Wordpress Plugin Patched After Zero Day Discovered

UPDATE A popular WordPress plugin is urging users to update as soon as possible after it patched a vulnerability that was being exploited in the wild. If users cannot update, developers recommended they disable the plugin. The plugin, Social Warfare, lets users add social media sharing buttons to...

WordPress WP Cost Estimation plugin < 9.644 - Arbitrary File Upload and Delete vulnerability

Arbitrary File Upload and Delete vulnerability found by Wordfence in WordPress WP Cost Estimation versions 9.644. Solution All versions older than 9.644 vulnerable and you should update to the latest available version at least to 9.644...

WordPress WP Cost Estimation plugin < 9.660 - Upload Directory Traversal vulnerability

Upload Directory Traversal vulnerability found by Wordfence in WordPress WP Cost Estimation plugin versions 9.660. Solution All versions older than version 9.660 are vulnerable, update to the latest version at least 9.660...

WordPress Wordfence 7.1.12 XSS / Username Disclosure

waraxe-2018-SA109 - Multiple vulnerabilities in Wordfence Wordpress plugin ================================================================================ Author: Janek Vind "waraxe" Date: 02. October 2018 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-109.html Target description:...

Wordpress plugin Wordfence username bypass vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A username bypass vulnerability exists in Wordpress plugin Wordfence, which can be exploited by an attacker to obtain usernam...

Wordpress plugin Wordfence 403.php page cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress plugin Wordfence 403.php page, which can be exploited by an...

Wordpress plugin Wordfence 503.php page cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress plugin Wordfence 503.php page, which can be exploited by an...

Wordfence <= 7.1.12 - Username Enumeration Prevention Bypass

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an Username Enumeration Prevention Bypass security vulnerability. PoC Wordfence blocks: http://www.example.com/?author=1 But allowed: http://www.example.com/?author=1...

Wordfence <= 7.1.12 - Username Enumeration Prevention Bypass

The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an Username Enumeration Prevention Bypass security vulnerability. Wordfence blocks: http://www.example.com/?author=1 But allowed: http://www.example.com/?author=1...

Old WordPress Plugin Being Exploited in RCE Attacks

Researchers are warning that attackers are abusing a vulnerability in WordPress site admins’ outdated versions of a migration plugin called Duplicator – allowing them to execute remote code. Made by Snap Creek Software, all Duplicator plugins earlier than version 1.2.42 are vulnerable to the...

WordPress Wordfence Security Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on PHP and MySQL servers.Wordfence Security is one of the security plug-ins, which provides firewalls, virus scanning, and traffic monitoring...

WordPress Wordfence Plugin < 5.1.5 XSS Vulnerability

The WordPress plugin Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

Cross site scripting

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php...

CVE-2014-4932

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php...

CVE-2014-4932

CVE-2014-4932 is a documented XSS in the Wordfence Security plugin for WordPress, before version 5.1.5. The issue allows a remote attacker to inject arbitrary web script or HTML by manipulating the val parameter to whois.php. Several connected sources corroborate the affected product and vulnerab...

CVE-2014-4932

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php...

CVE-2014-4932: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php...

PT-2018-4230

Name of the Vulnerable Software and Affected Versions Wordfence Security plugin versions prior to 5.1.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the val parameter to the "whois.php" endpoint. Recommendations For versions prior...

WordPress Plugin WF Cookie Consent 1.1.3 - Cross-Site Scripting

Exploit Title: WF Cookie Consent - Authenticated Persistent Cross-Site Scripting Date: 23/04/2018 Exploit Author: B0UG Vendor Homepage: http://www.wunderfarm.com/ Software Link: https://en-gb.wordpress.org/plugins/wf-cookie-consent/ Version: Tested on version 1.1.3 older versions may also be...

Wordpress Responsive Cookie Consent v1.5 / v1.6 / v1.7 - Authenticated Persistent Cross-Site Scripti

Exploit for php platform in category web applications Exploit Title: Wordpress Responsive Cookie Consent v1.5 / v1.6 / v1.7 - Authenticated Persistent Cross-Site Scripting Exploit Author: B0UG Vendor Homepage: http://www.jameskoussertari.co.uk/ Software Link:...