plugin
18 known security issues reported for the Crayon Syntax Highlighter WordPress plugin. Most recent disclosed Sep 12, 2023.
Running Crayon Syntax Highlighter on your site? Check whether your installed version is affected.
Scan your site free[en] The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2.8.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web...
The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Server Side Request Forgery via the 'crayon' shortcode in versions up to, and including, 2.8.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web appl...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Aram Kocharyan Crayon Syntax Highlighter plugin <= 2.8.4 versions.
The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.4. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function, via forged request granted t...
[en] The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
This plugin is prone to a local file disclosure vulnerability. It allows attackers to see the content of any file. Update plugin.
Because of this vulnerability, attackers can craft the user provided parameters in such a way that it becomes possible to overwrite base themes with arbitrary CSS. Update plugin.
The Crayon Syntax Highlighter Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the crayon-theme-editor-save AJAX action in versions 2.0 - 2.6.10. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to overwrite theme files.
The Crayon Syntax Highlighter Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the crayon-theme-editor-save AJAX action in versions 2.0 - 2.6.10. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to overwrite theme files.
The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 2.6.10 via the 'data-url' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, potentially outside the web root, which can contain sensitive inform...
The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 2.6.10 via the 'data-url' parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, potentially outside the web root, which can contain sensitive inform...
The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 1.13 via the crayon_is_php_file function. This allows unauthenticated attackers to include remote files on the server, resulting in code execution.
WordPress Crayon Syntax Highlighter plugin's "wp_load" parameter is prone to a remote file include vulnerability. It allows an attacker o compromise the application and the underlying system. Other attacks are also possible. Update the plugin.
The Crayon Syntax Highlighter plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 1.13 via the crayon_is_php_file function. This allows unauthenticated attackers to include remote files on the server, resulting in code execution.
The Crayon Syntax Highlighter plugin allows access to the AJAX method 'crayon-theme-editor-save' to any registered user. When called, the AJAX method ‘crayon-theme-editor-save’ will call the 'save' function within the CrayonThemeEditorWP class, defined in 'crayon-syntax-highlighter/...
The local file syntax highlighting feature of Crayon Syntax Highlighter doesn't check the path of the file to process. Also, by default, this feature is usable through public comments. This allows unauthenticated visitors to see the content of any file where the web server has read permissions, such as PHP source...
The Crayon Syntax Highlighter WordPress plugin was affected by a Remote File Inclusion security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free