CVE-2016-5833

Cross-site scripting XSS vulnerability in the columntitle function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834...

Stream <= 3.0.5 - Unauthenticated Events Export

The Stream WordPress plugin allows unauthenticated users to export CSV or JSON of recent events. The code only checks to see if the proper GET variables are passed to a valid backend WordPress handler and will happily export logged entries. Reported to maintainers on 5/25/2016 and new version...

CVE-2016-2221

Open redirect vulnerability in the wpvalidateredirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an...

CVE-2015-8834

Cross-site scripting XSS vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an...

CVE-2016-2221

Open redirect vulnerability in the wpvalidateredirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an...

Huge IT Image Gallery < 1.9.0 - Unauthenticated SQL Injection

The gallery-images WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

WordPress leenk.me Plugin 2.5.0 - CSRF/XSS

No description provided by source...

Ebook Download < 1.2 - Directory Traversal

The Zedna eBook download WordPress plugin was affected by a Directory Traversal security vulnerability...

WordPress Plugin Image Export 1.1.0 - Arbitrary File Disclosure

Exploit Title: Wordpress image-export LFD Date: 03/21/2016 Exploit Author: AMAR^SHG Vendor Homepage: http://www.1efthander.com Software Link: http://www.1efthander.com/category/wordpress-plugins/image-export Version: Everything is affected including latest 1.1.0 Tested on: Windows/Unix on localho...

Fedora 23 : wordpress-4.4.1-1.fc23 (2016-21f5261525)

WordPress 4.4.1 Security and Maintenance Release WordPress versions 4.4 and earlier are affected by a cross-site scripting vulnerability that could allow a site to be compromised. This was reported by Crtc4L. There were also several non-security bug fixes: Emoji support has been updated to includ...

WordPress < 3.0.2 Multiple Vulnerabilities

Binary data 9110.prm...

WordPress < 3.0.3 XML-RPC Interface Access Restriction Bypass

Binary data 9112.prm...

WordPress Plugin Ocim MP3 - SQL Injection

======== Ocim MP3 Plugin SQL Injection Vulnerability ======== :----------------------------------------------------------------------------------------------------: : Exploit Title : Ocim MP3 Plugin SQL Injection Vulnerability : Date : 26 February 2016 : Author : xevil and Blankon33 : Vendor Site...

Debian DLA-418-1 : wordpress security update

WordPress versions 4.4.1 and earlier are affected by two security issues: a possible Side Request Forgery Vulnerability for certain local URIs, reported by Ronni Skansing; and an open redirection attack, reported by Shailesh Suthar. CVE-2016-2221 Wordpress could be vulnerable for an open...

WordPress Releases Security Update

WordPress 4.4.1 and prior versions contain two security vulnerabilities. Exploitation of one of these vulnerabilities could allow a remote attacker to obtain sensitive information. Users and administrators are encouraged to review the WordPress Security and Maintenance Release and upgrade to...

WordPress Admin Management Xtended Plugin 2.4.0 - Privilege Escalation Vulnerability

WordPress Admin Management Xtended plugin version 2.4.0 suffers from a privilege escalation vulnerability. Exploit Title: Admin Management Xtended 2.4.0 Privilege escalation Date: 14-12-2015 Software Link: https://wordpress.org/plugins/admin-management-xtended/ Exploit Author: Kacper Szurek...

WP Fastest Cache <= 0.8.4.8 - Blind SQL Injection

According to the researcher, for this vulnerability to be present WP-Polls plugin also needs to be installed...

CVE-2015-2213

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

CVE-2015-2213

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

wordpress: multiple issues

CVE-2015-5714 cross-side scripting A cross-site scripting vulnerability has been discovered when processing shortcode tags. - CVE-2015-5715 insufficient permission restriction A vulnerability has been discovered, allowing users without proper permissions to publish private posts and make them...