Path traversal

The ad-inserter plugin before 2.4.20 for WordPress has path traversal...

Remote code execution

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution...

CVE-2019-15324

The CVE-2019-15324 entry concerns the WordPress plugin Ad Inserter prior to version 2.4.22, which is affected by a remote code execution vulnerability. Public records in multiple sources describe RCE in this plugin, with exploitation possible over the network and, in some disclosures, requiring a...

CVE-2019-15324

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution...

CVE-2019-15323

CVE-2019-15323 documents a path traversal vulnerability in the WordPress plugin Ad Inserter (before v2.4.20). The issue arises from insufficient input/path validation in the plugin, allowing traversal outside restricted directories. Affected: WordPress Ad Inserter plugin versions prior to 2.4.20....

CVE-2019-15323

The ad-inserter plugin before 2.4.20 for WordPress has path traversal...

PT-2019-14052 · WordPress · Ad Inserter

Name of the Vulnerable Software and Affected Versions: ad-inserter plugin versions prior to 2.4.20 Description: The issue allows for path traversal. Recommendations: For versions prior to 2.4.20, update to version 2.4.20 or later to resolve the issue...

WordPress Ad Inserter Plugin < 2.4.22 RCE Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112607";...

Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin was affected by an Authenticated Remote Code Execution security vulnerability. The nonce aicheck in the final request can be obtained by querying the homepage with the AIWPDEBUGGING cookie set to 2. Then, use an account with a role as lo...

Ad Inserter <= 2.4.21 - Authenticated Remote Code Execution

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin was affected by an Authenticated Remote Code Execution security vulnerability. PoC The nonce aicheck in the final request can be obtained by querying the homepage with the AIWPDEBUGGING cookie set to 2. Then, use an account with a role a...

WordPress Ad Inserter plugin <= 2.4.21 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability found by Sean Murphy WordFence in WordPress Ad Inserter plugin versions = 2.4.21. Solution Update the WordPress Ad Inserter plugin to the latest available version at least 2.4.22...

WordPress Ad Inserter plugin <= 2.4.19 - Authenticated Path Traversal vulnerability

Authenticated Path Traversal vulnerability found by Wilfried Becard in WordPress Ad Inserter plugin versions = 2.4.19. Solution Update the WordPress Ad Inserter plugin to the latest available version at least 2.4.20...

Ad Inserter <= 2.4.19 - Authenticated Path Traversal

Edit WPScanTeam: Even though the original advisory mentions that it only affect accounts with the administrator privilege, subscriber accounts and above can exploit the issue, as the nonce can be retrieved when submitting a request with a specific cookie, as described at...

WordPress Smart Google Code Inserter plugin <= 3.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Benjamin Lim in WordPress Smart Google Code Inserter plugin versions = 3.4. Solution Update the WordPress Smart Google Code Inserter plugin to the latest available version at least 3.5...

WordPress Oturia Smart Google Code Inserter Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Oturia Smart Google Code Inserter plugin is used in one of the meta-tagging validation to add plug-ins. A SQL...

WordPress Oturia Smart Google Code Inserter plugin authentication bypass vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Oturia Smart Google Code Inserter plugin is used in one of the meta-tagging validation to add plug-ins. An...

WordPress Smart Google Code Inserter plugin <=3.4 - Authorization bypass vulnerability

Authorization bypass vulnerability found by Benjamin Lim in WordPress Smart Google Code Inserter plugin versions =3.4. Solution Update the WordPress Smart Google Code Inserter plugin to the latest available version at least version 3.5...

WordPress Plugin Smart Google Code Inserter 3.5 - Authentication Bypass SQL Injection

WordPress Plugin Smart Google Code Inserter 3.5 - Authentication Bypass SQL Injection Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/...

WordPress Smart Google Code Inserter plugin <=3.4 - SQL injection (SQLi) vulnerability

SQL injection SQLi vulnerability found by Benjamin Lim in WordPress Smart Google Code Inserter plugin versions =3.4. Plugin function saveGoogleAdWords function in smartgooglecode.php file passes unsanitized $POST"oId" input into the SQL query. Solution Update the WordPress Smart Google Code...

WordPress Smart Google Code Inserter SQL Injection

Exploit Title: Smart Google Code Inserter 3.5 - Auth Bypass/SQLi Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/ Date: 26-Nov-17 Exploit Author: Benjamin Lim Vendor Homepage: http://oturia.com/ Software Link: https://wordpress.org/plugins/smart-google-code-inserter/ Version: 3.4...