Due to a lack of CSRF protection, and lack of sanitation of user input, it is possible to trigger a Persistent XSS attack via a CSRF attack. This attack targets in particular the Import functionality, which is located in the ‘wlcmsImport’ function,...
When initialized, the rtMedia will include and instantiate certain classes if BuddyPress is installed. One of these classes is RTMediaActivityUpgrade, contained within the file ‘app/importers/RTMediaActivityUpgrade.php’. This class is instantiated in...
The Mashshare plugin exposes a few AJAX commands via its own custom hook, which can be found in the file ‘includes/admin/admin-actions.php’, and the function ‘mashsb_process_actions’. This function is called upon the ‘admin_init’ action being fired,...
The Crayon Syntax Highlighter plugin allows access to the AJAX method ‘crayon-theme-editor-save’ to any registered user. This is due to the incorrect usage of the ‘is_admin()’ check, to ensure users are administrators. The ‘is_admin()’ will return...
The WordPress Leads plugin exposes a number of functions via AJAX to Anonymous users via the ‘nopriv_’ prefix. One of these functions that is registered in ‘leads/shared/classes/class.lead-storage.php’ controls the insertion of leads into the...
The Newsletter plugin is susceptible to an Open Redirect vulnerability. This issue is due to the fact user input it taken, and trusted, without validation. This user input is used when tracking link clicks, via the ‘newsletter/statistics/link.php’...
The AJAX function ‘coming_soon_page_settings’, defined in ‘easy-coming-soon/coming-soon-plugin.php’ is available to any registered user. This allows any registered user of the site to enable, and update the settings in the ‘Easy Coming Soon’ Plugin,...
The AJAX action ‘get_reqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return.
A hook is added to ‘init’ in the file ‘miwoftp/miwoftp.php’. This hook is triggered whenever a user visits the front end of the site. The function specified in this hook will proceed to allow the user to download a file within the scope of the home...