plugin
33 known security issues reported for the Wptouch WordPress plugin. Most recent disclosed Jun 6, 2025.
Running Wptouch on your site? Check whether your installed version is affected.
Scan your site free[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch allows Stored XSS. This issue affects WPtouch: from n/a through 4.3.60.
The WPtouch plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that...
[en] The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
[en] The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
The WPtouch plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.3.44 via deserialization of untrusted input when importing settings. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present vi...
The WPtouch plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation when uploading images in versions up to, and including, 4.3.44. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arbitrary files on the affected sites...
Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScan in WordPress WPtouch plugin (versions <= 4.3.42). Update the WordPress WPtouch plugin to the latest available version (at least 4.3.44).
The WPtouch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 4.3.42. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succes...
The WPtouch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 4.3.42. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succes...
The WPtouch plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.7.5.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The WPtouch plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.7.5.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The WPTouch plugin for WordPress is vulnerable to an open redirect in versions before 3.7. This allows attackers to use a trusted site to trick victims into being redirected to an untrusted site.
The WPTouch plugin for WordPress is vulnerable to an open redirect in versions before 3.7. This allows attackers to use a trusted site to trick victims into being redirected to an untrusted site.
This plugin is prone to an unvalidated open redirection vulnerability. Update the plugin.
The WPtouch plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 3.4.2. This is due to the 'admin_initialize()' method being called by the 'admin_init' hook and a lack of capability checks on the function. This makes it possible for authenticated attackers to upload a backdoor,...
The WPtouch plugin for WordPress is vulnerable to Open Redirect in versions before 1.9.30. This is due to insufficient input sanitization via the 'wptouch_redirect' parameter. This makes it possible for attackers to construct a URL which causes a redirection to an arbitrary external domain.
Because of this vulnerability, a logged-in attacker can potentially take over the website by uploading a backdoor and then do anything he wants. Update the plugin.
The WPtouch plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 3.4.2. This is due to the 'admin_initialize()' method being called by the 'admin_init' hook and a lack of capability checks on the function. This makes it possible for authenticated attackers to upload a backdoor,...
The WPtouch plugin for WordPress is vulnerable to Open Redirect in versions before 1.9.30. This is due to insufficient input sanitization via the 'wptouch_redirect' parameter. This makes it possible for attackers to construct a URL which causes a redirection to an arbitrary external domain.
This plugin is prone to an SQL injection vulnerability in include/submit.php parameter. Update the plugin.
This plugin is prone to a remote code execution in ajax/file_upload.php. Update the plugin.
[en] SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
This WordPress WPtouch plugin is prone to an URL redirection vulnerability.
[en] Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php. NOTE: some of these details are obtained from third party info...
Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php.
The plugin does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting
The WPtouch WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
The WPtouch WordPress plugin was affected by an Unvalidated Open Redirect security vulnerability.
The WPtouch WordPress plugin was affected by a 'wptouch_redirect' Parameter URI Redirection security vulnerability.
The WPtouch WordPress plugin was affected by an ajax/file_upload.php Crafted Content-Type File Upload Remote Code Execution security vulnerability.
The WPtouch WordPress plugin was affected by an include/submit.php Multiple Parameter SQL Injection security vulnerability.
The WPtouch WordPress plugin was affected by an Insecure Nonce Generation security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free