Category
Web / CMS
26,715 known vulnerabilities.
15,849 results · Clear filters · Feed
-
Medium 4.1
Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code
The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts,…
-
Medium 6.8
WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'main_field' Parameter
The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to …
-
Medium 5.3
WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, includ…
-
Medium 4.3
Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX Action
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable …
-
Medium 6.8
Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to p…
-
Medium 6.8
Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Display Name in Post Author Widget
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Auth…
-
Medium 5.3
Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe Checkout Session
The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and than…
-
Medium 5.3
Data Tables Generator by Supsystic < 1.15.8 - Unauthenticated Table Content Disclosure via IDOR
The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthent…
-
Medium 5.3
User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership Field
The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated regi…
-
Medium 4.3
User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely…
-
Medium 6.8
Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts…
-
Medium 6.1
Product Filter for WooCommerce by WBW <= 3.4.5 - Reflected Cross-Site Scripting via 'text_no_products' Parameter
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This ma…
-
Medium 6.0
Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0…
-
Medium 5.3
FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send
The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting th…
-
Medium 5.3
Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users …
-
Medium 5.9
BulletProof Security <= 7.2 - Unauthenticated Sensitive Data Disclosure via Security Log
The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server co…
-
Medium 5.5
All in One Visual Composer Addons <= 1.2 - Contributor+ LFI via vca_tabs_style Shortcode Attribute
The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor ro…
-
Medium 6.8
Zion Builder <= 3.6.17 - Author+ Stored XSS via SVG Upload
The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author ro…
-
Medium 5.3
Extend B2B - Companies and Users Management for WooCommerce <= 2.1.4 - Unauthenticated Sensitive Information Exposure in /wp/v2/aio_company REST Endpoint
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unauthenticated attackers…
-
Medium 5.4
PrestaShop Performance Debug Configuration PHP Code Injection
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is…
-
Medium 6.5
WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.
-
Medium 5.3
FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified
The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an or…
-
Medium 5.3
Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user acco…
-
Medium 5.3
UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unau…
-
Medium 5.3
Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wid…
-
Medium 5.9
GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's St…
-
Medium 4.4
WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checko…
-
Medium 5.3
All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of passwor…
-
Medium 4.9
Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR
The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash…
-
Medium 6.5
WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a …
-
Medium 4.9
Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification
The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, includ…
-
Medium 5.3
BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders …
-
Medium 4.1
Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection…
-
Medium 5.3
Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by …
-
Medium 6.5
Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction
The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to thei…
-
Medium 5.3
Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure
The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order…
-
Medium 4.3
FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification …
-
Medium 6.5
Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkou…
-
Medium 5.3
Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API
The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted …
-
Medium 5.3
WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure
The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full conte…