CVE-2014-9437

Multiple cross-site request forgery CSRF vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attacks via...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attacks via...

CVE-2014-9442

SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...

PT-2015-4217

Name of the Vulnerable Software and Affected Versions Simple Sticky Footer plugin versions prior to 1.3.3 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for...

PT-2015-4204

Name of the Vulnerable Software and Affected Versions Lightbox Photo Gallery plugin version 1.0 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting XSS...

PT-2015-4205

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the q parameter in a promotionProductSearch action to the...

PT-2015-4223

Name of the Vulnerable Software and Affected Versions WP-ViperGB plugin versions prior to 1.3.11 Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting XSS attacks. This c...

PT-2015-4224

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.4 Description The issue allows remote authenticated users to read arbitrary files due to a directory traversal vulnerability. This is achieved by using a .. dot dot in the member download action to the...

CVE-2014-9441: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 simplehoverback, 2 simplehovertext, 3...

CVE-2014-9400

CVE-2014-9400 concerns the WordPress plugin “WP Unique Article Header Image” (version 1.0 and earlier). The connected sources confirm CSRF vulnerabilities that allow an attacker to hijack an administrator’s authentication for requests leading to cross-site scripting (XSS) via the parameters gt_de...

PT-2014-8988

Name of the Vulnerable Software and Affected Versions twimp-wp plugin for WordPress affected versions not specified Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks...

PT-2014-8985

Name of the Vulnerable Software and Affected Versions WordPress PWGRandom plugin version 1.11 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the pwgrandom tit...

PT-2014-8989

Name of the Vulnerable Software and Affected Versions Twitter LiveBlog plugin versions 1.1.2 and earlier for WordPress Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS...

PT-2014-8991

Name of the Vulnerable Software and Affected Versions Wp Unique Article Header Image plugin version 1.0 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the gt...

PT-2014-8984

Name of the Vulnerable Software and Affected Versions Post to Twitter plugin versions 0.7 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the idptt twitter...

PT-2014-8986

Name of the Vulnerable Software and Affected Versions Simplelife plugin versions 1.2 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the simplehoverback,...

CVE-2014-9394: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 pwgrandomtitle or 2 pwgrandomcategory paramete...

CVE-2014-9399: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the tweetscribeusername parameter in a save action in the...

CVE-2014-9401: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the lpapostletters parameter in the...