wordpress wordpress 2.2.0 vulnerabilities and exploits

(subscribe to this query)

A remote code execution issue exists in the WooCommerce Products Filter (aka WOOF) plugin prior to 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woof_redraw_woof action. The plugin implemented a page redraw AJAX function accessible to anyone without any aut...

Woocommerce-filter Woocommerce Products Filter

The All In One Redirection WordPress plugin prior to 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

Vsourz All In One Redirection

The Comic Book Management System WordPress plugin prior to 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.

Inksplat Comic Book Management System

The Elements Kit Lite and Elements Kit Pro WordPress Plugins prior to 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

The grid-kit-premium WordPress plugin prior to 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Wpsofts Portfolio Gallery\\, Product Catalog - Grid Kit Portfolio

The Peter’s Collaboration E-mails WordPress plugin up to and including 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.

Peter\\'s Collaboration E-mails Project Peter\\'s Collaboration E-mails

The Contact Form Builder by Bit Form WordPress plugin prior to 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ...

Bitapps Contact Form Builder

The Easy Accordion WordPress plugin prior to 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used a...

Techearty Easy Accordion

The WP Meta and Date Remover WordPress plugin prior to 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as...

Prasadkirpekar Wp Meta And Date Remover

« PREV 1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook