Archive
13 June 2022
Vulnerabilities first published on this day (UTC), newest first.
146 results · Feed
-
Unscored —
Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard…
-
Unscored —
WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting
-
Unscored —
Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to tric…
-
Unscored —
Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF
The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks (due to copyright violations or licensing rules).
-
Unscored —
WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS
The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of saniti…
-
Unscored —
Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due …
-
Unscored —
iQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
-
Unscored —
Peter’s Collaboration E-mails <= 2.2.0 - Arbitrary Settings Update via CSRF
The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.
-
Unscored —
RB Internal Links <= 2.0.16 - Stored Cross-Site Scripting via CSRF
The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due…
-
Unscored —
Genki Pre-Publish Reminder <= 1.4.1 - Stored XSS & RCE via CSRF
The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom c…
-
Unscored —CVE-2022-1756 Scanner template
Newsletter < 7.4.5 - Reflected Cross-Site Scripting
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to …
-
Unscored —CVE-2022-1724 Scanner template
Simple Membership < 4.1.1 - Reflected Cross-Site Scripting
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
-
Unscored —
Appointment Hour Booking < 1.3.56 - Admin+ Stored Cross-Site Scripting
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
-
Unscored —
Useful Banner Manager <= 1.6.1 - Modify banners via CSRF
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
-
Unscored —
Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRF
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRF
The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRF
The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Email Users <= 4.8.8 - Arbitrary Settings Update via CSRF
The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
-
Unscored —
MailerLite < 1.5.4 - Reflected Cross-Site Scripting
The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
-
Unscored —CVE-2022-1595 Scanner template
HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
-
Unscored —
HC Custom WP-Admin URL <= 1.4 - Arbitrary Settings Update via CSRF
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
-
Unscored —
WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting
The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
-
Unscored —
Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site Scripting
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
-
Unscored —
Log WP_Mail <= 0.1 - Email Logs Publicly Accessible
The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
-
Unscored —
Carousel CK <= 1.1.0 - Admin+ Stored Cross-Site Scripting
The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
-
Unscored —
Slideshow CK < 1.4.10 - Admin+ Stored Cross-Site Scripting
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
-
Unscored —
WP-CRM <= 1.2.1 - CSV Injection
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
-
Unscored —CVE-2022-0885 Scanner template
Member Hero <= 1.0.9 - Unauthenticated RCE
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
-
Unscored —CVE-2022-0863 EPSS 24%
WP SVG Icons <= 3.2.3 - Admin+ Remote Code Execution (RCE)
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
-
Unscored —CVE-2022-0827 Scanner template
Bestbooks <= 2.6.3 - Unauthenticated SQLi
The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
-
Unscored —
KiviCare < 2.3.9 - Unauthenticated SQLi
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
-
Medium 5.4
JupiterX Theme <= 2.0.6 and JupiterX Core <= 2.0.6 - Authenticated Arbitrary Plugin Deactivation and Settings Modification
Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the Jupi…
-
Unscored —
Like Button Rating < 2.6.45 - Arbitrary e-mail Sending
The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body
-
Unscored —
Advanced Admin Search < 1.1.6 - Reflected Cross-Site Scripting
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could de…
-
High 7.6
Insufficient content-type validation for uploaded files in open-forms
Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ..…
-
Medium 6.1
Zephyr Project Manager <= 3.2.40 - Reflected Cross-Site Scripting
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…
-
High 8.8
SQL Injection in francoisjacquet/rosariosis
SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
-
Unscored —
flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index …
-
High 7.8
Adobe Premiere Pro M4A file memory corruption vulnerability could lead to remote code execution
Adobe Premiere Pro version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue r…