Slider Revolution < 6.6.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Actueel Financieel Nieuws – Denk Internet Solutions <= 5.2.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Permalinks Customizer <= 2.8.2 - Reflected Cross-Site Scripting

Description The Permalinks Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Current Menu Item for Custom Post Types < 1.6 - Cross-Site Request Forgery

Description The Current Menu Item for Custom Post Types plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the cmicptview function. This makes it possible for unauthenticated attackers to...

Youzify < 1.2.3 - Insecure Direct Object Reference

Description The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.2 due to missing validation on a user controlled key. This makes it...

Easy Social Icons < 3.2.5 - Missing Authorization via cnss_save_ajax_order

Description The Easy Social Icons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cnsssaveajaxorder function in versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with subscriber-level access a...

wp image slideshow < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

Description The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

iPanorama 360 – WordPress Virtual Tour Builder < 1.8.1 - Authenticated (Contributor+) SQL Injection via Shortcode

Description The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Post Status Notifier Lite < 1.11.1 - Reflected Cross-Site Scripting

Description The Post Status Notifier Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.11.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

Shareaholic < 9.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CallRail Phone Call Tracking < 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrailform' shortcode in versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on the 'formid' user supplied attribute. This makes it...

Easy Call Now by ThikShare <= 1.1.0 - Cross-Site Request Forgery via settings_page

Description The Easy Call Now by ThikShare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the settingspage function. This makes it possible for unauthenticated attackers to modify th...

Leaflet Map < 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level and above...

Daily Prayer Time < 2023.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Description The Daily Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2023.10.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload

Description The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audiomerchantaddaudiofile function. This makes it possible for unauthenticated attacker...

Community by PeepSo < 6.2.0.0 - Cross-Site Request Forgery via delete

Description The Community by PeepSo plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1.6.0. This is due to missing or incorrect nonce validation on the delete function. This makes it possible for unauthenticated attackers to delete PeepSo posts...

Extra Product Options for WooCommerce <= 3.0.3 - Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings

Description The Extra Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Thrive Theme Builder < 3.24.0 - Missing Authorization

Description The theme is vulnerable to unauthorized use of functionality due to missing capability check in one of its functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to invoke this function intended for higher-privileged users. The exact...

Email posts to subscribers <= 6.2 - Missing Authorization to Sensitive Information Exposure

Description The Email posts to subscribers for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elppluginparserequest function in versions up to, and including 6.2. This makes it possible for unauthenticated attackers to invoke additional functions a...

CBX Map for Google Map & OpenStreetMap < 1.1.12 - Contributor+ Stored XSS via shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WP Directory Kit < 1.2.7 - Missing Authorization

Description The WP Directory Kit plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on one of its functions in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to make use of functionality intended...

Foyer <= 1.7.5 - Content Injection via Improper Access Control

Description The Foyer – Digital Signage for WordPress plugin for WordPress is vulnerable to unauthorized content injection due to an insufficient capability check on the editing functionality in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with...

10WebAnalytics <= 1.2.12 - Missing Authorization via gawd_wd_bp_install_notice_status

Description The 10WebAnalytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gawdwdbpinstallnoticestatus function in versions up to, and including, 1.2.12. This makes it possible for authenticated attackers, with subscriber-level...

Ultimate Addons for Contact Form 7 < 3.2.11 - Missing Authorization

Description The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the uacf7databaseexportcsv function hooked via init in versions up to, and including, 3.2.10. This makes it possible for unauthenticated...

UserPro < 5.1.2 - Insecure Password Reset Mechanism

Description The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function userproprocessform. The function uses...

Funnelforms Free < 3.4.2 - Cross-Site Request Forgery to Arbitrary Post Deletion

Description The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsfdeleteposts function. This makes it possible for unauthenticated attackers to delete arbitrary...

TK Google Fonts GDPR Compliant < 2.2.12 - Missing Authorization to Font Deletion

Description The TK Google Fonts GDPR Compliant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tkgooglefontsdeletefont function in all versions up to, and including, 2.2.11. This makes it possible for authenticated attackers, with...

WP User Frontend < 3.6.6 - Authenticated (Author+) Privilege Escalation

Description The WP User Frontend – Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Plugin plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.5. This is due to the plugin not providing...

Funnelforms Free < 3.4.2 - Missing Authorization to Test Email Sending

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2testmail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions a...

Etsy Shop < 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Podlove Web Player <= 5.7.3 - Missing Authorization

Description The Podlove Web Player plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 5.7.3. This makes it possible for unauthenticated attackers to perform an unauthorized action...

LifterLMS < 7.5.0 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion

Description The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybeserveexport function. This makes it possible for authenticated attackers, with administrator or LMS manager access and abov...

Live Gold Price & Silver Price Charts Widgets <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings

Description The Live Gold Price & Silver Price Charts Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Animated Counters < 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

WP Ultimate Exporter < 2.4.2 - Unauthenticated Information Disclosure

Description The WP Ultimate Exporter plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.4.1 due to insufficient protection on the directory in which exported files are stored in. This can allow unauthenticated attackers to extract sensitive da...

Funnelforms Free < 3.4.2 - Missing Authorization to Enable/Disable Dark Mode

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2triggerdarkmode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level...

EasyRotator for WordPress <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The EasyRotator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyrotator' shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Slick Popup: Contact Form 7 Popup Plugin < 1.7.15 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Slick Popup: Contact Form 7 Popup Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the main heading parameter in all versions up to 1.7.15 exclusive due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Login and Logout Redirect <= 2.0.2 - Open Redirect

Description The Login and Logout Redirect plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 2.0.2. This is due to insufficient validation on the redirect url supplied via the 'redirectto' parameter. This makes it possible for unauthenticated attackers to redire...

Brands for WooCommerce < 3.8.2.3 - Missing Authorization to Unauthenticated Order Manipulation and Information Retrieval

Description The Brands for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.8.2.2. This is due to missing capability checks on the clearcacheajax, saveorder, brgetproducts, brgetbrands, and saveallorders functions hooked via AJAX nopriv...

Poptin < 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wit...

ApplyOnline < 2.5.4 - Missing Authorization

Description The plugin is vulnerable to unauthorized access due to a missing or improper capability check on an unknown function, allowing authenticated attackers, with contributor-level access and above, to perform an unauthorized action...

Auto Tag Creator <= 1.0.2 - Missing Authorization via tag_save_settings_callback

Description The Auto Tag Creator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tagsavesettingscallback function in versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level...

Freesoul Deactivate Plugins < 2.1.4 - Cross-Site Request Forgery via eos_dp_pro_delete_transient

Description The Freesoul Deactivate Plugins – Plugin manager and cleanup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 2.1.4 exclusive. This is due to missing or incorrect nonce validation on the eosdpprodeletetransient function. This makes it possible for...

AtomChat <= 1.1.4 - Missing Authorization via credits REST API Endpoint

Description The AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'credits' REST API function in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to manipulate user credits when the...

Product Recommendation Quiz for eCommerce < 2.1.2 - Missing Authorization in prq_set_token

Description The Product Recommendation Quiz for eCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the prqsettoken function in versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to modify...

User Submitted Posts < 20230914 - Unauthenticated Arbitrary File Upload

Description The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uspattachimages function in versions up to, and including, 20230902. This makes it possible for unauthenticatedattackers to upload arbitrary files as long a...

Funnelforms Free < 3.4.2 - Missing Authorization to Arbitrary Post Deletion

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions a...

ANAC XML Bandi di Gara <= 7.5 - Authenticated (Editor+) Stored Cross-Site Scripting

Description The ANAC XML Bandi di Gara plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...

miniorange otp verification < 4.2.2 - Missing Authorization via dismiss_notice

Description The miniorange otp verification plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the dismissnotice function in versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with subscriber-level...