Jan 17, 2020 | WordPress Vulnerabilities
Proof of Concept It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwp_mmb_set_request which is located in the init.php file. This checks if the request_params array of the core class is not...
Jan 16, 2020 | WordPress Vulnerabilities
DescriptionWordPress Plugin Plugin Chained Quiz before 1.1.8.2 suffers from a Reflected XSS vulnerability in the ‘total_questions’ POST parameter when a user completes a quiz. The code in question accepts the ‘total_questions’ parameter without...
![LearnDash < 3.1.2 – Reflected Cross Site Scripting (XSS) issue on the [ld_profile] search field.](https://shawndewolfe.com/wp-content/uploads/2020/01/learndash-3-1-2-reflected-cross-site-scripting-xss-issue-on-the-ld_profile-search-field.png)
Jan 16, 2020 | WordPress Vulnerabilities
DescriptionReflected Cross Site Scripting (XSS) issue on the [ld_profile] search field. First reported to Learndash on January 14, 2020, and update 3.1.2 to fix it was released same day. This report is based on an email LearnDash sent out to their users on January 14,...
Jan 15, 2020 | WordPress Vulnerabilities
DescriptionReflected XSS was discovered in the «ListingPro – WordPress Directory Theme», tested version — v2.5.3 Edit – WPScanTeam: January 13th, 2020 – Report Received & Envato Contacted January 13th, 2020 – Envato Investigating January...
Jan 14, 2020 | WordPress Vulnerabilities
Proof of Concept It is possible to login as an administrator on the site due to logical mistakes in the code. The issue resides in wptc-cron-functions.php line 12 where it parses the request. This parse_request function calls the function decode_server_request_wptc...
Jan 11, 2020 | WordPress Vulnerabilities
DescriptionMultiple vulnerabilities was discovered in the «EasyBook – Directory & Listing WordPress Theme», tested version — v1.2.1: – Unauthenticated Reflected XSS – Authenticated Persistent XSS – IDOR December 27th, 2019 – Envato...
