ProfilePress < 4.13.2 Cross-Site Request Forgery via 'admin_notice'

Description The ProfilePress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on the 'adminnotice' function. This makes it possible for unauthenticated attackers to dismiss admin notices...

EWWW Image Optimizer < 7.2.1 - Sensitive Information Exposure

Description The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file...

kk Star Ratings < 5.4.6 - Missing Authorization

Description The kk Star Ratings plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on an unknown function in versions up to, and including, 5.4.5. This makes it possible for unauthenticated attackers to make use of this functionality. The exa...

Email Encoder < 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Email Encoder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eebmailto' shortcode in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WooCommerce Checkout Manager < 7.3.1 - Missing Authorization

Description The WooCommerce Checkout Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajaxorderattachmentupload and ajaxdeleteattachment functions hooked via AJAX in versions up to, and including, 7.3.0. This makes it possible for...

WP Maintenance < 6.1.4 - IP Restriction Bypass

Description The WP Maintenance plugin for WordPress is vulnerable to IP Address Restriction Bypass in versions up to, and including, 6.1.3. This can be used to bypass settings that may have blocked out an IP address from accessing a page on the site...

BackWPup < 4.0.2 - Authenticated (Administrator+) Directory Traversal

Description The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally,...

GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin deactivation

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpdisconnect function. This makes it possible for unauthenticated attackers to deactivate the SendW...

GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin installation

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpremoteinstallhandler function. This makes it possible for unauthenticated attackers to install an...

Ultimate Dashboard < 3.7.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Description The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

GiveWP < 2.33.2 - Missing Authorization via handleBeforeGateway

Description The GiveWP plugin for WordPress is vulnerable to unauthorized donation form access due to a missing check on the handleBeforeGateway function that would ensure that a donation form can be used and is not trashed in versions up to, and including, 2.33.1. There is no real security impac...

Brands for WooCommerce < 3.8.2.3 - Cross-Site Request Forgery

Description The Brands for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.2.2. This is due to missing nonce validation on the clearcacheajax, saveorder, and saveallorders functions hooked via AJAX actions. This makes it possible...

BP Profile Shortcodes Extra < 2.5.3 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Lava Directory Manager <= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Description The Lava Directory Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.34 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Flo Forms <= 1.0.41 - Missing Authorization via flo_send_test_email

Description The Flo Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flosendtestemail function in versions up to, and including, 1.0.41. This makes it possible for authenticated attackers, with subscriber-level access and above...

Leadster < 1.1.3 - Cross-Site Request Forgery via leadster_script_code_action

Description The Leadster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the leadsterscriptcodeaction function. This makes it possible for unauthenticated attackers to modify the...

Broken Link Checker | Finder < 2.5.0 - Missing Authorization via moblc_auth_save_settings

Description The Broken Link Checker | Finder plugin for WordPress is vulnerable to modification of data due to a missing capability check on the moblcauthsavesettings function in versions up to, and including, 2.4.2. This makes it possible for unauthenticated attackers to dismiss admin notificati...

LayerSlider < 7.7.10 - Cross-Site Request Forgery

Description The LayerSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.7.9. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a...

User Submitted Posts < 20230902 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 20230901 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Widget Responsive for Youtube < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Widget Responsive for Youtube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube' shortcode in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

ANAC XML Bandi di Gara <= 7.5 - Cross-Site Request Forgery via settings.php

Description The ANAC XML Bandi di Gara plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.5. This is due to missing or incorrect nonce validation on the settings.php file. This makes it possible for unauthenticated attackers to alter the plugin's...

Jetpack < 12.8-a.3 - Contributor+ Stored XSS via block attribute

Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Woo Custom and Sequential Order Number <= 2.6.0 - Cross-Site Request Forgery

Description The Woo Custom and Sequential Order Number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.0. This is due to missing or incorrect nonce validation on the wcsonsavesettings function. This makes it possible for unauthenticated...

Delete Duplicate Posts < 4.9 - Missing Authorization via AJAX Actions

Description The Delete Duplicate Posts plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on some of its AJAX actions in all versions up to 4.9 exclusive. This makes it possible for authenticated attackers, with subscriber access or higher, to...

Contact Form builder with drag & drop - Kali Forms < 2.3.28 - Missing Authorization via Contact Form

Description The Contact Form builder with drag & drop - Kali Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing check on the runformprocesschecks function in versions up to, and including, 2.3.27. This makes it possible for unauthenticated attackers to...

Pressference Exporter <= 1.0.3 - Authenticated (Administrator+) SQL Injection

Description The Pressference Exporter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

Q2W3 Post Order <= 1.2.8 - Reflected Cross-Site Scripting

Description The Q2W3 Post Order plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Anywhere Flash Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Anywhere Flash Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, t...

Ni WooCommerce Sales Report <= 3.7.3 - Missing Authorization via ajax_sales_order

Description The Ni WooCommerce Sales Report plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajaxsalesorder' function in versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with subscriber-level acces...

Simple File List < 6.1.10 - Unauthenticated Arbitrary File Deletion

Description The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including, 6.1.9. This is due to insufficient controls on files passed to a deletion function. This makes it possible for unauthenticated attackers to delete arbitrary files, whic...

Linker < 1.2.2 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Theater for WordPress < 0.18.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Youtube SpeedLoad <= 0.6.3 - Cross-Site Request Forgery

Description The Youtube SpeedLoad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.3. This is due to missing or incorrect nonce validation on the ytslsettingspage function. This makes it possible for unauthenticated attackers to modify the...

The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read

Description The plugin discloses the content of password protected posts to unauthenticated users via a crafted request PoC Append "?view=single-event" to a password protected post, then view the source of the page and find the post content disclosed in...

Super Testimonials < 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Welcome Email Editor < 5.0.7 - Subscriber+ Email Sending

Description The plugin does not have authorisation in its ajaxhandler function, allowing any authenticated users, such as subscriber to call it and send various emails...

Jquery accordion slideshow < 8.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

WP Category Post List Widget <= 2.0.3 - Cross-Site Request Forgery via gen_set_page

Description The WP Category Post List Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on the 'gensetpage' function. This makes it possible for unauthenticated attackers to modify...

Export Import Menus < 1.9.0 - Authenticated (Subscriber+) Arbitrary File Upload

Description The Export Import Menus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadMenusJson function in versions up to, and including, 1.8.0. This makes it possible for authenticated attackers, with subscriber-level permissions and...

WPCafe < 2.2.23 - Missing Authorization

Description The plugin is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on an unknown function, allowing unauthenticated attackers to make use of the unprotected functionality...

Contact Form builder with drag & drop - Kali Forms < 2.3.29 - Missing Authorization via get_log

Description The Contact Form builder with drag & drop - Kali Forms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the getlog function in versions up to, and including, 2.3.28. This makes it possible for authenticated attackers, with subscriber-level...

MainWP Dashboard < 4.5.1.3 - Authenticated(Administrator+) CSS Injection

Description The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated...

Themify Ultra < 7.3.6 - Missing Authorization

Description The themify-ultra theme for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on an unknown function in all versions up to, and including, 7.3.3. This makes it possible for authenticated attackers with subscriber access or...

Live Preview for Contact Form 7 <= 1.2.0 - Missing Authorization via update_option

Description The Live Preview for Contact Form 7 plugin for WordPress is vulnerable to unauthorized plugin option update due to a missing capability check on the updateoption function in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber acces...

Just Custom Fields <= 3.3.2 - Missing Authorization on AJAX Actions

Description The Just Custom Fields plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on various AJAX actions in versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with subscriber-level access and above,...

Convertful – Your Ultimate On-Site Conversion Tool < 2.6 - Missing Authorization via add_woo_coupon

Description The Convertful – Your Ultimate On-Site Conversion Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'addwoocoupon' REST function in versions up to, and including, 2.5. This makes it possible for unauthenticated...

DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints

Description The DoLogin Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple REST functions in versions up to, and including, 3.7.1. This makes it possible for unauthenticated attackers to send test SMS messages to arbitrar...

Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery

Description The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

Taggbox <= 3.1 - Missing Authorization

Description The Taggbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized...

Download CloudNet360 <= 3.2.0 - Reflected Cross-Site Scripting

Description The CloudNet360 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...