CVE-2013-5977

Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...

PT-2013-5899

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.1.15 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to create or modify products, or conduct...

CVE-2013-5977: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...

Cross site scripting

Cross-site scripting XSS vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php...

PT-2013-5105

Name of the Vulnerable Software and Affected Versions BackWPup plugin versions prior to 3.0.13 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the tab parameter to "wp-admin/admin.php". Recommendations For versions prior to 3.0.13,...

CVE-2013-4626: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php...

CVE-2013-5098

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...

PT-2013-5363

Name of the Vulnerable Software and Affected Versions Download Monitor plugin versions prior to 3.3.6.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the sort parameter in the admin/admin.php file...

PT-2013-4260

Name of the Vulnerable Software and Affected Versions Download Monitor plugin versions prior to 3.3.6.2 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the p parameter in the...

CVE-2013-3262: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter...

CVE-2013-5098: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...

CVE-2013-3261: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action...

CVE-2013-3254

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...

PT-2013-4257

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus plugin versions prior to 5.0.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a "wppa manage comments edit" action. This occurs in...

CVE-2013-3254: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...

WordPress GRAND FlAGallery Plugin <= 2.71 - XSS

Because of this vulnerability in wp-admin/admin.php, the attackers can inject arbitrary web script or HTML via the "s" parameter in a flag-manage-gallery action. Solution Update the plugin...

PT-2013-1975

Name of the Vulnerable Software and Affected Versions Organizer plugin version 1.2.1 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters in an "Update Setting" action. The vulnerable parameters are the delete id parameter and...

CVE-2012-6312

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

CVE-2012-6312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

PT-2012-6261

Name of the Vulnerable Software and Affected Versions Video Lead Form plugin for WordPress affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a "video-lead-form" action t...