CVE-2014-6445

CVE-2014-6445 concerns the WordPress plugin Contact Form 7 Integrations (includes/toAdmin.php) with multiple XSS vulnerabilities in versions 1.0–1.3.10. The flaws allow remote attackers to inject arbitrary script/HTML via the uE or uC parameters. Public references (NVD, WPVulndb, OpenVAS entries,...

WordPress Contact Form DB Plugin <= 2.8.15 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "form" or "enc" parameter. Solution Update the plugin...

Two XSS in Contact Form DB WordPress plugin

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in Contact Form DB WordPress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks against administrator of a WordPress website with vulnerable plugin installed. 1 Two Cross-Site Scripting XSS...

WordPress Contact Form 7 Integrations Plugin <= 1.3.10 - Multiple XSS

Because of these vulnerabilities in includes/toAdmin.php, the attackers can inject arbitrary web script or HTML via the "uE" or "uC" parameter. Solution Update the plugin...

CSRF, XSS Vulnerabilities Afflict Wordpress Plugins

A smattering of bugs, mostly cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities, have been plaguing at least eight different WordPress plugins as of late. A security researcher going by the pseudonym Voxel@Night published on Monday information regarding the...

WordPress Contact Form Plugin Cross Site Scripting Vulnerability

WordPress Contact Form Plugin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Contact Form 7 <= 3.5.2 - File Upload Remote Code Execution

The Contact Form 7 WordPress plugin was affected by a File Upload Remote Code Execution security vulnerability...

Contact Form 7 <= 3.7.1 - CAPTCHA Bypass

The Contact Form 7 WordPress plugin was affected by a CAPTCHA Bypass security vulnerability...

Quick Contact Form 6.2 - Unspecified XSS

The Quick Contact Form WordPress plugin was affected by an Unspecified XSS security vulnerability...

ThinkIT <= 0.3 - wp-admin/admin.php Contact Form Deletion CSRF

The ThinkIT WP Contact Form WordPress plugin was affected by a wp-admin/admin.php Contact Form Deletion CSRF security vulnerability...

Usernoise 3.7.8 - Feedback Submission summary Field XSS

The Usernoise modal feedback / contact form WordPress plugin was affected by a Feedback Submission summary Field XSS security vulnerability...

Contact Form 3.36 - contact_form.php cntctfrm_contact_email Parameter XSS

The Contact Form by BestWebSoft WordPress plugin was affected by a contactform.php cntctfrmcontactemail Parameter XSS security vulnerability...

Contact Form <= 2.7.5 - SQL Injection

The contact-form-wordpress WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress Contact Form 7 Plugin <= 3.5.2 - Remote Code Execution

Because of this vulnerability, attackers with admin access add uploader tag into contact form at the site and use it for CE via AFU attack. Solution Update the plugin...

CVE-2014-4718

Multiple cross-site request forgery CSRF vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that 1 add Super users via a request to admin/usercreate.php or conduct cross-site scripting XSS attacks via the 2 email or 3 subje...

CVE-2014-4518

Cross-site scripting XSS vulnerability in xdresize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter...

CVE-2014-4518

Cross-site scripting XSS vulnerability in xdresize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter...

CVE-2014-4518

CVE-2014-4518 is a cross-site scripting vulnerability in the WordPress Contact Form Plugin (ContactMe.com)

Ripe Website Manager 0.8.4 contact/index.php ripeformpost Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/23597/info html headtitleRipe Website Manager = 0.8.4 - Cross-Site Scripting and SQL Injection Exploit/titlebody centerbrbrfont size=4Ripe Website Manager = 0.8.4 - Cross-Site Scripting and SQL Injection Exploit/fontbrfon...

WordPress Easy Contact Form Lite Plugin <= 1.0.7 - SQL Injection

No description provided by source. Exploit Title: WordPress Easy Contact Form Lite plugin = 1.0.7 SQL Injection Vulnerability Date: 2011-08-17 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/easy-contact-form-lite.zip Version:...