CVE-2015-1582: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

PT-2015-5368

Name of the Vulnerable Software and Affected Versions Mobile Domain plugin version 1.5.2 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct cross-site scripting XSS attacks. Th...

PT-2015-5369

Name of the Vulnerable Software and Affected Versions Spider Facebook plugin versions prior to 1.0.11 Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters. Specifically, the appid parameter in a registration task to the default URI is...

PT-2015-5366

Name of the Vulnerable Software and Affected Versions Elegant Themes Divi theme for WordPress affected versions not specified Description A directory traversal issue exists in the Elegant Themes Divi theme for WordPress, allowing remote attackers to read arbitrary files. This is achieved by...

CVE-2015-1579: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

CVE-2015-1384

Cross-site scripting XSS vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannereffectdivid parameter in the BannerEffectOptions page to wp-admin/options-general.php...

PT-2015-5257

Name of the Vulnerable Software and Affected Versions Banner Effect Header plugin versions prior to 1.2.8 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the banner effect divid parameter in the BannerEffectOptions page to...

CVE-2015-1385

Cross-site scripting XSS vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmincategoryfeeds.php page to...

PT-2015-5262

Name of the Vulnerable Software and Affected Versions Photo Gallery plugin versions prior to 1.2.11 for WordPress Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the asc or desc parameter in a create gallery request in the "galleries...

CVE-2015-1204

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

PT-2015-5162

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2 Description A cross-site scripting XSS issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fsresource...

CVE-2015-1204: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

WordPress Photo Gallery Plugin <= 1.2.7 - SQL Injection

Because of this vulnerability, attackers to execute arbitrary SQL commands via the "orderby parameter" in a GalleryBox action to wp-admin/admin-ajax.php. Solution Update the plugin...

CVE-2015-1055: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the orderby parameter in a GalleryBox action to wp-admin/admin-ajax.php...

PT-2015-3981

Name of the Vulnerable Software and Affected Versions WordPress Pods plugin versions prior to 2.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to "wp-admin/admin.php"...

PT-2015-3982

Name of the Vulnerable Software and Affected Versions Pods plugin versions prior to 2.5 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including conducting cross-site scripting XSS attacks, deleting pods, resetting...

CVE-2014-7957: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 conduct cross-site scripting XSS attacks via the toggled parameter in a toggle action in the pods-componen...

CVE-2014-7956: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php...

PT-2015-4280

Name of the Vulnerable Software and Affected Versions MyWebsiteAdvisor Simple Security plugin versions 1.1.5 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the datefilter parameter in the "access log" page to...

CVE-2014-9570: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefilter parameter in the accesslog page to wp-admin/users.php or 2 simplesecurityipblacklist...