14678 matches found
DrawIt (draw.io) <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The DrawIt draw.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...
Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings
Description The Dragfy Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level...
UserPro < 5.1.2 - Cross-Site Request Forgery to Sensitive Information Exposure
Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'exportusers' function. This makes it possible for unauthenticated attackers to export the users to a csv...
UserPro < 5.1.2 - Sensitive Information Disclosure via Shortcode
Description The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible fo...
UserPro < 5.1.2 - Cross-Site Request Forgery to Privilege Escalation
Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation in the 'adminpage', 'userproverifyuser' and 'verifyUnverifyAllUsers' functions. This makes it possible for unauthenticated...
UserPro < 5.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata
Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'userprosaveuserdata' function. This makes it possible for unauthenticated attackers to update the user met...
UserPro < 5.1.1 - Cross-Site Request Forgery to PHP Object Injection
Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'importsettings' function. This makes it possible for unauthenticated attackers to exploit PHP Object...
CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization
Description The plugin is vulnerable to unauthorized access of data, modification of data, or loss of data due to a missing capability check on an unknown function, allowing unauthenticated attackers to make unauthorized use of the unprotected function...
LuckyWP Scripts Control <= 1.2.1 - Missing Authorization
Description The LuckyWP Scripts Control plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform...
FormCraft < 1.2.8 - Missing Authorization via formcraft_nag_update
Description The FormCraft plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the formcraftnagupdate AJAX nopriv function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to delay or disable upda...
SAML SP Single Sign On < 5.0.5 - Missing Authorization to notice dismissal
Description The SAML SP Single Sign On plugin for WordPress is vulnerable to unauthorized notice dismissal due to a missing capability check on the closewelcomemodal function in versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with subscriber-level access...
Simple Cloudflare Turnstile < 1.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode in versions up to, and including, 1.23.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
Simple Like Page Plugin < 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
UserPro < 5.1.2 - Cross-Site Request Forgery via multiple functions
Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete user meta an...
Interactive World Map <= 3.2.0 - Reflected Cross-Site Scripting
Description The Interactive World Map plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
RumbleTalk Live Group Chat < 6.2.0 - Missing Authorization via handleRequest
Description The RumbleTalk Live Group Chat plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handleRequest AJAX function in versions up to, and including, 6.1.9. This makes it possible for authenticat...
Advanced Local Pickup for WooCommerce < 1.6.0 - Authenticated (Administrator+) SQL Injection
Description The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
Description The WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a featured image 'alt' attribute in versions up to, and including, 8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
affiliate-toolkit – WordPress Affiliate Plugin < 3.4.0 - Open Redirect via atkpout.php
Description The affiliate-toolkit – WordPress Affiliate Plugin is vulnerable to Open Redirect in versions up to, and including, 3.3.9. This is due to insufficient validation on the redirect url supplied via the 'url' parameter in atkpout.php. This makes it possible for unauthenticated attackers t...
Post Meta Data Manager < 1.2.2 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion
Description The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the pmdmwpajaxdeletemeta, pmdmwpdeleteusermeta, and pmdmwpdeleteusermeta functions. This makes it possibl...
Post Status Notifier Lite < 1.11.1 - Reflected Cross-Site Scripting
Description The Post Status Notifier Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.11.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...
Pre-Publish Checklist < 1.1.2 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update
Description The Pre-Publish Checklist plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.1.1 via the ppcmetaboxajaxaddhandler and ppcmetaboxajaxdeletehandler functions due to missing validation on a user controlled key. This can allow...
iPages Flipbook < 1.5.0 - Authenticated (Administrator+) SQL Injection
Description The iPages Flipbook For WordPress plugin for WordPress is vulnerable to SQL Injection via the orderby parameter in all versions up to 1.5.0 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
WooCommerce < 7.9.0 - Sensitive Information Exposure
Description The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to...
iPanorama 360 – WordPress Virtual Tour Builder < 1.8.1 - Authenticated (Contributor+) SQL Injection via Shortcode
Description The iPanorama 360 – WordPress Virtual Tour Builder plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
WooCommerce Bookings < 2.0.4 - Cross-Site Request Forgery
Description The WooCommerce Bookings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function...
WooCommerce Product Carousel Slider <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Description The WooCommerce Product Carousel Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
MSHOP MY SITE <= 1.1.7 - Subscriber+ Settings Update
Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
Japanized For WooCommerce < 2.6.5 - Missing Authorization
Description The Japanized For WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification due to missing capability checks on several functions called via REST API function in versions up to, and including, 2.6.4. This makes it possible for unauthenticated attackers to...
BZScore – Live Score <= 1.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Description The BZScore – Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
Sharkdropship for AliExpress Dropship and Affiliate <= 2.2.3 - Missing Authorization
Description The Sharkdropship for AliExpress Dropship and Affiliate plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions called via nopriv AJAX actions in the /wooshark-aliexpress-importerinit.php file in versions...
AppPresser < 4.3.0 - Insecure Password Reset Mechanism
Description The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit...
WP Affiliate Disclosure < 1.2.7 - Cross-Site Request Forgery via check_capability
Description The WP Affiliate Disclosure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is due to incorrect nonce validation logic on the checkcapability function. This makes it possible for unauthenticated attackers to update...
ANAC XML Bandi di Gara <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Description The ANAC XML Bandi di Gara plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
Social Sharing Plugin - Social Warfare < 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'socialwarfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
Copy Or Move Comments <= 5.0.4 - Authenticated (Subscriber+) SQL Injection
Description The Copy Or Move Comments plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Copy Anything to Clipboard < 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...
WP EXtra < 6.3 - Missing Authorization to Export Settings
Description The WP EXtra plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to export plugin...
WP fade in text news < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
Superb slideshow gallery < 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
wp image slideshow < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
WP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Description The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress Backup & Migration < 1.4.2 - Missing Authorization to Settings and Schedule Modification
Description The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wtsavesettings and saveschedule functions in versions up to, and including, 1.4.1. This makes it possible for authenticated attackers, with...
WP Travel < 7.8.1 - Unauthenticated AJAX Calls
Description The plugin does not have authorisation checks in various AJAX actions, allowing unauthenticated users to call them and update the plugin settings for example...
WP User Frontend < 3.6.9 - Missing Authorization via AJAX actions
Description The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with...
WP Users Media <= 4.2.3 - Missing Authorization via wpusme_save_settings
Description The WP Users Media plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpusmesavesettings function in versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber-level permission...
wpMandrill <= 1.33 - Missing Authorization via getAjaxStats
Description The wpMandrill plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAjaxStats function in versions up to, and including, 1.33. This makes it possible for authenticated attackers, with subscriber-level access and above, to view...
TWB Woocommerce Reviews <= 1.7.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The TWB Woocommerce Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Olive One Click Demo Import <= 1.0.9 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file
Description The Olive One Click Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the oliveoneclickdemoimportsavefile function in versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...
Contact Form Generator <= 2.7.1 - Contributor+ SQLi
Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by Contributor roles and above...