406,221 results · Feed
-
High 7.5
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's pass…
-
Critical 9.9
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones con…
-
Critical 9.8
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's p…
-
Medium 5.3
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
-
Medium 4.3
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights …
-
Low 3.7
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user accoun…
-
Low 3.7
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
-
Medium 4.3
Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allo…
-
Medium 5.3
Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registrati…
-
Medium 6.8
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitizat…
-
Medium 6.8
Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform…
-
Low 3.5
LetterPress < 2.4.0 - Admin+ Stored XSS
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Low 3.5
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes i…
-
High 8.6
vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
-
Medium 6.5
PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment…
-
Critical 9.0
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP o…
-
High 7.2
Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side…
-
Medium 4.3
Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy …
-
Medium 5.3
Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
-
Medium 5.3
Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name s…
-
Medium 5.3
Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a …
-
Medium 5.4
Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notificatio…
-
Medium 5.3
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, includ…
-
Medium 6.4
Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once th…
-
High 7.0
nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, e…
-
High 7.2
Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. T…
-
High 8.1
SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table…
-
High 7.5
Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin fall…
-
High 7.5
SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar…
-
High 7.5
Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to, and including, 4.1.12 due to insufficient escaping on the user suppli…
-
Critical 9.8
Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback…
-
High 7.2
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it po…
-
High 7.2
DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This mak…
-
Medium 5.3
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-280…
-
Medium 5.6
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A spe…
-
Critical 9.8
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially…
-
Medium 5.3
In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call…
-
Medium 4.8
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stor…
-
Medium 5.3
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefro…
-
High 8.6
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secr…