401 matches found
CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
CVE-2019-11869
The Yuzo Related Posts plugin for WordPress (versions prior to 5.12.94 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is a logic flaw where the plugin incorrectly assumes that the is_admin() function verifies the identity of the requester; in reality, it only checks if the request...
CVE-2019-11869: Improper Neutralization of Input During Web Page Generation
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
VulnCheck KEV: CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
PT-2019-12530
Name of the Vulnerable Software and Affected Versions Yuzo Related Posts plugin version 5.12.94 Description The issue arises from the plugin mistakenly assuming that the is admin function verifies the request origin as an admin user, when in fact it only checks if the request is for an admin page...
Users Urged to Uninstall WordPress Yuzo Plugin After Flaw Exploited
UPDATE Users of the popular Yuzo Related Posts plugin are being urged to uninstall the plugin after a flaw was discovered being exploited in the wild – putting tens of thousands of websites at risk. Yuzo Related Posts, which enables WordPress websites to display “related posts” segments, is...
WordPress Yuzo Related Posts plugin <=5.12.91 - Broken authentication
Broken authentication and session management allows unauthenticated call any action or update any option on WordPress Yuzo Related Posts plugin versions =5.12.91. Solution 10 April 2019 - this plugin was closed and is no longer available for download...
PT-2017-15230
Name of the Vulnerable Software and Affected Versions Captcha versions prior to 4.3.0 Car Rental versions prior to 1.0.5 Contact Form Multi versions prior to 1.2.1 Contact Form versions prior to 4.0.6 Contact Form to DB versions prior to 1.5.7 Custom Admin Page versions prior to 0.1.2 Custom Fiel...
WordPress Relevant Related Posts 1.0.7 Cross Site Scripting Vulnerability
WordPress Relevant Related Posts plugin version 1.0.7 suffers from a cross site scripting vulnerability. WordPress Relevant Related Posts 1.0.7 Cross Site Scripting Plugin Name : Relevant Related Posts Plugin Effected Version : 1.0.7 and most probably lower version's if any Vulnerability :...
WordPress Relevant Related Posts 1.0.7 Cross Site Scripting
Plugin Name : Relevant Related Posts Plugin Effected Version : 1.0.7 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields pu...
WordPress plugin Yet Another Related Posts '/wp-admin/options-general.php' cross-site request forgery vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Yet Another Related Posts Plugin for WordPress is a wordpress plugin. The WordPress plugin Yet Another Related Posts...
WordPress Yet Another Related Posts Plugin <= 4.2.4 - CSRF Vulnerability
Exploit for php platform in category web applications Homepage https://wordpress.org/plugins/yet-another-related-posts-plugin/ Affected Versions input type='hidden' name='autodisplayposttypespag...
WordPress Yet Another Related Posts Plugin <= 4.2.4 - CSRF
WordPress Yet Another Related Posts plugin is prone to a cross-site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Upgrade the plugin...
WordPress Plugin Yet Another Related Posts 4.2.4 - Cross-Site Request Forgery
WordPress Plugin Yet Another Related Posts 4.2.4 - Cross-Site Request Forgery Homepage https://wordpress.org/plugins/yet-another-related-posts-plugin/ Affected Versions input type='hidden' name='autodisplayposttypespage...
Yet Another Related Posts Plugin (YARPP) 4.2.4 - CSRF / XSS / RCE
'Yet Another Related Posts Plugin' options can be updated with no token/nonce protection which an attacker may exploit via tricking website's administrator to enter a malformed page which will change YARPP options, and since some options allow html the attacker is able to inject malformed...
WordPress Yet Another Related Posts 4.2.4 CSRF / XSS / Code Execution
Homepage https://wordpress.org/plugins/yet-another-related-posts-plugin/ Affected Versions input type='hidden' name='autodisplaypostt...
WordPress Related Posts for WordPress plugin <= 1.8.1 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability discovered by Barry Kooij in WordPress Related Posts for WordPress plugin versions = 1.8.1. Solution Update the WordPress Related Posts for WordPress plugin to the latest available version at least 1.8.2...