14608 matches found
WP Discord Invite < 2.5.1 - Reflected Cross-Site Scripting via webhook
Description The WP Discord Invite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘webhook’ parameter in versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
WPSchoolPress < 2.2.5 - Cross-Site Request Forgery
Description The WPSchoolPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.4. This is due to missing nonce validation on several functions called via AJAX actions in the /lib/wpsp-ajaxworks.php file. This makes it possible for...
Contact Form Email < 1.3.42 - Captcha Bypass
Description The Contact Form Email plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.3.41. This makes it possible for unauthenticated attackers to bypass the Captcha Verification...
Contact Form to Any API < 1.1.7 - Subscriber+ API Entry Record Deletion
Description The plugin does not have authorisation check when deleting CF7 API entry records, which could allow any authenticated users, such as subscriber to delete them...
Mollie Payments for WooCommerce < 7.3.12 - Authenticated (Shop Manager+) Arbitrary File Upload
Description The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in one of its functions in all versions up to, and including, 7.3.11. This makes it possible for authenticated attackers, with Shop Manager access to...
Booster for WooCommerce < 7.1.2 - Authenticated (Subscriber+) Information Disclosure via Shortcode
Description The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcjgetoption' shortcode in versions up to, and including, 7.1.1 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers,...
PayTR Taksit Tablosu <= 1.3.1 - Missing Authorization
Description The PayTR Taksit Tablosu plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on one of its functions in versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to invoke this function with an unclear...
Form Maker < 1.15.21 - Captcha Bypass
Description The Form Maker plugin for WordPress is vulnerable to Captcha Bypass in versions up to, and including, 1.15.20 due to insufficient input verification. This makes it possible for unauthenticated attackers to automate form submissions...
Export WP Page to Static HTML/CSS < 2.2.0 - Missing Authorization via Multiple AJAX Actions
Description The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers,...
Fast Custom Social Share by CodeBard <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Fast Custom Social Share by CodeBard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
ChatBot < 4.7.9 - Authenticated (Administrator+) SQL Injection
Description The AI ChatBot plugin for WordPress is vulnerable to SQL Injection via the orderby parameter in all versions up to, and including, 4.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload
Description The CataBlog plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with editor access and above to upload arbitrary files on the affected site's server which may make remote code...
WP Forms Puzzle Captcha <= 4.1 - Captcha Bypass
Description The WP Forms Puzzle Captcha plugin for WordPress is vulnerable to Captcha Bypass in versions up to, and including, 2.8. This makes it possible for unauthenticated attackers to bypass the Captcha Verification...
MyBookTable Bookstore < 3.3.5 - API Key Update via CSRF
Description The plugin does not have CSRF check when updating its API key via the mbtapikeyrefreshajax function, which could allow attackers to make logged in admins update it via a CSRF attack...
BookingPress < 1.0.77 - Authenticated (Administrator+) Arbitrary File Upload
Description The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpressprocessupload' function in versions up to, and including, 1.0.76. This makes it possible for authenticated attackers with administrator-level...
League Table < 1.14 - Tables Cloning/Update/Deletion via CSRF
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the view/tables.php file. This makes it possible for unauthenticated attackers to clone, edit, update, and delete tables via a forged request granted they can trick a site...
Porto Theme - Functionality < 2.12.1 - Missing Authorization
Description The Porto Theme - Functionality plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on an unknown function in versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to perform an unauthorized...
Decorator - WooCommerce Email Customizer < 1.2.8 - Cross-Site Request Forgery
Description The Decorator – WooCommerce Email Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing nonce validation on several functions such as ajaxreset, wtdecoratorbuttontext, wtdecoratorsetasdefault, an...
Seraphinite Post .DOCX Source < 2.16.7 - Settings Update/Reset/Import via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin perform such actions CSRF attacks...
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor. PoC Run the following within a block editor page. Notice that the request is delayed by the SLEEP call in...
WP Child Theme Generator <= 1.0.9 - Admin+ Arbitrary File Upload
Description The plugin is vulnerable to arbitrary file uploads, allowing administrators to upload arbitrary files on the affected site's server which may make remote code execution possible...
Simple Testimonials Showcase <= 1.1.5 - Cross-Site Request Forgery
Description The Simple Testimonials Showcase plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on the stssavesettings function. This makes it possible for unauthenticated attackers to upda...
Bulk Comment Remove <= 2 - Cross-Site Request Forgery via brc_admin()
Description The Bulk Comment Remove plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. This is due to missing or incorrect nonce validation on the brcadmin function. This makes it possible for unauthenticated attackers to delete comments in bulk...
WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCE
Description The plugin does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution. PoC Run the following JS code in any page on the server, setting the id variable to a valid ID of a log entry on the...
WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints
Description The plugin does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users. PoC The following actions may be taken by a Contributor user: --- /wmllogs - Information leak Execute the...
Porto Theme - Functionality < 2.12.1 - Unauthenticated SQL Injection
Description The Porto Theme - Functionality plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.11.1 due to insufficient escaping on a user supplied parameter and lack of sufficient preparation on an existing SQL query. This makes it possible for unauthenticate...
TextMe SMS < 1.9.1 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Broken Link Checker for YouTube <= 1.3 - Cross-Site Request Forgery via plugin_settings_page()
Description The Broken Link Checker for YouTube plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the pluginsettingspage function. This makes it possible for unauthenticated attackers to...
WCMultiShipping < 2.3.6 - Missing Authorization to Log Export
Description The WCMultiShipping plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wmsexportlog function in all versions up to, and including, 2.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above,...
Accept Stripe Payments < 2.0.80 - Insecure Direct Object Reference
Description The Stripe Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handlecreatepi function in versions up to, and including, 2.0.79. This makes it possible for unauthenticated attackers to purchase products in another...
Awesome Support < 6.1.5 - Missing Authorization via wpas_edit_reply_ajax()
Description The Awesome Support plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpaseditreplyajax function in versions up to, and including, 6.1.4. This makes it possible for authenticated attackers, with subscriber-level access and...
Availability Calendar <= 1.2.6 - Cross-Site Request Forgery via add_availability_calendar_create_admin_page()
Description The Availability Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the addavailabilitycalendarcreateadminpage function. This makes it possible for unauthenticated...
WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint
Description The plugin does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files. PoC Run the following within any page on the site, ensuring that the id parameter is set to a...
BSK Forms Blacklist < 3.7 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. In the plugin settings ex:...
Debug Log Manager < 2.2.2 - Subscriber+ Debug Log Clearing
Description The plugin does not have authorisation when clearing debug logs, allowing any authenticated users, such as subscriber to perform such action...
WP Crowdfunding < 2.1.8 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Add a campaign and for the...
Consensu.io <= 1.0.2 - Missing Authorization via update_config_db()
Description The Consensu.io plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateconfigdb function in versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to modify the plugin's setting...
Taxonomy filter < 2.2.10 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor. PoC Run the following within any page on the site. Notice that the request is delayed by the SLEEP call i...
Frontier Post <= 6.1 - Cross-Site Request Forgery
Description The Frontier Post plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action...
Awesome Support < 6.1.5 - Cross-Site Request Forgery via wpas_edit_reply_ajax()
Description The Awesome Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1.4. This is due to missing or incorrect nonce validation on the wpaseditreplyajax function. This makes it possible for unauthenticated attackers to edit replies vi...
Preloader for Website < 1.3 - Missing Authorization via plwao_register_settings()
Description The Preloader for Website plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the plwaoregistersettings function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to reset the plugin's...
Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export
Description The plugin does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens. PoC curl --url 'http://vulnerable-site.tld/wp-admin/admin-post.php?luv-action=export'...
so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion
Description The plugin does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites. PoC 1. Create a multi-site wordpress setup, i.e. using...
Chatbot for WordPress < 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and abov...
Video PopUp < 1.1.4 - Contributor+ Stored XSS via Shortcode
Description The plugin does not validate and escape some of its videopopup shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
WCFM Marketplace < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfmstores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
WP Meta and Date Remover < 2.3.1 - Cross-Site Request Forgery via updateSettings
Description The WP Meta and Date Remover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.0. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to chang...
WP Users Media <= 4.2.3 - Cross-Site Request Forgery in wpusme_save_settings
Description The WP Users Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the wpusmesavesettings function. This makes it possible for unauthenticated attackers to modify plugin...
Simple 301 Redirects by BetterLinks < 2.0.8 - Missing Authorization via clicked
Description The Simple 301 Redirects by BetterLinks plugin for WordPress is vulnerable to unauthorized enabling of plugin usage tracking due to a missing capability check on the clicked function in all versions up to, and including, 2.0.7. This makes it possible for subscribers to enable plugin...