WordPress Plugin Vulnerabilities
- Slider by 10Web < 1.2.36 – Multiple Authenticated SQL Injection
- WP Courses < 2.0.29 – Broken Access Controls leading to Courses Content Disclosure
- Simple:Press < 6.6.1 – Broken Access Control leading to RCE
- XCloner Backup and Restore < 4.2.153 – Cross-Site Request Forgery
- XCloner Backup and Restore 4.2.1 – 4.2.12 – Unprotected AJAX Action
- Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 – Unauthenticated Remote Code Execution
- Discount Rules for WooCommerce < 2.2.1 – Multiple Authorization Bypass
- MetaSlider < 3.17.2 – Authenticated Stored Cross-Site Scripting (XSS)
- Multiple Plugins/Themes – Cross-Site Request Forgery (CSRF)
- Affiliate Manager < 2.7.8 – Unauthenticated Stored Cross-Site Scripting (XSS)
- 10Web Social Post Feed < 1.1.27 – Authenticated SQL Injection
- Email Subscribers & Newsletters < 4.5.6 – Unauthenticated email forgery/spoofing
- Sticky Menu, Sticky Header (or anything!) on Scroll < 2.21 – CSRF & XSS
- LearnPress < 3.2.7.3 – CSRF & XSS
- Elementor Addon Elements < 1.6.4 – CSRF & XSS
- Cookiebot < 3.6.1 – CSRF & XSS
- Asset CleanUp: Page Speed Booster < 1.3.6.7 – CSRF & XSS
- All In One WP Security & Firewall < 4.4.4 – CSRF & XSS
- Absolutely Glamorous Custom Admin < 6.5.5 – CSRF & XSS
- Advanced Database Cleaner < 3.0.2 – Authenticated SQL injection
- ActiveCampaign < 8.0.2 – Cross-Site Request Forgery in Settings
- Constant Contact Forms < 1.8.8 – Multiple Authenticated Stored XSS
- NextScripts: Social Networks Auto-Poster < 4.3.18 – Insufficient Privilege Validation
- File Manager < 6.9 – Arbitrary File Upload leading to RCE
WPScan 
Leave a Reply