WordPress Shareaholic Plugin <= 7.6.0 - XSS

This vulnerability is in admin.php. It allows authenticated users to inject arbitrary web script or HTML via the "locationid" parameter that is in a shareaholicaddlocation action to wp-admin/admin-ajax.php. Solution Update the plugin...

N-Media file uploader vulnerability in handling uploaded files

Overview N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...

WordPress Last.FM Rotation Plugin <= 3.3 - Local File Inclusion

Because of this vulnerability in lastfm-proxy.php, the attackers can read arbitrary files in the "snode" parameter. Solution Update the plugin...

WordPress Global Flash Galleries Plugin - Remote File Upload

Because of this vulnerability, attacker could use the affected system to Host files. Solution Update the plugin...

WordPress ClickDesk Plugin <= 3.8.1 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Comment Control Plugin <= 0.3.0 - SQL Injection

This plugin is prone to an SQL injection vulnerability in comment-control.php type parameter. Solution Update the plugin...

WordPress CopySafe PDF Protection 0.6 Shell Upload

Exploit Title : Wordpress Plugin CopySafe PDF Protection Shell Upload vulnerability Author : Jagriti Sahu Download Link : http://wordpress.org/support/plugin/wp-copysafe-pdf version affected : 0.6 and below Date : 14/07/2014 Discovered at : IndiShell Lab Love to : Surbhi, Mradula and Harry...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

WordPress Better WP Security Plugin - Stored XSS

Better WP Security plugins is prone to a stored XSS vulnerability that allow to steal cookies or gain privileged access to the affected site. Solution Update the plugin to 3.5.4 version...

WordPress <= 3.6.0 - Arbitrary Code Execution

Unsafe PHP unserialization in wp-includes/functions.php could cause arbitrary code execution. Solution Update the plugin...

WordPress Sharebar Plugin <= 1.2.5 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that insert cross-site scripting sequences, add or modify buttons. Solution Update the plugin...

WordPress <= 3.5.1 - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the plugin...

WordPress Ripe HD FLV Player Plugin - SQL Injection

WordPress Ripe HD FLV Player plugin is prone to an SQL injection vulnerability. It allows an attacker to get access to the database, get username, password and disclosure the full path. Solution Update the plugin...

MyBB Xbox Live ID Cross Site Scripting

Exploit Title: Xbox Live ID MyBB Plugin Stored XSS Date: 13/12/2012 Exploit Author: limb0 Vendor Homepage: http://www.leveleando.com Software Link: http://mods.mybb.com/view/profile-xbox-live-id Version: 1.0 Category:Web Security Tested on: Linux...

WordPress Video Lead Form Plugin - Cross Site Scripting

WordPress Video Lead Form plugin's "errMsg" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can stea...

WordPress Mingle Forum Plugin <= 1.0.32 - Multiple SQL Injection #2

Because of these vulnerabilities in fs-admin/fs-admin.php, the authenticated users can execute arbitrary SQL commands via the "usergroup" parameter in an addusertogroup action or "addforumgroupid" parameter in an addforumsubmit action. Solution Update the plugin...

WordPress MF Gig Calendar Plugin - Cross Site Scripting

WordPress MF Gig Calendar plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...

WordPress ThreeWP Email Reflector Plugin - Stored XSS

ThreeWP Email Reflector plugin is prone to a stored XSS vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...

WordPress Church Admin Plugin - Cross Site Scripting

WordPress ChurchAdmin plugin's "id" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress LB Mixed Slideshow Plugin - Arbitrary File Upload

LB Mixed Slideshow plugin's "upload.php" is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are...