DEBIAN-CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

PT-2007-5375 · Pluck · Pluck

Name of the Vulnerable Software and Affected Versions: Pluck version 4.3 Description: The issue allows remote attackers to potentially read arbitrary local files via a .. dot dot in the file parameter in the data/inc/theme.php file when register globals is enabled. However, it's noted that the co...

PT-2007-5376 · Pluck · Pluck

Name of the Vulnerable Software and Affected Versions: Pluck version 4.3 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter when register globals is enabled. However, a reliable third party disputes this vulnerability, stating that the...