CVE-2014-100018: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php...

WordPress Unconfirmed Plugin <= 1.2.4 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the plugin...

CVE-2014-2839: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php...

PT-2015-3713

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved by exploiting the s parameter in the "gd-star-rating-stats" page to "wp-admin/admin.php". Recommendation...

PT-2015-3712

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22 Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to SQL injection attacks via the s parameter in the "gd-star-rating-stats" page ...

SimpleDark 1.2.10 - 's' Parameter Cross Site Scripting

The SimpleDark WordPress theme was affected by a 's' Parameter Cross Site Scripting security vulnerability...

WordPress Simple Balance Theme <= 2.2.1 - Cross Site Scripting

This vulnerability allows remote attackers to inject arbitrary script or HTML via "index.php" file, "s" parameter. Solution Update the theme...

CVE-2014-4573

Multiple cross-site scripting XSS vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s or 2 o parameter...

PT-2014-5987

Name of the Vulnerable Software and Affected Versions Walk Score plugin versions 0.5.5 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the s or o parameters in the...

CVE-2014-4575

Cross-site scripting XSS vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

PT-2014-5989

Name of the Vulnerable Software and Affected Versions Wikipop plugin versions 2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the s parameter in the js/window.php file. Recommendations For Wikipop plugin versions 2.0 and...

CVE-2014-4575: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

WordPress Wikipop Plugin <= 2.0 - XSS

Because of this vulnerability in js/window.php, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the plugin...

CVE-2014-2316: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in sesearchdefault in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information...

PT-2014-4619

Name of the Vulnerable Software and Affected Versions Search Everything plugin versions prior to 7.0.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the s parameter to the "index.php" endpoint. Recommendations For versions prior to 7.0.3,...

CVE-2014-1907: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to 1 read arbitrary files via a .. dot dot in the s parameter to ls/rtmplogin.php or 2 delete arbitrary files via a .. dot dot in the s parameter t...

PT-2013-5869

Name of the Vulnerable Software and Affected Versions Platinum SEO plugin versions prior to 1.3.8 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the s parameter in the platinum seo pack.php file...

CVE-2013-5918: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in platinumseopack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2013-3261: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action...

PT-2013-4259

Name of the Vulnerable Software and Affected Versions GRAND FlAGallery plugin versions prior to 2.72 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the s parameter in a...