WordPress Plugin Creative Contact Form 0.9.7 - Arbitrary File Upload

========================================================== "Creative Contact Form - The Best WordPress Contact Form Builder" - Arbitrary File Upload Author: Gianni Angelozzi Date: 08/10/2014 Remote: Yes Vendor Homepage: https://profiles.wordpress.org/creative-solutions-1/ Software Link:...

WordPress Contact Form 7 Integrations Multiple Cross Site Scripting Vulnerabilities

WordPress Contact Form 7 Integrations is prone to multiple cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

CVE-2014-6445

Multiple cross-site scripting XSS vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 uE or 2 uC parameter...

CVE-2014-6445

CVE-2014-6445 concerns the WordPress plugin Contact Form 7 Integrations (includes/toAdmin.php) with multiple XSS vulnerabilities in versions 1.0–1.3.10. The flaws allow remote attackers to inject arbitrary script/HTML via the uE or uC parameters. Public references (NVD, WPVulndb, OpenVAS entries,...

WordPress Contact Form DB Plugin <= 2.8.15 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "form" or "enc" parameter. Solution Update the plugin...

Two XSS in Contact Form DB WordPress plugin

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Contact Form DB WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin installed. 1 Two Cross-Site Scripting XSS...

WordPress Contact Form 7 Integrations Plugin <= 1.3.10 - Multiple XSS

Because of these vulnerabilities in includes/toAdmin.php, the attackers can inject arbitrary web script or HTML via the "uE" or "uC" parameter. Solution Update the plugin...

CSRF, XSS Vulnerabilities Afflict Wordpress Plugins

A smattering of bugs, mostly cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities, have been plaguing at least eight different WordPress plugins as of late. A security researcher going by the pseudonym Voxel@Night published on Monday information regarding the...

WordPress Contact Form Plugin Cross Site Scripting Vulnerability

WordPress Contact Form Plugin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Contact Form 7 <= 3.5.2 - File Upload Remote Code Execution

The Contact Form 7 WordPress plugin was affected by a File Upload Remote Code Execution security vulnerability...

Contact Form 7 <= 3.7.1 - CAPTCHA Bypass

The Contact Form 7 WordPress plugin was affected by a CAPTCHA Bypass security vulnerability...

Quick Contact Form 6.2 - Unspecified XSS

The Quick Contact Form WordPress plugin was affected by an Unspecified XSS security vulnerability...

ThinkIT <= 0.3 - wp-admin/admin.php Contact Form Deletion CSRF

The ThinkIT WP Contact Form WordPress plugin was affected by a wp-admin/admin.php Contact Form Deletion CSRF security vulnerability...

Usernoise 3.7.8 - Feedback Submission summary Field XSS

The Usernoise modal feedback / contact form WordPress plugin was affected by a Feedback Submission summary Field XSS security vulnerability...

Contact Form 3.36 - contact_form.php cntctfrm_contact_email Parameter XSS

The Contact Form by BestWebSoft WordPress plugin was affected by a contactform.php cntctfrmcontactemail Parameter XSS security vulnerability...

Contact Form <= 2.7.5 - SQL Injection

The contact-form-wordpress WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress Contact Form 7 Plugin <= 3.5.2 - Remote Code Execution

Because of this vulnerability, attackers with admin access add uploader tag into contact form at the site and use it for CE via AFU attack. Solution Update the plugin...

CVE-2014-4718

Multiple cross-site request forgery CSRF vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that 1 add Super users via a request to admin/usercreate.php or conduct cross-site scripting XSS attacks via the 2 email or 3 subje...

CVE-2014-4518

Cross-site scripting XSS vulnerability in xdresize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter...

CVE-2014-4518

Cross-site scripting XSS vulnerability in xdresize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter...