Jetpack <= 3.9.1 - LaTeX HTML Element XSS

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a LaTeX HTML Element XSS security vulnerability...

WordPress Jetpack Plugin <= 3.9.1 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Magento the presence of XSS vulnerability, the online Mall may be the attacker's control-the vulnerability warning-the black bar safety net

Magento is an open source e-Commerce system, is a major business-oriented application, The processing of e-Commerce needs, including shopping, shipping, product reviews, etc., and ultimately for the construction of a multipurpose and wide application of e-Commerce websites to provide help. Magent...

Automattic: Possible Timing Side-Channel in XMLRPC Verification

https://github.com/Automattic/jetpack/blob/bc7a4541ef6f0e9f583376d801ab0c40cfb976c3/class.jetpack-xmlrpc-server.phpL115 I mentioned this to @daljo628 and he suggested submitting it here instead. This looks very much like a classic timing attack vulnerability. The fix would be to use hashequals...

WordPress Jetpack Plugin Security Patch

After a few critical bugs were recently discovered and patched in the core WordPress engine—a rarity with WordPress-related security issues—order has apparently been restored with the discovery of a critical vulnerability in a popular plugin. Insecure plugins have been at the heart of numerous...

Jetpack <= 3.7.0 - Information Disclosure

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by an Information Disclosure security vulnerability...

WordPress Jetpack Plugin <= 3.7.0 - Stored Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Jetpack Plugin <= 3.7.0 - Information Disclosure

This plugin is prone to an information disclosure vulnerability in certain hosting configurations. Solution Update the plugin...

Jetpack <= 3.7.0 - Stored Cross-Site Scripting (XSS)

Jetpack versions 3.7.0 and earlier are vulnerable to a cross-site scripting vulnerability in the contact form due to improper input sanitization. Reported by Marc-Alexandre Montpas from Sucuri...

WordPress example.html 跨站脚本漏洞

知道创宇安全研究团队 Evi1m0 ：2015.5.7概要WordPress 被爆 DOM XSS 漏洞，数百万站点受影响，该漏洞存在于 WordPress 流行的 Genericons example.html 页面中，默认主题 Twenty Fifteen 及知名插件 Jetpack 都内置了该页面，经过分析发现原来是 example.html 使用了存在 DOM XSS 漏 洞的 jQuery老版本 。11 年 dmethvin 提交 jQuery 1.6.1 版本的 Ticket 9521 , 其原因是由 $ | jQuery 预期的 CSS 选择器在其他情况下可以用于创建 HT...

The default WordPress Theme the presence of DOM XSS（cross-site scripting vulnerability affecting millions of users-vulnerability warning-the black bar safety net

! The use of the Genericons package of WordPress plugin or theme are likely to be affected by a DOM-basedXSSvulnerability, because of WordPress default theme Twenty Fifteen 及 知名 插件 Jetpack 都 包含 了 存在 漏洞 的 页面 example.html that affect millions of users. Vulnerability causes Any use of the genericons...

Vulnerabilities Identified in Two WordPress Plugins

The last few months have seen a significant uptick in WordPress plugin vulnerabilities, and judging by advisories issued this week regarding another another pair of insecure plugins, the trend will likely continue for the time being. The first vulnerability, discovered by security firm High Tech...

WordPress Vulnerability Puts Millions of Websites At Risk

Millions of WordPress websites are at risks of being completely hijacked by the hackers due to a critical cross-site scripting XSS vulnerability present in the default installation of the widely used content management system. The cross-site scripting XSS vulnerability, uncovered by the security...

WordPress Jetpack Plugin <= 3.5.2 - Cross Site Scripting

This plugin is prone to an unauthenticated DOM cross site scripting vulnerability. Solution Update the plugin...

Jetpack <= 3.5.2 - Unauthenticated DOM Cross-Site Scripting (XSS)

Genericons...

Jetpack <= 3.5.2 - Unauthenticated DOM Cross-Site Scripting (XSS)

Genericons = 3.2 vulnerable to DOM XSS in the example.html file due to using outdated version of jQuery and vulnerable code. Vulnerable Code: permalink = "genericon-" + window.location.hash.split''1; cssclass = jQuery '.' + permalink .attr'class'; PoC...

Jetpack 3.0-3.4.2 - Cross-Site Scripting (XSS)

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress Jetpack Plugin <= 3.4.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

Jetpack <= 2.9.2 - class.jetpack.php XML-RPC Access Control Bypass

The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a class.jetpack.php XML-RPC Access Control Bypass security vulnerability...

WordPress jetpack Plugin - 'sharedaddy.php' ID SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress jetpack plugin SQL Injection Vulnerability Date: 2011-19-11 Author: longrifle0x software: Wordpress Download:http://wordpress.org/extend/plugins/jetpack/ Tools: SQLMAP DESCRIPTION Discovered a vulnerability in jetpack, Wordpress Plugin,...