Jan 22, 2020 | WordPress Vulnerabilities
DescriptionContact Form Clean and Simple is vulnerable to Authenticated stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin’s options. This code will then be executed on every page with the contact form on the...
Jan 19, 2020 | WordPress Vulnerabilities
Proof of Concept Vulnerable code is from like 68 to 84. The code gets the value of option `bm_row_amount` from database and matches it with the GET request `row_amount`. If they do not match then it updates the option `bm_row_amount` with the provided GET value. If...
Jan 18, 2020 | WordPress Vulnerabilities
<html> <form action=”https://[WP]/wp-admin/admin.php?page=marketo_fat” method=”POST” id=”csrf”> <input type=”text” name=”marketo_save” value=”true”> <input...
Jan 17, 2020 | WordPress Vulnerabilities
Proof of Concept It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwp_mmb_set_request which is located in the init.php file. This checks if the request_params array of the core class is not...
Jan 16, 2020 | WordPress Vulnerabilities
DescriptionReflected Cross Site Scripting (XSS) issue on the [ld_profile] search field. First reported to Learndash on January 14, 2020, and update 3.1.2 to fix it was released same day. This report is based on an email LearnDash sent out to their users on January 14,...
