I found one of the quickest vulnerabilities I think I will ever find right after signing up for an account on the website. This was a private bug bounty program so I will not be disclosing the company name, but I think you will still find this quite interesting! As…
I came across a Broken Access Control vulnerability in the Easy Cookie Policy plugin for WordPress on February 27th, 2021. This affects all versions of the plugin, and unfortunately, there is no fix available for the plugin which has since been removed from the WordPress plugin repository. About The Plugin…
A Cross-Site Scripting vulnerability was found in the WordPress plugin Advanced Order Export For WooCommerce version 3.1.7 and lower. The vulnerability in Advanced Order For WooCommerce plugin was originally found on February 15th, and fixed by the 22nd. This was a reflected XSS, located in the plugin options via the…
On the 10th and 11th of February, I came across two inactive WordPress plugins relating to database backups. Both plugins had cross-site request forgery vulnerabilities where a logged-in admin could be tricked into clicking a link that will create a backup of the database. The database backups are then created…