Category
Web / CMS
26,715 known vulnerabilities.
1,140 results · Clear filters · Feed
-
Medium 5.3CVE-2024-0624 Public exploit
Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the …
-
High 8.8
Cross-site WebSocket hijacking vulnerability in the Jenkins CLI
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing at…
-
Critical 9.8
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files …
KEV Aug 19, 2024 -
Medium 6.5CVE-2024-0679 Public exploit
ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation
The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-l…
-
Medium 4.3CVE-2024-0623 Public exploit
VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery
The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for …
-
Medium 5.3
EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
-
High 7.5CVE-2023-1405 Public exploit
Formidable Forms < 6.2 - Unauthenticated PHP Object Injection
The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.
-
Critical 9.8
The School Management < 9.9.7 - Unauthenticated RCE via REST api
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
-
Critical 10.0
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated att…
KEV Jan 24, 2024 -
Critical 10.0
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account passwor…
KEV May 1, 2024 -
Critical 9.8
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all v…
-
Critical 9.8
LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…
-
High 8.1CVE-2023-6634 Public exploit
LearnPress <= 4.2.5.7 - Command Injection
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for …
-
Medium 6.1CVE-2023-6000 Public exploit
Popup Builder < 4.2.3 - Unauthenticated Stored XSS
The Popup Builder WordPress plugin before 4.2.3 does not prevent simple visitors from updating existing popups, and injecting raw JavaScript in them, which could lead to Stored XSS attacks.
-
High 7.5CVE-2023-6421 Public exploit
Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak
The Download Manager WordPress plugin before 3.2.83 does not protect file download's passwords, leaking it upon receiving an invalid one.
-
Critical 9.8CVE-2023-6972 Public exploit
Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possib…
-
Critical 10.0CVE-2023-29384 Public exploit
WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
-
Medium 4.3CVE-2023-6289 Public exploit
Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
-
Critical 9.8
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequ…
-
Unscored —
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
-
Medium 6.1CVE-2023-4460 Public exploit
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
-
High 8.6
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in t…
-
Unscored —CVE-2023-40626 Public exploit
[20231101] - Core - Exposure of environment variables
The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information.
-
Critical 9.8CVE-2023-2437 Public exploit
UserPro <= 5.1.1 - Authentication Bypass to Administrator
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthe…
-
Medium 4.3CVE-2023-5546 Public exploit
Moodle: stored xss in quiz grading report via user id number
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
-
Medium 6.4CVE-2023-4842 Public exploit
Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied att…
-
Critical 10.0
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authori…
KEV Nov 7, 2023 -
Unscored —
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
-
High 8.8CVE-2023-5412 Public exploit
Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on …
-
Medium 6.5CVE-2023-5070 Public exploit
Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposure
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that inc…
-
Critical 9.8CVE-2023-5204 Public exploit
AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response
The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak…
-
High 7.2CVE-2023-5538 Public exploit
MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att…
-
Medium 5.3CVE-2023-5089 Public exploit
Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin …
-
High 7.2CVE-2023-4861 Public exploit
File Manager Pro < 1.8.1 - Admin+ Remote Code Execution
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code executio…
-
Medium 6.5CVE-2023-4800 Public exploit
DoLogin Security < 3.7.1 - Subscriber+ IP Address leak
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
-
Medium 5.3CVE-2023-5561 Public exploit
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
-
Critical 10.0
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…
KEV Oct 5, 2023 -
Unscored —CVE-2023-4549 Public exploit
DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
-
Medium 5.3CVE-2023-4631 Public exploit
DoLogin Security < 3.7 - IP Spoofing
The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.
-
Medium 5.3CVE-2023-4281 Public exploit
Activity Log < 2.8.8 - IP Spoofing
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.