35966 matches found
CVE-2015-9367
The CVE-2015-9367 entry concerns the WordPress ecosystem: the Easy Canadian Sales Taxes Add-on for iThemes Exchange is vulnerable to cross‑site scripting (XSS) through add_query_arg()/remove_query_arg() in versions before 1.1.0. The underlying issue is improper handling of query parameters that c...
CVE-2015-9366
CVE-2015-9366 affects the Custom URL Tracking Add-on for iThemes Exchange (WordPress) prior to version 1.1.0. The vulnerability is an XSS via add_query_arg() and remove_query_arg(). The NVD data lists CVSSv2 base score 4.3 (MEDIUM) with I:P and A:N, and CVSSv3 base score 6.1 (MEDIUM) with I:L, C:...
CVE-2015-9365
The CVE-2015-9365 entry concerns the WordPress plugin component: Authorize.net Add-on for iThemes Exchange, affected on versions before 1.1.0. The vulnerability is a cross-site scripting (XSS) issue exploitable via add_query_arg() and remove_query_arg(), as described in multiple sources (NVD entr...
CVE-2015-9364
CVE-2015-9364 affects the WordPress plugin component “2Checkout Add-on for iThemes Exchange.” It describes a Cross-Site Scripting (XSS) vulnerability via add_query_arg() and remove_query_arg() in versions before 1.1.0. The underlying issue is unsafe handling of query arguments in the plugin, enab...
CVE-2015-9363
CVE-2015-9363 : A cross-site scripting vulnerability affects WordPress via the iThemes Exchange plugin, reported to be present before version 1.12.0. The flaw is caused by improper handling of query arguments with add_query_arg() and remove_query_arg(), enabling injection of malicious scripts int...
CVE-2015-9362
CVE-2015-9362 concerns the WordPress Post Connector plugin prior to 1.0.4, where an XSS flaw exists through the use of add_query_arg() and remove_query_arg(). The vulnerability is in the Post Connector plugin for WordPress, which is affected by untrusted input that can be reflected in the page ou...
CVE-2015-9361
The CVE-2015-9361 entry concerns the WordPress Related Posts plugin (before 1.8.2). The vulnerability is a cross-site scripting (XSS) flaw triggered via add_query_arg() and remove_query_arg(), allowing injected client-side scripts. Affected component: Related Posts plugin for WordPress; root caus...
CVE-2015-9360
The CVE covers the UpdraftPlus WordPress backup plugin. Affected: UpdraftPlus plugin before version 1.9.64. Vulnerability: XSS via add_query_arg() and remove_query_arg(). Root cause: improper handling of query arguments enabling client-side script injection. Impact: cross-site scripting accessibl...
CVE-2015-9358
The feedwordpress WordPress plugin prior to 2015.0514 is affected by CVE-2015-9358: an XSS flaw exploitable via manipulated query arguments using add_query_arg() and remove_query_arg(). The vulnerability is described as a cross-site scripting issue impacting the plugin before the stated release, ...
CVE-2015-9357
The akismet plugin before 3.1.5 for WordPress has XSS...
CVE-2015-9356
CVE-2015-9356 concerns the WP-ViperGB WordPress plugin prior to version 1.3.16, where an XSS vulnerability exists via add_query_arg() and remove_query_arg(). The issue is distinct from CVE-2014-9460 and is documented across multiple sources in the connected set, including Red Hat and CVE records....
CVE-2015-9354
The gigpress plugin before 2.3.11 for WordPress has XSS...
CVE-2015-9354
CVE-2015-9354 concerns the WordPress plugin GigPress. The vulnerability is a cross-site scripting (XSS) flaw in GigPress up to version 2.3.11 (i.e., affected when using versions before 2.3.11). The underlying issue is a client-side script injection vulnerability within the plugin, enabling likely...
CVE-2015-9353
Affected software: WordPress GigPress plugin (before 2.3.11). Vulnerability: SQL injection in the admin area. Root cause: Improper handling of input in admin/handlers.php via the show_artist_id or show_venue_id parameters in an add action (gigpress.php) to wp-admin/admin.php. Impact: Remote authe...
RDoc -- multiple jQuery vulnerabilities
Ruby news: There are multiple vulnerabilities about Cross-Site Scripting XSS in jQuery shipped with RDoc which bundled in Ruby. All Ruby users are recommended to update Ruby to the latest release which includes the fixed version of RDoc. The following vulnerabilities have been reported...
CVE-2015-9351
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button...
CVE-2015-9348
CVE-2015-9348 affects the WordPress Sell Downloads plugin prior to version 1.0.8. The vulnerability arises from insufficient restrictions on brute-force guessing of purchase IDs, enabling an attacker to obtain purchase IDs. Multiple connected sources (Red Hat, CNVD, WPVulndb, NVD) corroborate thi...
CVE-2015-9344
The link-log plugin before 2.1 for WordPress has SQL injection...