PT-2014-8924

Name of the Vulnerable Software and Affected Versions jRSS Widget plugin version 1.2 and earlier for WordPress Description A server-side request forgery SSRF issue allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter. Recommendations For jRSS Widget...

WordPress jRSS Widget Plugin <= 1.2 - SSRF

This vulnerability is in the proxy.php. It allows the attackers to trigger outbound requests and enumerate open ports via the "URL" parameter. Solution Update the plugin...

PT-2014-2251

Name of the Vulnerable Software and Affected Versions Mini Mail Dashboard Widget plugin version 1.42 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the body of an email. This could potentially lead to unauthorized actions on the...

CVE-2012-4226: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 Title, 2 Content, or 3 New category field to wordpress/ or 4 query string to wordpress/...

WordPress Flash Player Widget Plugin - Content Spoofing

This plugin is prone to a content spoofing vulnerability in dewplayer.swf. Solution Update the plugin...

CVE-2014-4516

Cross-site scripting XSS vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter...

CVE-2014-4516

The CVE-2014-4516 entry affects the WordPress BIC Media Widget plugin (

PT-2014-5946

Name of the Vulnerable Software and Affected Versions BIC Media Widget plugin version 1.0 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the param parameter in the...

PT-2013-6114

Name of the Vulnerable Software and Affected Versions Blue Wrench Video Widget plugin versions prior to 2.0.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw url parameter ...

CVE-2013-2704

The CVE-2013-2704 entry concerns the WordPress plugin Dropdown Menu Widget (version 1.9.1). The vulnerability is described as a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of arbitrary users for requests that insert Cross-Site Scripting (XSS) sequen...

PT-2013-3881

Name of the Vulnerable Software and Affected Versions Dropdown Menu Widget plugin version 1.9.1 Description The issue is a cross-site request forgery CSRF vulnerability that allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting XSS...

PT-2013-3484

Name of the Vulnerable Software and Affected Versions Social Media Widget plugin version 4.0 Description The issue concerns an externally introduced modification, often referred to as a Trojan Horse, within the Social Media Widget plugin. This modification enables remote attackers to force the...

PT-2013-2559

Name of the Vulnerable Software and Affected Versions WP PHP widget plugin version 1.0.2 Description The issue allows remote attackers to obtain sensitive information via a direct request. This is achieved by revealing the full path in an error message. No information is available about the...

CVE-2012-3578

Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct...

PT-2012-4824

Name of the Vulnerable Software and Affected Versions FCChat Widget plugin versions 2.2.13.1 and earlier for WordPress Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a...

WordPress FCChat Widget Plugin 2.2.x - Arbitrary File Upload

FCChat Widget plugin's "Upload.php" is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also...

WordPress Rating Widget Plugin 1.3.1 - Multiple Cross-Site Scripting Vulnerabilities

Rating Widget plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...