SQL Injection Bug Fixed in Popular WordPress SEO Plug-In

SEO by Yoast, a popular search engine optimization plug-in for WordPress, has fixed a pair of blind SQL injection vulnerabilities that could have allowed an attacker to take complete control of affected sites. It’s not clear how many WordPress sites have SEO by Yoast installed, but the maker of t...

'WordPress SEO by Yoast' Plugin Vulnerability Affects Millions

A critical vulnerability has been discovered in the most popular plugin of the WordPress content management platform CMS that puts tens of Millions of websites at risks of being hacked by the attackers. The vulnerability actually resides in most versions of a WordPress plugin known as ‘WordPress...

SEO Toaster E-Commerce 2.2.0 Cross Site Scripting

Affected software: http://demo.seotoaster.com Type of vulnerability: clickjacking Version: E-Commerce 2.2.0 URL: http://www.seotoaster.com/ Discovered by: Provensec Website: http://www.provensec.com Description:Free SEO Software & CMS: All in One Proof of concept seo toaster search filed was vuln...

CVE-2014-100024

Cross-site scripting XSS vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-100024

Cross-site scripting XSS vulnerability in Seo Panel before 3.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-100024

SEO Panel is affected by a Cross-site Scripting (XSS) vulnerability prior to version 3.4.0. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Remediation: upgrade to at least 3.4.0 or apply vendor-supplied fixes once available; details on vectors ar...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from...

CVE-2014-100001

Cross-site request forgery CSRF vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are obtained from...

CVE-2014-100001

CVE-2014-100001 is a CSRF vulnerability in the WordPress plugin LiveOptim (SEO Plugin LiveOptim) before version 1.1.4-free . The issue allows remote attackers to hijack the authentication of administrators and perform requests that change plugin settings via unspecified vectors, effectively manip...

Greg's High Performance SEO 1.6.1 - Reflected XSS

The Greg's High Performance SEO WordPress plugin was affected by a Reflected XSS security vulnerability...

WordPress Greg's High Performance SEO Plugin <= 1.6.1 - Reflected XSS

This plugin is prone to a reflected cross site scripting, because $GET'submenu' is not escaped. Solution Upgrade this plugin...

WordPress SEO Friendly Images Plugin <= 3.0.4 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

SEO Redirection < 2.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the referer link from requests before displaying them in the 'Settings SEO Redirection Redirection History' page. This result in a Store dCross-Site Scripting XSS issue This cURL request to a redirected page with a custom referer makes it possible: curl -H 'Referer:...

WordPress SEO Redirection Plugin <= 2.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

SEO Redirection < 2.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the referer link from requests before displaying them in the 'Settings SEO Redirection Redirection History' page. This result in a Store dCross-Site Scripting XSS issue PoC This cURL request to a redirected page with a custom referer makes it possible: curl -H 'Referer...

Wix.com Cross Site Scripting

57 million web pages are affected by a security problem in wix.com Proof of concept of a web page made in wix.com: http://www.itsec.cl/ to see the source code can observe the following: ... Find the SEO content of this site's homepage via http://www.itsec.cl/?escapedfragment= That is where search...

CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes

Security researchers have discovered thousands of backdoored plugins and themes for the popular content management systems CMS that could be used by attackers to compromise web servers on a large scale. The Netherlands-based security firm Fox-IT has published a whitepaper revealing a new Backdoor...

Attackers Using Compromised Web Plug-Ins in CryptoPHP Blackhat SEO Campaign

Researchers have discovered a group of attackers who have published a variety of compromised WordPress themes and plug-ins on legitimate-looking sites, tricking developers into downloading and installing them on their own sites. The components then give the attackers remote control of the...

SEO Control Panel 3.6.0 - Authenticated SQL Injection

No description provided by source. Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection Date: 10/10/2014 Exploit Author: Tiago Carvalho [email protected] or [email protected] Vendor Homepage: www.seopanel.in Software Link: http://www.seopanel.in/spdownload/ Version: Se...