WordPress Plugin BuddyPress Activity Plus 1.5 - Cross-Site Request Forgery

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

WordPress BuddyPress Activity Plus Plugin 1.5 - CSRF

BuddyPress Activity Plus plugin is prone to a cross-site request forgery that allows an attacker to delete any file which PHP process can delete. Solution Upgrade the plugin...

WordPress BuddyPress Activity Plus 1.5 CSRF / File Deletion

Details ================ Software: BuddyPress Activity Plus Version: 1.5 Homepage: http://wordpress.org/plugins/buddypress-activity-plus/ Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/ CVE: Awaiting assignment CVSS: 8.5 High;...

BuddyPress Activity Plus <= 1.5 - Cross-Site Request Forgery (CSRF)

The BuddyPress Activity Plus WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...

WordPress BuddyPress Plugin <= 1.2.9 - SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

WordPress BuddyPress Plugin <= 1.7.1 - Multiple SQL Injections

This plugin is prone to multiple SQL injections. Solution Update the plugin...

rtMedia for WordPress, BuddyPress & bbPress 3.7.39 - SQL Injection

When initialized, the rtMedia will include and instantiate certain classes if BuddyPress is installed. One of these classes is RTMediaActivityUpgrade, contained within the file ‘app/importers/RTMediaActivityUpgrade.php’. This class is instantiated in the file ‘admin/RTMediaAdmin.php,’ line 110, i...

rtMedia for WordPress, BuddyPress & bbPress 3.7.39 - SQL Injection

When initialized, the rtMedia will include and instantiate certain classes if BuddyPress is installed. One of these classes is RTMediaActivityUpgrade, contained within the file ‘app/importers/RTMediaActivityUpgrade.php’. This class is instantiated in the file ‘admin/RTMediaAdmin.php,’ line 110, i...

BuddyPress Extended Friendship Request - wp-admin/admin-ajax.php friendship_request_message Parameter XSS

The BuddyPress Extended Friendship Request WordPress plugin was affected by a wp-admin/admin-ajax.php friendshiprequestmessage Parameter XSS security vulnerability...

Buddypress <= 1.9.1 - Crafted bp_new_group_id Cookie Arbitrary Group Manipulation

The BuddyPress WordPress plugin was affected by a Crafted bpnewgroupid Cookie Arbitrary Group Manipulation security vulnerability...

BuddyPress 1.2.9 - SQL Injection

The BuddyPress WordPress plugin was affected by a SQL Injection security vulnerability...

Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)

The BuddyPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

BuddyPress 1.7.1 - Multiple SQL Injections

The BuddyPress WordPress plugin was affected by a Multiple SQL Injections security vulnerability...

Wordpress Buddypress Plugin 1.9.1 - Privilege Escalation

No description provided by source. Exploit Title: Wordpress plugin Buddypress = 1.9.1 privilege escalation Date: 11/02/2014 Exploit Author: Pietro Oliva Vendor Homepage: http://buddypress.org Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip Version: 1.9.1 CVE :...

Buddypress plugin of Wordpress remote SQL Injection

No description provided by source. Exploit Title: Buddypress plugin of Wordpress remote SQL Injection Date: March 31, 2012 Author: Ivan Terkin Exploitation: Remote Exploit Bug: Remote SQL Injection Software Link: buddypress.org Version: till 1.5.5 Tested on: Buddypress 1.5.4 POST /wp-load.php...

Wordpress plugin Buddypress &lt;= 1.9.1 privilege escalation vulnerability

Vulnerability: Wordpress plugin Buddypress = 1.9.1 privilege escalation Date: 13/02/2014 Author: Pietro Oliva Vendor Homepage: http://buddypress.org Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip Version: 1.9.1 CVE : CVE-2014-1889 Responsibly disclosed and patched in...

Wordpress plugin Buddypress &lt;= 1.9.1 stored xss vulnerability

Vulnerability: Wordpress plugin Buddypress = 1.9.1 stored xss Date: 13/02/2014 Author: Pietro Oliva Vendor Homepage: http://buddypress.org Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip Version: 1.9.1 CVE : CVE-2014-1888 Responsibly disclosed and patched in version 1.9....

CVE-2014-1888

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

Cross site scripting

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

CVE-2014-1888

CVE-2014-1888 affects the BuddyPress plugin for WordPress up to version 1.9.1. It is a stored XSS in the group-details form: an attacker can inject script via the group name field in /groups/create/step/group-details/. The note indicates this can be exploited without authentication by leveraging ...