1.3.4.3 - Unauthenticated SQL Injection via search terms
Description The HUSKY – Products Filter for WooCommerce formerly WOOF plugin for WordPress is vulnerable to generic SQL Injection via search terms in versions up to, and including, 1.3.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
NextScripts < 4.4.3 - Reflected Cross-Site Scripting via code
Description The NextScripts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘code’ parameter in versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...
Social Pug < 1.30.1 - Missing Authorization via multiple admin_init actions
Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions that run on admininit, allowing unauthenticated attackers to update the database...
Aruba HiSpeed Cache < 2.0.7 - Unauthenticated Log File Access
Description The plugin is vulnerable to Sensitive Information Exposure via the plugin's log file, allowing unauthenticated attackers to extract sensitive data including debug and trace information...
Nested Pages < 3.2.7 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...