Publicly Disclosed
PoC Exploits

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

The Quick Paypal Payments WordPress plugin versions prior to 5.7.50 contains a security weakness in its PayPal IPN handler. This vulnerability allows an attacker to exploit the payment confirmation process by matching order tokens without validating key transaction details such as the paid amount...

The Estatik Real Estate Plugin for WordPress features a significant flaw where it fails to properly validate the recipient list intended for messages generated via its property request form. This oversight allows unauthenticated users to exploit the functionality and send emails to any arbitrary ...

The Payment Button for PayPal WordPress plugin prior to version 1.2.3.44 features a significant vulnerability related to improper input validation. This security flaw allows unauthenticated users to manipulate the payment amount by sending a client-supplied payment value that is not properly vali...

The Kirki WordPress plugin prior to version 6.2.1 is susceptible to inadequate authorization that affects its front-end form submission REST routes. This vulnerability allows unauthenticated attackers to exploit the system by executing any registered shortcodes, which can lead to significant issu...

The Payment Gateway for PayPal in the WooCommerce plugin prior to version 9.2.1 contains a vulnerability that compromises the integrity of payment processing. It fails to validate whether a payment was successfully completed before marking orders as paid. The exploit allows an unauthenticated att...

The Welcart e-Commerce plugin for WordPress is susceptible to a significant vulnerability where it fails to properly verify the authenticity of callback requests related to convenience-store and bank-transfer settlements. This flaw allows an unauthenticated attacker to change the status of an ord...

The Wallet System for WooCommerce WordPress plugin version prior to 2.7.10 is vulnerable due to a lack of validation for user-supplied wallet amounts during the checkout process. This failure allows authenticated users to reduce their order total arbitrarily, including the possibility of setting ...

The node-tar library, utilized for handling tar files in Node.js, has a security flaw affecting versions up to 7.5.2. This vulnerability arises from an inadequate sanitization of link paths in both hardlink and symbolic link entries when the preservePaths option is disabled (which is the default ...

The Royal Addons for Elementor plugin for WordPress, prior to version 1.7.1065, contains a vulnerability that fails to adequately validate widget settings when generating HTML outputs. This oversight allows users with Contributor roles or higher to inject malicious scripts, facilitating Stored Cr...

The WPC Admin Columns plugin for WordPress prior to version 2.3.4 lacks proper authorization checks in one of its AJAX actions. This oversight permits users with minimal roles, such as subscribers, to access and read arbitrary user, post, and term metadata, potentially exposing sensitive informat...

The Order Sync with Zendesk for WooCommerce plugin prior to version 2.2.3 fails to implement necessary capability checks on its REST API endpoints. This oversight allows unauthenticated users to gain access to sensitive customer information, including order history and total purchases, simply by ...

The ProSolution WP Client WordPress plugin prior to version 2.0.9 has a critical security flaw that permits authenticated users to leverage an unvalidated URL input for server-side HTTP requests. Due to the lack of validation on the user-supplied URL and insufficient checks on user capabilities o...

The ProSolution WP Client plugin for WordPress, prior to version 2.0.9, suffers from a serious security flaw due to inadequate checks on administrative AJAX actions. This oversight permits any authenticated user, including those with limited roles such as subscribers, to invoke administrative dat...

The WP Photo Album Plus WordPress plugin, prior to version 9.2.09.002, fails to enforce user authorization when allowing front-end uploads. This oversight enables any authenticated user, including those with minimal access such as Subscribers, to upload files to albums owned by others, including ...

An access control vulnerability exists in the Ezoic WordPress plugin prior to version 2.23.1, which fails to adequately restrict access to its content export features. This flaw enables unauthorized users to exploit the plugin, resulting in the ability to trigger an unwanted server-side export of...

The WP Directory Kit WordPress plugin prior to version 1.5.6 fails to properly sanitize and escape input parameters in its SQL statements during authenticated AJAX actions. This lack of adequate authorization checks enables any authenticated user, including subscribers, to exploit this vulnerabil...

The WP Directory Kit WordPress plugin is susceptible to SQL injection due to insufficient sanitization and escaping of parameters used in SQL statements. This vulnerability enables unauthenticated users to manipulate the database by exploiting a non-default search field type, potentially leading ...

The Events Manager plugin for WordPress prior to version 7.4.1 contains a significant access control vulnerability. This flaw arises from improper scoping of capability mapping, which negates the access control measures implemented by WordPress for unrelated privileged actions. As a result, unaut...

The WooCommerce Subscriptions plugin, prior to version 9.1.0, is vulnerable to PHP Object Injection when operating on stores that have High-Performance Order Storage enabled. This vulnerability allows unauthenticated users to exploit the weakness by injecting malicious serialized objects. By leve...

The Events Manager plugin for WordPress, prior to version 7.4.1, is susceptible to SQL injection due to insufficient sanitization and escaping of user-supplied input in its SQL statements. This vulnerability permits users with subscriber-level access or higher to manipulate booking consent record...

The WP Photo Album Plus plugin for WordPress has a significant security issue that arises from its failure to validate user-controlled input when constructing file paths. This vulnerability allows unauthenticated attackers to execute arbitrary deletion commands on ZIP archives stored on the serve...

The WP Photo Album Plus plugin for WordPress prior to version 9.2.07.002 contains a security flaw that allows unauthorized users to access sensitive configuration data. This occurs because the plugin does not implement necessary checks on certain public endpoints and inadequately handles input va...

The Cookie Consent WordPress plugin prior to version 0.0.10 contains a significant flaw that allows authenticated users, even those with minimal privileges, to modify the geolocation service license key. This vulnerability arises due to insufficient enforcement of administrator-only capabilities ...

The WP Photo Album Plus plugin for WordPress versions prior to 9.2.07.002 is susceptible to reflected cross-site scripting (XSS) due to improper sanitization and escaping of input parameters. This weakness can be exploited by unauthenticated attackers, who can craft malicious links that, when cli...

The User Access Manager plugin for WordPress prior to version 2.3.15 contains a significant access control flaw. This vulnerability allows unauthenticated individuals to bypass intended restrictions, gaining unauthorized access to posts, pages, and custom post types. The absence of proper access ...

The WP Travel Engine plugin for WordPress before version 6.8.5 lacks proper authorization checks on unauthenticated cart actions. This loophole allows attackers to exploit the system by providing a booking identifier to access sensitive customer booking details and billing information. Additional...

The Wallet for WooCommerce plugin prior to version 1.6.10 suffers from a vulnerability where it fails to validate the actual amount collected during wallet top-up transactions. This oversight enables users to increase their wallet balance unjustly, allowing for potential financial exploitation. P...

The PowerPress Podcasting Plugin by Blubrry prior to version 11.17.1 contains a security flaw where it fails to validate the Podcast Episode URL settings. This oversight permits users assigned to lower roles, such as Contributor, to exploit server-side request forgery (SSRF) vulnerabilities. As a...

The Form Maker plugin by 10Web for WordPress prior to version 1.15.45 contains a vulnerability due to improper parameterization of user-controlled values. This flaw allows an attacker with subscriber-level permissions to exploit dynamic SQL queries within the plugin, potentially enabling second-o...

The Total Upkeep plugin for WordPress, prior to version 1.17.3, is susceptible to an insecure direct object reference, resulting in inadequate protection of backup-restore functionality secrets. This flaw allows unauthenticated users to access sensitive backup data and potentially initiate a full...

The WPMU DEV Updates plugin prior to version 5.0.1 fails to ensure the integrity of packages installed via its remote management interface. This oversight allows attackers to exploit legitimate management requests, potentially leading to the installation and execution of arbitrary code on affecte...

The Cookie Consent plugin for WordPress prior to version 0.0.10 is susceptible to improper access control due to a lack of proper enforcement of administrator capabilities on its REST routes. This vulnerability allows any authenticated user, even those with limited privileges such as subscribers,...

The Patterns Kit plugin for WordPress has a vulnerability that allows users with minimal privileges, such as the Contributor role, to inject malicious payloads. This occurs because the plugin fails to properly escape link attributes before inserting them into client-side scripts. Consequently, at...

The Welcart e-Commerce plugin for WordPress prior to version 2.11.34 lacks proper sanitization and escaping of product fields. This oversight allows users with the Author role or higher to inject arbitrary web scripts. Such scripts can execute in the browser of any visitor accessing the product p...

The Import WP plugin prior to version 2.14.23 is susceptible to an authorization bypass flaw, which permits unauthenticated attackers to download export files that were generated by administrators. These files may unintentionally expose sensitive user information, including email addresses, login...

The WP Crowdfunding plugin for WordPress, prior to version 2.2.1, exhibits a significant security flaw that fails to verify ownership of orders before disclosing their details. This allows any authenticated users, including those with Subscriber roles, to access sensitive WooCommerce order inform...

The WP Crowdfunding plugin for WordPress prior to version 2.2.1 features an authorization bypass flaw. This vulnerability allows authenticated users, including those with subscriber privileges, to submit crowdfunding campaign posts without the necessary permissions. Specifically, the plugin does ...

The Giftware WordPress plugin prior to version 4.2.10 has a security flaw that fails to properly validate the type of uploaded files in certain upload paths. This oversight allows unauthenticated users to upload arbitrary files, including potentially malicious PHP scripts, which can be executed o...

The KiviCare WordPress plugin, prior to version 4.5.2, inadequately sanitizes and escapes user-provided input before utilizing it in SQL queries. This flaw enables authenticated users with clinic staff-level permissions to execute malicious SQL commands, potentially compromising database integrit...

The Eventin plugin for WordPress, prior to version 4.1.20, contains an access control vulnerability that allows users with contributor-level access or higher to gain unauthorized access to sensitive order records. This vulnerability enables them to read personal information of other customers by ...

The KiviCare WordPress plugin prior to version 4.5.2 fails to ensure that users can only access their own records, inadvertently allowing authenticated users to read sensitive information such as bills, invoices, and appointment details of other patients. This lack of adequate access verification...

The Eventin WordPress plugin prior to version 4.1.20 has a flaw that lacks proper authorization checks on its waiting-list registration handler. This vulnerability allows unauthenticated users to create WordPress user accounts linked to arbitrary email addresses, leading to potential misuse and i...

The WP Crowdfunding plugin for WordPress versions prior to 2.2.1 has a security flaw that allows any authenticated user, including those with Subscriber roles, to modify the update history of campaigns they do not own. This vulnerability also permits the unauthorized sending of notification email...

The LearnPress plugin for WordPress fails to ensure that users are properly enrolled in courses before granting access to course lesson content. This oversight permits any authenticated user, including subscribers, to access materials from paid courses they have not officially enrolled in. As a r...

The Eventin WordPress plugin has a security flaw that allows users with contributor-level access and above to view sensitive customer information stored in the system. This flaw arises from inadequate access controls, permitting unauthorized users to read personal data, such as names and email ad...

An SQL injection vulnerability exists in specific versions of Django prior to 5.1.14, 4.2.26, and 5.2.8. Through the use of specially crafted dictionaries, attackers can exploit the `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()` methods, as well as the `Q()` class, when utilizing...

An information exposure vulnerability exists in Hitachi's Ops Center API Configuration Manager, Configuration Manager, and Device Manager, which could enable unauthorized session hijacking. This flaw affects multiple product versions, potentially exposing sensitive information to attackers. It is...

The vulnerability in the Windows Kernel involves an untrusted pointer dereference that enables authorized attackers to escalate privileges on affected systems. By exploiting this flaw, attackers can gain elevated permissions, potentially leading to unauthorized access and control over system reso...

A security flaw in Open5GS affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, allowing for a denial of service condition. This vulnerability can be exploited remotely, potentially disrupting services that rely on Open5GS. Users are urged to upgrade to version...