iframe < 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcode

Description The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the iframe shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission...

Folders < 2.9.3 - Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload

Description The Folders plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handlefoldersfileupload function in versions up to, and including, 2.9.2. This makes it possible for authenticated attackers, with author-level permissions or above, to...

PageLayer < 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The PageLayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ pagelayerheadercode’, 'pagelayerbodycode', and 'pagelayerfootercode' parameters in versions up to, and including, 1.7.6 due to insufficient input sanitization and output escaping. This makes it...

Feeds for YouTube < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Feeds for YouTube for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WooCommerce < 7.0.1 - Authenticated(Shop Manager+) Sensitive Information Exposure

Description The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.0. This can allow authenticated attackers with Shop Manager privileges or above to extract sensitive user metadata including session tokens...

Ditty < 3.1.25 - Missing Authorization via save_ditty_permissions_check

Description The Ditty plugin for WordPress is vulnerable to unauthorized editing of dittys due to a missing capability check on the savedittypermissionscheck function in versions up to, and including, 3.1.24. This makes it possible for unauthenticated attackers to edit dittys...

Simple Membership < 4.3.5 - Account Takeover via Password Reset

Description The Simple Membership plugin for WordPress is vulnerable to account takeover due to missing input validation on the processpasswordresetusinglink function in versions up to, and including, 4.3.4. This makes it possible for authenticated attackers to gain access to arbitrary accounts o...

EWWW Image Optimizer < 7.2.1 - Unauthenticated Sensitive Information Exposure via Debug Log

Description The EWWW Image Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.0 via the debuglog function. This makes it possible for unauthenticated attackers to extract sensitive debug data when debug logging is enabled...

Quiz And Survey Master < 8.1.16 - Cross-Site Request Forgery via 'display_results'

Description The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.1.15. This is due to missing or incorrect nonce validation on the 'displayresults' function. This makes it possible for unauthenticated attackers to submit...

Table of Contents Plus < 2309 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Table of Contents Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2302 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

ProfilePress < 4.13.3 - Information Disclosure via Debug Log

Description The ProfilePress plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.13.2 via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system error...

EmbedPress < 3.8.4 - Cross-Site Request Forgery

Description The EmbedPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.3. This is due to missing nonce validation on the clicked function. This makes it possible for unauthenticated attackers to trigger notice clicks via a forged request...

GiveWP < 2.33.4 - Cross-Site Request Forgery to Stripe Integration Deletion

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givestripedisconnectconnectstripeaccount function. This makes it possible for unauthenticated attackers to...

WooCommerce Subscription < 4.6.0 - Cross-Site Request Forgery

Description The WooCommerce Subscription for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and not including, 4.6.0. This is due to missing or incorrect nonce validation when suspending or canceling subscriptions. This makes it possible for unauthenticated attackers to...

Elements kit Elementor addons < 2.9.2 - Missing Authorization

Description The plugin is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the dismissajaxcall function, making it possible for authenticated attackers, with subscriber-level access and above, to dismiss notices intended for admins...

Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries

Description The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the...

Redirection for Contact Form 7 < 3.0.0 - Missing Authorization

Description The Redirection for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportcurrentfilteredview function hooked via admininit in versions up to, and including, 2.9.2. This makes it possible for unauthenticated...

ProfilePress < 4.13.2 - Limited Privilege Escalation via 'acceptable_defined_roles'

Description The ProfilePress plugin for WordPress is vulnerable to limited privilege escalation in versions up to, and including, 4.13.1 via the 'acceptabledefinedroles' function due to incomplete validation on a user controlled key. This can allow unauthenticated attackers to elevate their...

Super Socializer < 7.13.55 - Missing Authorization

Description The Super Socializer plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions such as heateorsstwitcountnotificationread, heateorssgdprnotificationread, heateorssfbredirectionnotificationread,...

wpDiscuz < 7.6.12 - Cross-Site Request Forgery

Description The wpDiscuz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.6.11. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to dismiss admin notices via a...

rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Sensitive Information Exposure

Description The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportsettings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with...

Essential Addons for Elementor < 5.8.9 - Authenticated (Contributor+) Privilege Escalation

Description The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.8.8 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for...

Quiz And Survey Master < 8.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 8.1.13 due to insufficient input sanitization and output escaping on user...

Unyson <= 2.7.28 - Missing Authorization

Description The Unyson plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions in versions up to, and including, 2.7.28. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Cloud Templates & Patterns collection < 1.2.3 - Sensitive Information Exposure via Log File

Description The Cloud Templates & Patterns collection plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.2 via a log file with a predictable name. This makes it possible for unauthenticated attackers to extract sensitive data...

Contact Form for Plugin by Fluent Forms < 5.0.9 - Insecure Direct Object Reference

Description The Contact Form for Plugin by Fluent Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.8 via the addIsRenderableFilter function due to missing validation on the publication status of a form. This makes it possible for...

WooCommerce Canada Post Shipping < 2.8.4 - Cross-Site Request Forgery

Description The WooCommerce Canada Post Shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.3. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke...

Theme My Login 2FA < 1.2 - Lack of Rate Limiting

Description The plugin does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits. PoC https://packetstormsecurity.com/2309-exploits/wpmylogin-bruteforce.txt...

Folders < 2.9.3 - Authenticated (Author+) Arbitrary File Upload

Description The Folders plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handlefoldersfileupload function in versions up to, and including, 2.9.2. This makes it possible for authors or higher to upload arbitrary files on the affected site's...

Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization in Reviews Exporter

Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the checkprogress and cancelexport functions in versions up to, and including, 5.36.0. This makes it possible for...

Simple 301 Redirects < 2.0.8 - Cross-Site Request Forgery via 'clicked'

Description The Simple 301 Redirects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the 'clicked' function. This makes it possible for unauthenticated attackers to enable or disable...

Phlox Portfolio < 2.3.2 - Unauthenticated Local File Inclusion

Description The Phlox Portfolio plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.1. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files...

Backup Migration < 1.3.0 - Cross-Site Request Forgery

Description The Backup Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9. This is due to missing nonce validation on the ajax function, or BMIAjax class. This makes it possible for unauthenticated attackers to control any of the...

WP Meta and Date Remover < 2.3.1 - Cross-Site Request Forgery via updateSettings

Description The WP Meta and Date Remover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.0. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to chang...

WP Users Media <= 4.2.3 - Cross-Site Request Forgery in wpusme_save_settings

Description The WP Users Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the wpusmesavesettings function. This makes it possible for unauthenticated attackers to modify plugin...

WPvivid Backup Plugin < 0.9.91 - Missing Authorization via 'start_staging' and 'get_staging_progress'

Description The WPvivid Backup Plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startstaging' and 'getstagingprogress' functions in versions up to, and including, 0.9.90. This makes it possible for authenticated...

10Web Map Builder for Google Maps < 1.0.74 - Cross-Site Request Forgery to Notice Dismissal

Description The 10Web Map Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.73. This is due to missing or incorrect nonce validation on the gmwdbpinstallnoticestatus function. This makes it possible for unauthenticated attackers to...

Big File Uploads < 2.1.2 - Cross-Site Request Forgery via actions

Description The Big File Uploads plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the actions function. This makes it possible for unauthenticated attackers to dismiss or delay admin...

Legal Pages < 1.3.8 - Missing Authorization on 'deleteLegalTemplate'

Description The Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteLegalTemplate function in versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with subscriber-level access and...

Essential Blocks for Gutenberg < 4.2.1 - Missing Authorization via AJAX actions

Description The Essential Blocks for Gutenberg plugin for WordPress is vulnerable to unauthorized access to AJAX actions due to a missing capability check on several functions in versions up to, and including, 4.2.0. This makes it possible for authenticated attackers, with subscriber-level access...

Elementor Website Builder < 3.16.5 - Missing Authorization to Arbitrary Attachment Read

Description The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getinlinesvg function in all versions up to, and including, 3.16.4. This makes it possible for authenticated attackers, with contributor-level acces...

Starter Templates <= 3.2.5 - Incorrect Authorization

Description The Starter Templates free and premium plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the sseimport function in versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with...

Simple Membership < 4.3.5 - Privilege escalation via Registration

Description The Simple Membership plugin for WordPress is vulnerable to privilege escalation due to missing input validation on the createswpmuser function in versions up to, and including, 4.3.4. This makes it possible for unauthenticated attackers to register users with arbitrary membership...

Qi Addons For Elementor < 1.6.4 - Authenticated (Contributor+) Local File Inclusion

Description The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowi...

Advanced Custom Fields: Extended < 0.8.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfeform' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Checkout Field Editor < 1.7.5 - Cross-Site Request Forgery to Checkout Fields Update

Description The Checkout Field Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.4. This is due to missing nonce validation when updating checkout fields. This makes it possible for unauthenticated attackers to update checkout fields via...

Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Stripe Gateway < 7.6.1 - Cross-Site Request Forgery

Description The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 7.6.1 exclusive. This is due to missing or incorrect nonce validation on the maybehandleredirect function. This makes it possible for unauthenticated attackers...

Conditional Fields for Contact Form 7 < 2.4.2 - Missing Authorization

Description The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on an unknown function in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with...

Metform Elementor Contact Form Builder < 3.3.2 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

Description The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mffirstname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information...