Archive
27 June 2022
Vulnerabilities first published on this day (UTC), newest first.
129 results · Feed
-
Unscored —
Nested Pages < 3.1.21 - Admin+ Stored Cross Site Scripting
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed
-
Unscored —
WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF…
-
Unscored —
NextCellent Gallery <= 1.9.35 - Admin+ Stored XSS
The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallo…
-
Unscored —
Easy SVG Support < 3.3.0 - Author+ Stored Cross Site Scripting via SVG
The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
-
Unscored —
MyCSS <= 1.1 - Arbitrary Settings Update via CSRF
The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File Deletion
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink()…
-
Unscored —CVE-2022-1916 Scanner template
Active Products Tables for WooCommerce < 1.0.5 - Reflected Cross-Site-Scripting
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticate…
-
Unscored —
Clean-Contact <= 1.6 - Arbitrary Settings Update to Stored XSS via CSRF
The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escapin…
-
Unscored —
Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of saniti…
-
Unscored —CVE-2022-1904 Scanner template
Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflec…
-
Unscored —
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users b…
-
Unscored —
Cimy Header Image Rotator <= 6.1.1 - Arbitrary Settings Update via CSRF
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Rotating Posts <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF
The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
Tiny Contact Form <= 0.7 - Arbitrary Settings Update via CSRF
The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
WP Post Styling < 1.3.1 - Multiple CSRF
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
-
Unscored —
WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF
The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisatio…
-
Unscored —
MailPress <= 7.2.1 - Arbitrary Settings Update & Log Files Purge via CSRF
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
-
Unscored —
OpenBook Book Data <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF
The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of …
-
Unscored —
Icegram < 2.1.8 - Contributor+ Stored Cross-Site Scripting
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
-
Unscored —
Social Share Buttons by Supsystic < 2.2.4 - Multiple CSRF
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete an…
-
Unscored —
My Private Site < 3.0.8 - Arbitrary Settings Update via CSRF
The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Unscored —
New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin setti…
-
Unscored —
Site Offline or Coming Soon <= 1.6.6 - Stored Cross-Site Scripting via CSRF
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them …
-
Unscored —
HTML2WP <= 1.0.0 - Unauthenticated Arbitrary File Upload
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
-
Unscored —
HTML2WP <= 1.0.0 - Arbitrary Settings Update via CSRF
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them
-
Unscored —
HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
-
Unscored —
Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site Scripting
The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
-
Unscored —
Image Gallery - Grid Gallery < 1.1.6 - Admin+ Stored Cross-Site Scripting
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
-
Unscored —
Form - Contact Form <= 1.2.0 - Admin+ Stored Cross-Site Scripting
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
-
Unscored —
miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unf…
-
Unscored —
Flower Delivery by Florist One <= 3.7 - Admin+ Stored Cross-Site Scripting
The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disal…
-
Unscored —
Mihdan: No External Links < 5.0.2 - Admin+ Stored Cross-Site Scripting
The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disa…
-
Unscored —CVE-2022-1029 Scanner template
Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting
The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html…
-
Unscored —
WordPress Security < 4.2.1 - Admin+ Stored Cross-Site Scripting
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site …
-
Unscored —
Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html c…
-
Unscored —
miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
-
Unscored —
XCloner < 4.3.6 - Plugin Settings Reset
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup …
-
Medium 6.3
SourceCodester Library Management System bookdetails.php sql injection
A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /librarian/bookdetails.php. The manipulation of the argument id with the input ' AND (SE…
-
Low 3.5
SourceCodester Library Management System cross site scripting
A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_admin_details.php?id=admin. The manipulation of the argument Nam…
-
Medium 6.3
SourceCodester Library Management System /card/index.php unrestricted upload
A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component /card/index.php. The manipulation of the argument image leads to unrestricted upload. It is possibl…