WordPress Plugin Vulnerabilities

Hide My WP <= 4.53 - Stored-Cross Site Scripting (XSS)

Description

An attacker can make a fake attack attempt which will be logged, and can inject JavaScript.

Proof of Concept

Affects Plugins

Plugin icon
hide_my_wp
Fixed in 4.54

References

URL
https://codecanyon.net/item/hide-my-wp-no-one-can-know-you-use-wordpress/4177158

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Submitter
jurij
Verified
No
WPVDB ID
ffc7ba9c-94c8-4993-bf2b-d7fcf749ba1e

Timeline

Publicly Published
2015-08-13 (about 10 years ago)
Added
2015-08-13 (about 10 years ago)
Last Updated
2019-10-22 (about 6 years ago)

Other

Published
Title
Published
2026-01-06
Title
Post Like Dislike <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Published
2025-10-21
Title
Bg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-04-20
Title
CMS Tree Page View < 1.6.8 - Reflected XSS
Published
2026-03-06
Title
Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Published
2025-12-22
Title
YouTube Embed <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting