Directory traversal

The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter...

CVE-2018-16299

CVE-2018-16299 : WordPress Localize My Post 1.0 is vulnerable to Local File Inclusion via the ajax/include.php parameter. The vulnerability stems from insufficient validation of the file parameter, enabling an attacker to read arbitrary server files. Affected: WordPress Localize My Post 1.0 plugi...

WordPress Frontier Post Plugin - Bypass

This plugin is prone to a publishing posts security bypass vulnerability. Solution Update this plugin...

Amazon Product In a Post Plugin - SQL Injection

amazon-product-in-a-post.php - this plugin takes raw user values and uses it delete from the database. This query can be manipulated to perform SQL injection attacks. Line 40: $tempswe = $wpdb-query"DELETE FROM $wpdb-prefixamazoncache WHERE Cacheid ='$wp-queryvars'appip-cache-id'' LIMIT 1;"; sqlm...

WordPress Tweet Old Post plugin <= 3.2.5 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Tweet Old Post plugin = 3.2.5 SQL Injection Vulnerability Date: 2011-09-05 Author: sherl0ck sherl0ck at alligatorteam dot org Software Link: http://downloads.wordpress.org/plugin/tweet-old-post.zip Version: 3.2.5 tested --------------- P...

Cross site scripting

Cross-site scripting XSS vulnerability in postalert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2011-5107

CVE-2011-5107 is an XSS in the WordPress plugin Alert Before Your Post (post_alert.php) affecting possibly version 0.1.1 and earlier. The vulnerability allows an attacker to inject arbitrary script via the name parameter, potentially affecting a user’s browser context. Remediation: update to the ...

WordPress Light Post Plugin 'abspath' Parameter Remote File Include Vulnerability

The Light Post WordPress Plugin is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...