Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0

Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124 Download Site: https://wordpress.org/plugins/se-html5-album-audio-player/ Vendor:...

WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal

Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124 Download Site: https://wordpress.org/plugins/se-html5-album-audio-player/ Vendor:...

WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal

WordPress Plugin SE HTML5 Album Audio Player 1.1.0 - Directory Traversal Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124 Download Site:...

WordPress SE HTML5 Album Audio Player 1.1.0 Directory Traversal Vulnerability

WordPress SE HTML5 Album Audio Player plugin version 1.1.0 suffers from a traversal vulnerability. Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124...

WordPress SE HTML5 Album Audio Player 1.1.0 Directory Traversal

Title: Path Traversal vulnerability in Wordpress plugin se-html5-album-audio-player v1.1.0 Author: Larry W. Cashdollar, @larry0 Date: 2015-06-06 Advisory: http://www.vapid.dhs.org/advisory.php?v=124 Download Site: https://wordpress.org/plugins/se-html5-album-audio-player/ Vendor:...

SE HTML5 Album Audio Player <= 1.1.0 - Local File Include

The se-html5-album-audio-player v1.1.0 plugin for wordpress has a local file include vulnerability. The downloadaudio.php file does not check to see if the user is authenticated, it only attempts to check if the path is in /wp-content/uploads which is easily defeated with ../...

SE HTML5 Album Audio Player <= 1.1.0 - Local File Include

The se-html5-album-audio-player v1.1.0 plugin for wordpress has a local file include vulnerability. The downloadaudio.php file does not check to see if the user is authenticated, it only attempts to check if the path is in /wp-content/uploads which is easily defeated with ../. PoC...

WordPress Haiku Minimalist Audio Player Plugin <= 1.1.0 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in jPlayer.swf. Solution Update the plugin...

WordPress Plugin WonderPlugin Audio Player Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WonderPlugin Audio Player is one of the audio player plugin. WordPress WonderPlugin Audio Player plugin 2.0 and...

CVE-2015-2218

Multiple cross-site scripting XSS vulnerabilities in the wpajaxsaveitem function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 itemname or 2 itemcustomcss parameter in a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the wpajaxsaveitem function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 itemname or 2 itemcustomcss parameter in a...

CVE-2015-2218

Multiple cross-site scripting XSS vulnerabilities in the wpajaxsaveitem function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 itemname or 2 itemcustomcss parameter in a...

CVE-2015-2218

CVE-2015-2218 affects WonderPlugin Audio Player for WordPress (plugin versions before 2.1). The vulnerability is a set of cross-site scripting (XSS) flaws in the wp_ajax_save_item function and related admin paths, allowing remote attackers to inject arbitrary script or HTML via parameters: item[n...

WordPress Audio Player Plugin <= 2.0 - Multiple XSS

Because of these vulnerabilities in the wpajaxsaveitem function, the attackers can inject arbitrary web script or HTML via the "itemname" or "itemcustomcss" parameters in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php. Solution Upgrade the plugin...

Multiple SQL Injection Vulnerabilities in WordPress Plugin WonderPlugin Audio Player

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple SQL injection vulnerabilities in the WordPress plugin WonderPlugin Audio Player allow remote authenticated users to...

CVE-2015-2199

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

Sql injection

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

CVE-2015-2199

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

CVE-2015-2199

The CVE-2015-2199 issue affects the WonderPlugin Audio Player WordPress plugin (before 2.1). Multiple SQL injection flaws allow remote unauthenticated/authenticated actors to execute arbitrary SQL commands via item[id] in wonderplugin_audio_save_item (AJAX at wp-admin/admin-ajax.php) or via itemi...

WordPress Audio Player Plugin <= 2.0 - Multiple SQL Injection

Because of these vulnerabilities, the administrators can execute arbitrary SQL commands via the "itemid" parameter in the wonderpluginaudioshowitem. Also, an authenticated user can execute arbitrary SQL commands via the "itemid" parameter in a wonderpluginaudiosaveitem action to...