27 matches found
WordPress Invite Anyone plugin <=1.3.18 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability found in WordPress Invite Anyone plugin versions =1.3.18. Solution Update the WordPress Invite Anyone plugin to the latest available version at least version 1.3.19...
WordPress Invite Anyone plugin <=1.3.15 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability
WordPress Invite Anyone plugin Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities were found in 1.3.15 version. The settings are passed without any sanitization to function registersetting. Solution Update the plugin...
WordPress Invite Anyone Plugin Security Bypass Vulnerability
WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Invite Anyone is one of the invitation components. A security bypass vulnerability exists in the by-email/by-email.php...
Code injection
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...
CVE-2017-6955
An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...
CVE-2017-6955
The CVE-2017-6955 vulnerability affects the WordPress plugin Invite Anyone, specifically by-email/by-email.php in versions prior to 1.3.15. An authenticated or sufficient-privileges user can modify the subject and body of the invitation email, which should be immutable, facilitating social engine...
