14678 matches found
Seers <= 8.0.6 - Missing Authorization via multiple AJAX actions
Description The Seers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax functions in versions up to, and including, 8.0.6. This makes it possible for unauthenticated attackers to modify the cookie policy and change the conse...
The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read
Description The plugin discloses the content of password protected posts to unauthenticated users via a crafted request PoC Append "?view=single-event" to a password protected post, then view the source of the page and find the post content disclosed in...
Image horizontal reel scroll slideshow < 13.3 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
Image Hover Effects <= 5.5 - Cross-Site Request Forgery
Description The Image Hover Effects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.5. This is due to missing or incorrect nonce validation on the savecaptionoptions function. This makes it possible for unauthenticated attackers to modify the...
Linker < 1.2.2 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Master Slider Pro <= 3.6.5 - Reflected Cross-Site Scripting
Description The Master Slider Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Responsive Column Widgets <= 1.2.7 - Open Redirect via responsive_column_widgets_link
Description The Responsive Column Widgets plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.2.7. This is due to insufficient validation on the redirect url supplied via the responsivecolumnwidgetslink parameter. This makes it possible for unauthenticated...
BMI Calculator Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The BMI Calculator Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, ...
Bold Timeline Lite < 1.2.0 - Missing Authorization to Admin Notice Dismissal
Description The Bold Timeline Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a logic error on the boldtimelinewpdocsthisscreen function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access an...
Welcome Email Editor < 5.0.7 - Subscriber+ Email Sending
Description The plugin does not have authorisation in its ajaxhandler function, allowing any authenticated users, such as subscriber to call it and send various emails...
Inactive Logout < 3.2.3 - Missing Authorization
Description The Inactive Logout plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the inaresetadvsettings function in versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber-level access a...
Who Hit The Page – Hit Counter <= 1.4.14.3 - Authenticated (Administrator+) SQL Injection
Description The Who Hit The Page – Hit Counter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
Tilda Publishing <= 0.3.21 - Missing Authorization
Description The Tilda Publishing plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on several functions hooked via AJAX actions such as 'ajaxexportfile,' 'ajaxsync,' 'ajaxgetkeys,' 'ajaxswitcherstatus,' and more in versions ...
Embed Privacy < 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Embed Privacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedprivacyoptout ' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...
Information Reel < 10.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
Poll Maker < 4.7.2 - Missing Authorization
Description The Poll Maker plugin for WordPress is vulnerable to unauthorized access of data or functionality due to a missing capability check on one of its functions in all versions up to, and including, 4.7.1. This makes it possible for unauthenticated attackers to make use of this function...
Drop Shadow Boxes < 1.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dropshadowbox' shortcode in versions up to, and including, 1.7.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
UserHeat Plugin <= 1.1.6 - Cross-Site Request Forgery
Description The UserHeat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on the settingPage function. This makes it possible for unauthenticated attackers to modify the plugin's...
Flo Forms <= 1.0.41 - Missing Authorization via flo_send_test_email
Description The Flo Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flosendtestemail function in versions up to, and including, 1.0.41. This makes it possible for authenticated attackers, with subscriber-level access and above...
Integration for Contact Form 7 and Constant Contact < 1.1.5 - Open Redirect
Description The Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.1.4. This is due to insufficient validation a redirect url. This makes it possible for unauthenticated...
Live Preview for Contact Form 7 <= 1.2.0 - Missing Authorization via update_option
Description The Live Preview for Contact Form 7 plugin for WordPress is vulnerable to unauthorized plugin option update due to a missing capability check on the updateoption function in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber acces...
Charitable < 1.7.0.14 - Authenticated(Contributor+) Stored Cross-Site Scripting
Description The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.7.0.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
Woo Custom and Sequential Order Number <= 2.6.0 - Cross-Site Request Forgery
Description The Woo Custom and Sequential Order Number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.0. This is due to missing or incorrect nonce validation on the wcsonsavesettings function. This makes it possible for unauthenticated...
Simple File List < 6.1.10 - Unauthenticated Arbitrary File Deletion
Description The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including, 6.1.9. This is due to insufficient controls on files passed to a deletion function. This makes it possible for unauthenticated attackers to delete arbitrary files, whic...
Modal Window < 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
Pressference Exporter <= 1.0.3 - Authenticated (Administrator+) SQL Injection
Description The Pressference Exporter plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Motors – Car Dealer & Classified Ads <= 1.4.6 - Server Side Request Forgery
Description The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...
Click To Tweet <= 2.0.14 - Missing Authorization
Description The Click To Tweet plugin for WordPress is vulnerable to unauthorized access, loss or modification of data due to a missing capability check on one of its functions in versions up to, and including, 2.0.14. This makes it possible for authenticated attackers, with subscriber-level acce...
MP3 Audio Player for Music, Radio & Podcast by Sonaar < 4.10.1 - Missing Authorization to Template Import
Description The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importsrmp3template function in all versions up to, and including, 4.10. This makes it possible for authenticated...
WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update
Description The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refreshordereandata AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level acces...
Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update
Description The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage function. This makes it possible for unauthenticated attackers to update the...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization via export_settings
Description The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the exportsettings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with...
Export Import Menus < 1.9.0 - Authenticated (Subscriber+) Arbitrary File Upload
Description The Export Import Menus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadMenusJson function in versions up to, and including, 1.8.0. This makes it possible for authenticated attackers, with subscriber-level permissions and...
Smart App Banner <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Smart App Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...
Wp anything slider < 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
WP Category Post List Widget <= 2.0.3 - Cross-Site Request Forgery via gen_set_page
Description The WP Category Post List Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on the 'gensetpage' function. This makes it possible for unauthenticated attackers to modify...
WP Custom Admin Interface < 7.32 - Missing Authorization via wpcai_pro_notice_disable
Description The WP Custom Admin Interface plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the wpcaipronoticedisable function in versions up to, and including, 7.31. This makes it possible for authenticated attackers, with...
WP Crowdfunding < 2.1.5 - Missing Authorization via settings_reset
Description The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized settings reset due to a missing capability check on the settingsreset function in versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation
Description The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.9.25 due to missing validation on a user-controlled key. This can allow unauthenticated attackers to manipulate orders that do not belong to them...
Surfer < 1.3.3.379 - Missing Authorization
Description The Surfer plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions, such as removepostdraftconnection, checkdraftstatus, getlocations, getajaxsurferconnecturl, disconnectsurferfromwp, and...
IMPress Listings <= 2.6.2 - Missing Authorization
Description The IMPress Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to perform unauthorized actions...
Wp photo text slider 50 < 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
Thumbnail carousel slider < 1.0.1 - Cross-Site Request Forgery to Mass Slider Deletion
Description The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request...
Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
Remove Add to Cart WooCommerce <= 1.4.4 - Cross-Site Request Forgery to Settings Modification
Description The Remove Add to Cart WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the ratcwprolebasesavedata function. This makes it possible for unauthenticated attacker...
Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access
Description The plugin does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected PoC Run the belo...
Website Optimization – Plerdy < 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Comments Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...
WP ERP < 1.12.7 - Missing Authorization via admin notice dismissal
Description The WP ERP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple admin notice dismissal function in versions up to, and including, 1.12.6. This makes it possible for authenticated attackers, with subscriber-level access a...