CVE-2022-2091

The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack...

CVE-2022-2091

The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF attack...

WordPress plugin Cache Images 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

The vulnerability of the `unsplash_download_w` and `unsplash_download_h` parameters in the Instant Images One Click plugin of the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the unsplashdownloadw and unsplashdownloadh parameters in the “One Click for Instant Images” plugin of the WordPress content management system is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability could allow a malicious...

WordPress WP SVG images plugin <= 3.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via uploaded SVG file

Authenticated Stored Cross-Site Scripting XSS vulnerability via uploaded SVG file discovered by Rasi in WordPress WP SVG images plugin versions = 3.3. Solution Update the WordPress WP SVG images plugin to the latest available version at least 3.4...

CVE-2021-24334

The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplashdownloadw and unsplashdownloadh parameter settings /wp-admin/upload.php?page=instant-images, only validating them client side before saving them, leading to a Stored...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . Instant Images - One Click Unsplash Uploads A security...

CVE-2017-18561

The CVE-2017-18561 entry concerns the WordPress plugin embed-comment-images with an XSS vulnerability in versions before 0.6. Connected sources consistently describe Cross-Site Scripting in this plugin, evidenced by references noting XSS and a PoC demonstrating an image tag-based vector (e.g., un...

VulnCheck KEV: CVE-2019-14206

An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST'adaptive-images-settings' parameter in adaptive-images-script.php...

CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2018-6194

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

Design/Logic Flaw

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2018-6194

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6195

CVE-2018-6195 affects the WordPress plugin wp-splashing-images prior to 2.1.1. An authenticated user (administrator, editor, or author) can exploit PHP Object Injection by sending crafted serialized data in the session parameter to wp-admin/upload.php, allowing remote code execution-like impact. ...

CVE-2018-6194

The CVE-2018-6194 entry describes a Cross-Site Scripting (XSS) vulnerability in WordPress Splashing Images plugin (wp-splashing-images) versions before 2.1.1. The flaw is in admin/partials/wp-splashing-admin-sidebar.php where the search parameter is echoed directly into the value attribute of an ...

thefilmlot.com XSS vulnerability

Vulnerable URL: http://thefilmlot.com/tflblogwp/wp-content/plugins/popup-images/popup.php?z=http://thefilmlot.com/tflblogwp/blogimages/Biff07/drunkpubbig.jpg=504=706=%22/%3E%3CsvG/OnLoad=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.10.2017...

abc.se XSS vulnerability

Vulnerable URL: https://www.abc.se/kansli/wordpress/wp-content/plugins/popup-images/popup.php/popup.php?z=http://www.abc.se/kansli/wordpress/wp-content/uploads/2007/10/svenwickberg.jpg=269=363=%22/%3E%3CsvG/onLoad=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at...

WordPress plugin Pixabay Images arbitrary file write vulnerability (CNVD-2015-00815)

The Pixabay Images plugin is a plugin that supports the insertion of selected CC0 public domain photos from Pixabay an image material sharing network anywhere in the blog. An arbitrary file write vulnerability exists in versions of the WordPress plugin Pixabay Images prior to 2.4, which allows...

CVE-2015-1375

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files...