Archives: Reports

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the stopbadbots_install_plugin AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to install and activate arbitrary plugins from WordPress.org repository.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the shop_options_ajax AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to create, update and delete shipping methods.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in multiple AJAX actions, and it’s also contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for attackers to inject arbitrary web scripts.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the pm_delete_popup AJAX action, which makes it possible for unauthenticated attackers to delete arbitrary popup.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the pm_save_data AJAX action, which makes it possible for unauthenticated attackers to access popup update functionality. The plugin also contains a Cross-Site Scripting (XSS) vulnerability, due to the plugin does not sanitize and escape the popup_html parameter, which makes it possible to inject arbitrary web scripts.

The plugin does not prevent subscribers from updating a site’s feed access token, which may deny other users access to the functionality in certain configurations. The plugin contains a Missing Authorization vulnerability due to a missing capability check in the regenerate_token AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to update the site’s feed access token, which may deny other users access to the website.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the send_system_info and generate_url AJAX actions, which makes it possible for authenticated attackers with a role as low as subscriber to extract sensitive data including system information.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the wo_remove_client AJAX action, which makes it possible for attackers to delete arbitrary post because the post type check is also missing via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the activecampaign_for_woocommerce_clear_error_log AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to delete error logs.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the wpfc_qtip_content AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to extract sensitive data including post content of a draft, private or password-protected post.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated attackers with a role as low as administrator to inject arbitrary web scripts.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated users with a role as low as contributor to inject arbitrary web scripts into pages.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the stm_wpcfto_get_settings AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to extract sensitive data including meeting’s data.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the social_login_update AJAX action, which makes it possible for attackers to update plugin settings via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the wd_search_cf AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to extract sensitive data including post metadata.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the phone-orders-for-woocommerce AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to extract sensitive data including user’s personal data.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the cp_feedback AJAX action, which makes it possible for attackers to submit feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when submitting feedback, which makes it possible for attackers to send feedback via a forged request if they can trick an administrator into performing an action such as clicking on a link.