Publicly Disclosed
PoC Exploits

isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to...

The Paymentfor Gateway for WooCommerce plugin, prior to version 1.0.6, has a critical issue where it fails to properly verify the authenticity of inbound payment notifications. This vulnerability allows malicious users to mark orders as paid without completing any actual payment, potentially lead...

The Cart Abandonment Recovery for WooCommerce plugin prior to version 2.1.4 is vulnerable as it fails to validate the ownership of email addresses used to access abandoned cart records. This allows unauthenticated attackers, armed with a customer's email, to manipulate or delete stored abandoned ...

The AWP Classifieds plugin for WordPress prior to version 4.4.9 lacks proper authorization checks when a payment transaction is involved. This issue allows unauthenticated individuals to bypass security measures on the ad submission page, enabling them to access and read private contact informati...

The Sifalo Pay WordPress plugin, prior to version 2.5.3, exhibits a serious flaw in its handling of payment returns. Specifically, the plugin fails to validate the ownership or authorization for orders being modified during payment return processes. This oversight could potentially allow unauthen...

The YITH WooCommerce Popup WordPress plugin prior to version 1.60.0 contains an authorization flaw that permits users with Contributor role and above to delete arbitrary post metadata. This vulnerability allows unauthorized manipulation of post content, bypassing intended access controls that sho...

The SellKit plugin for WordPress, prior to version 2.8.0, contains a significant vulnerability that fails to properly validate the price input supplied by users. This weakness permits unauthenticated attackers to manipulate product prices during the checkout process. As a result, attackers can pl...

The Donation Thermometer plugin for WordPress, prior to version 2.3.0, is vulnerable to arbitrary code injection due to the inadequate escaping of a color value from a shortcode attribute. This flaw enables users with Contributor role and higher to inject event handlers that execute when the page...

The Sifalo Pay WordPress plugin prior to version 2.5.3 contains a serious verification bypass vulnerability. This flaw permits unauthenticated attackers to exploit valid transaction identifiers, potentially marking arbitrary pending orders as paid without authorization. By failing to verify wheth...

The Robokassa payment gateway for WooCommerce, prior to version 1.9.0, is susceptible to a malfunction due to improper verification of payment notification requests. This flaw enables unauthorized users to manipulate the state of any WooCommerce order, potentially leading to disruption in order f...

The Asaas Gateway for WooCommerce plugin prior to version 2.7.8 is susceptible to an authentication bypass vulnerability. This issue arises due to insufficient verification of payment webhooks, where an empty access token can be accepted in the default configuration. This lack of validation permi...

The Tainacan WordPress plugin prior to version 1.4.0 allows authenticated users lacking sufficient permissions to access unrestricted REST API endpoints. This flaw can enable subscribers to obtain sensitive information, specifically the email addresses of repository staff members, posing a risk t...

The Fast Courier WordPress plugin prior to version 5.2.4 is susceptible to an SQL injection vulnerability due to improper sanitization and escaping of input values in an unauthenticated REST route. This flaw allows attackers without authentication to manipulate SQL queries, potentially granting t...

The rtMedia plugin for WordPress, which integrates with BuddyPress and bbPress, contains a flaw that allows users with subscriber-level accounts or higher to upload media to private albums that do not belong to them. This behavior is due to inadequate verification of user permissions, potentially...

The Trust Payments Gateway for WooCommerce plugin prior to version 3.1.0 contains a significant security flaw that allows attackers to exploit the lack of verification on payment responses. When users return from the hosted payment page, the plugin fails to authenticate the payment provider's res...

The FV Flowplayer Video Player plugin for WordPress is susceptible to a server-side request forgery (SSRF) vulnerability due to improper validation of user-supplied URLs. This flaw, present in versions prior to 7.5.55.7212, allows users with Contributor-level access and above to initiate requests...

The Forms WordPress plugin before version 3.0.2 allows unauthenticated users to exploit inadequately sanitized form values. This vulnerability enables potential attackers to inject arbitrary web scripts, which can execute in the browser of any administrator viewing the form submissions within the...

The Pricing Table WordPress plugin, prior to version 2.1.5, contains a vulnerability that permits a user with contributor-level access or higher to input links lacking proper validation. This flaw allows them to store and execute harmful scripts when other users interact with the affected content...

The WooCommerce Merchant plugin, utilized for managing product feeds for Google Shopping and Microsoft Advertising, is affected by a vulnerability due to insufficient security checks. Specifically, the plugin lacks appropriate nonce or capability verification on the AJAX action responsible for st...

The Affiliate-Toolkit WordPress plugin, prior to version 3.9.1, exposes a significant vulnerability that allows users with low privileges to manipulate the template body. When processed by the plugin's templating engine, this can result in arbitrary PHP code execution on the server. This poses a ...

The WP Encryption plugin for WordPress versions prior to 7.8.8.2 is susceptible to improper authentication vulnerabilities, where it fails to implement necessary capability or nonce checks on its SSL certificate provisioning handlers. This allows unauthenticated users to potentially overwrite the...

The WP 2FA plugin for WordPress prior to version 4.2.0 is susceptible to a vulnerability that allows site administrators on Multisite installations to bypass proper authorization checks. This flaw enables them to remove the two-factor authentication (2FA) configurations of users from different si...

The Sunshine Photo Cart WordPress plugin prior to version 3.7.4 lacks proper validation to restrict access to protected galleries, enabling unauthorized individuals to submit comments. This vulnerability allows attackers to manipulate comment content and author details, thus compromising the inte...

The EmbedPress WordPress plugin, prior to version 4.6.8, is susceptible to a server-side request forgery vulnerability. This flaw allows unauthenticated attackers to send requests that trigger actions on a third-party API without proper checks, such as capability or nonce validation. Consequently...

The File Upload to Order plugin for WordPress allows unauthenticated users to exploit a flaw in file path handling, enabling them to delete arbitrary files on the server. This security issue arises because the plugin does not properly validate file paths derived from attacker-controlled session d...

The LTL Freight Quotes plugin for WordPress, prior to version 4.2.19, is susceptible to an input injection vulnerability due to the absence of proper authorization checks and input sanitization. This flaw allows unauthenticated users to insert arbitrary HTML and links into the system, which may t...

The GamiPress WordPress plugin prior to version 8.0.6 suffers from a security flaw that fails to correctly authorize access to private activity logs. This oversight enables unauthenticated users to access sensitive user activity logs, posing a risk to user privacy and data security. This vulnerab...

The Image Photo Gallery Final Tiles Grid Plugin for WordPress prior to version 3.6.16 contains a vulnerability that fails to properly escape values for gallery lightbox configurations. This oversight allows users with contributor-level permissions and above to inject malicious JavaScript code int...

The Ultimate Multisite plugin for WordPress, versions prior to 2.17.2, is susceptible to a file inclusion vulnerability that allows unauthenticated users to include and read arbitrary files on the server. This issue arises from the plugin's failure to properly validate user-supplied input utilize...

The GamiPress plugin for WordPress, prior to version 8.0.6, features a significant vulnerability due to its lack of capability checks and ownership verification on certain authenticated AJAX actions. This oversight enables any authenticated user, such as a Subscriber, to access sensitive informat...

The Gutenverse Form WordPress plugin, prior to version 3.0.11, is susceptible to an SVG injection vulnerability. This occurs due to the plugin's failure to properly sanitize SVG icon markup prior to rendering it on the webpage. Authenticated users with Contributor-level access and above can explo...

The Classified Listing Plugin for WordPress prior to version 6.1.1 contains a vulnerability that allows authenticated users with subscriber-level accounts to manipulate, corrupt, or delete media-library attachments owned by other users. This occurs due to the plugin's failure to validate whether ...

The WP Data Access plugin for WordPress, prior to version 5.5.84, lacks sufficient access control for its database table export functionality. This flaw allows unauthorized users to exploit a token for exporting data from any publicly displayed tables. Attackers can access the complete dataset, i...

The LTL Freight Quotes WordPress plugin prior to version 4.2.19 is susceptible to an authorization bypass on specific REST API routes. This flaw permits unauthenticated users to manipulate stored settings in the database, potentially leading to misuse and data integrity issues. Users are advised ...

The NEX-Forms plugin for WordPress versions prior to 9.3.1 has a significant authorization flaw, lacking essential checks for validating user ownership and requests when updating stored form entries. This vulnerability enables unauthenticated attackers to exploit the system by modifying, deleting...

The WP Booking System plugin for WordPress, prior to version 2.1.0.1, fails to properly sanitize user input before storing and subsequently displaying it on the admin interface. This oversight allows attackers to inject malicious scripts, leading to Stored Cross-Site Scripting (XSS) attacks. An u...

The PublishPress Future plugin for WordPress, prior to version 4.10.6, lacks proper enforcement of a safe HTML-element allowlist for shortcode attributes. As a result, this allows users with the Contributor role and above to inject malicious JavaScript code. This code executes in the browser sess...

The Rank Math SEO plugin for WordPress prior to version 1.0.280 is susceptible to an improper access control vulnerability. This flaw allows unauthenticated users to clear stored SEO analysis data without the need for proper capability checks or nonce validation. As a result, unauthorized deletio...

The CodeAtoZ B2B Suite for WooCommerce WordPress plugin prior to version 1.6.1 is susceptible to an access control vulnerability that permits unauthenticated users to access and retrieve guest-submitted quotes. By providing an enumerable identifier, attackers can obtain sensitive information incl...

The CamPay Shortcode Payment Gateway plugin for WordPress prior to version 1.7 suffers from a significant security flaw that undermines the verification of Mobile Money payment confirmations. This vulnerability allows unauthenticated users to manipulate payment records by asserting that transacti...

The WP Data Access plugin for WordPress prior to version 5.5.77 lacks proper authorization checks on a specific application REST endpoint. This oversight permits unauthorized users to alter application data that is configured for anonymous read access, even if the administrator has disabled updat...

The Image Photo Gallery Final Tiles Grid Plugin for WordPress contains a vulnerability allowing users with contributor-level access and higher to inject malicious JavaScript. This occurs due to improper sanitization and escaping of gallery configuration values, which are echoed in an inline scrip...

The Walletdoc Payment Gateway for WooCommerce plugin prior to version 1.8.5 is susceptible to SQL injection due to inadequate sanitization and escaping of user input within SQL statements. Additionally, it lacks a secure payment webhook verification as its signing secret is set to empty by defaul...

A missing authentication issue in the Windows Health and Optimized Experiences Service allows an attacker with local access to escalate their privileges. This vulnerability can be exploited to gain unauthorized access to sensitive data and operations, threatening the overall security of the syste...

A server-side request forgery vulnerability has been identified in Hyperledger Firefly's Webhook Subscription component. The issue lies in the ValidateOptions function found in the internal/events/webhooks/webhooks.go file. An attacker can manipulate the URL argument, potentially leading to unaut...

An improper authentication vulnerability exists in the Danfoss AK-SM 8xxA Series, which can allow unauthorized access to sensitive functions within the affected products. This vulnerability risks the security of controlled environments, potentially leading to exposure of critical data and operati...

The NetX Duo SNMP addon in ThreadX is vulnerable to a buffer overflow due to improper validation of the OID data length when using BER multibyte length encoding. This vulnerability allows attackers to send crafted SNMP packets with malicious OID lengths larger than the available buffer. As a resu...

The simple-git package, which facilitates running Git commands in Node.js applications, has a vulnerability prior to version 4.0.0 that allows attacker-influenced arguments to bypass security checks during Git operations. This can lead to command injection risks, enabling attackers to execute arb...

Telegram Desktop prior to version 7.2.9 is susceptible to an IPC record-separator injection vulnerability present in Core::Sandbox. This flaw permits remote attackers to craft tg:// links embedded with unescaped semicolons. By exploiting this vulnerability, an attacker can manipulate the interpre...

Vikunja versions between 0.24.0 and 2.3.0 are susceptible to a broken object level authorization (BOLA) flaw within the task-collection endpoint. This vulnerability allows an attacker to access unauthorized project views by manipulating the URL path. Specifically, the endpoint does not verify if ...