CVE-2017-18544

The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF...

CVE-2017-18544: Cross-Site Request Forgery (CSRF)

The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF...

CVE-2017-18545: Improper Input Validation

The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input...

CVE-2017-18543: Improper Access Control

The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations...

WordPress Invite Anyone plugin <=1.3.18 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability found in WordPress Invite Anyone plugin versions =1.3.18. Solution Update the WordPress Invite Anyone plugin to the latest available version at least version 1.3.19...

WordPress Invite Anyone plugin <=1.3.15 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability

WordPress Invite Anyone plugin Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities were found in 1.3.15 version. The settings are passed without any sanitization to function registersetting. Solution Update the plugin...

WordPress Invite Anyone Plugin Security Bypass Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Invite Anyone is one of the invitation components. A security bypass vulnerability exists in the by-email/by-email.php...

Code injection

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...

CVE-2017-6955

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...

CVE-2017-6955

The CVE-2017-6955 vulnerability affects the WordPress plugin Invite Anyone, specifically by-email/by-email.php in versions prior to 1.3.15. An authenticated or sufficient-privileges user can modify the subject and body of the invitation email, which should be immutable, facilitating social engine...

Invite Anyone <= 1.3.14 - Change of Email Invitation Content

The Invite Anyone WordPress plugin was affected by a Change of Email Invitation Content security vulnerability...

CVE-2017-6955: Improper Input Validation

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...