Archives: Reports

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The framework for plugins and themes contain a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the {slug}_submit-uninstall-reason AJAX action, which makes it possible for attackers to sending the uninstall reason, which also includes personal data (such as the admin’s name, email, IP address), and server information via a forged request if they can trick an administrator into performing an action such as clicking on a link. Note: The {slug} is a plugin or theme slug configured in the framework.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce checks in the rb_activate_included_plugin and rb_deactivate_included_plugin AJAX actions, which makes it possible for attackers to activate or deactivate addon plugins via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the prompt_dismiss_notice AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to perform PHP Object Injection attacks.

The plugin contains a Missing Authorization vulnerability due to an incorrect capability check in the wo_remove_client AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to delete arbitrary client.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the donation_button_twilio_send_test_sms AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to use the plugin’s Twilio integration to send SMS to arbitrary phone numbers.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Non-Arbitrary File Upload vulnerability due a missing form id check and an incorrect nonce check in the dnd_codedropz_upload and dnd_codedropz_upload_delete AJAX actions, which makes it possible for unauthenticated attackers to upload files to the server without it being assigned to an existing form and delete files from the server.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the wo_regenerate_secret AJAX action, which makes it possible for attackers to regenerate the secret of an arbitrary client via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the cardealer_install_plugin AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to install and activate arbitrary plugins from WordPress.org repository.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the antihacker_install_plugin AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to install and activate arbitrary plugins from WordPress.org repository.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the wptools_install_plugin AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to install and activate arbitrary plugins from WordPress.org repository.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the wpmemory_install_plugin AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to install and activate arbitrary plugins from WordPress.org repository.