GD bbPress Attachments <= 2.5 - Authenticated Stored XSS

An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary JavaScript code via the image filename. The arbitrary code runs both on the topic page and in the admin panel, and it only affects the administrators, moderators and the attacker. The variable $error‘file’ in...

Bbp Move Topics < 1.1.6 - Code Injection & CSRF

The bbPress Move Topics WordPress plugin was affected by a Code Injection & CSRF security vulnerability...

bbPress <= 2.5.12 - Unauthenticated SQL Injection

Requires anonymous posting option to be enabled and WordPress version 4.8.3...

Wordpress Image Upload for BBPress Plugin - Full Path Disclosure Vulnerability

Usage Info About Failure: The Full Path Disclosure vulnerability, when it occurs, exposes the full path of a particular file and the user on your server. These two information make life easier for an attacker. First he will know where the files are and his attempts will be directed. According to...

WordPress: WordPress DB Class, bad implementation of prepare method guides to sqli and information disclosure

Issue 1: Method checks if first argument is an array and if it is, it avoids the rest of the arguments and uses the first argument array values as input. Issue 2: When input query has %s in it, then it quote and this guides to sql injection in case query that need to be prepared have quoted user...

WordPress bbPress Plugin <= 2.5.9 - Cross Site Scripting

This plugin is prone to display name and avatar potential cross site scripting vulnerability. Solution Update plugin...

Automattic: [bbPress] Stored XSS in any forum post.

Intro: Encouraged by the success of cure53 and their reward, i start the research plugins in your scope. And almost immediately i found critical Stored XSS, which of course leeds to privelege escalation or PHP code execution. This vulnerability doesnt requres "special" preveleges like...

bbPress <= 2.5.9 - Display Name & Avatar Potential Cross-Site Scripting (XSS)

The bbPress WordPress plugin was affected by a Display Name & Avatar Potential Cross-Site Scripting XSS security vulnerability...

Security Alert: WordPress Forum plug-in bbPress, there is stored XSS vulnerability, the impact of fix version 2. 5. 9 all previous versions-bug warning-the black bar safety net

Recently, the WordPress parent company Automattic released bbPress 2.5.9 version in the official WordPress Forum plugin to the latest version, fixes a higher threat of the storage typeXSSvulnerabilities that affect the scope include existing bbPress version, i.e., version 2.5.9 of all will suffer...

WordPress bbPress Plugin <= 2.5.8 - Stored Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...

bbPress <= 2.5.8 - Stored Cross-Site Scripting (XSS)

The bbPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

WordPress GD bbPress Attachments Plugin Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL server to set up a personal blog site. gd bbPress Attachments is one of the support for uploading attachments to the bbPress open-source forum progra...

WordPress GD bbPress Attachments plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL server to set up a personal blog site. gd bbPress Attachments is one of the support for uploading attachments to the bbPress open-source forum progra...

CVE-2015-5482

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. dot dot in the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

CVE-2015-5481

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

Directory traversal

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. dot dot in the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

CVE-2015-5481

The CVE-2015-5481 entry documents a Cross-site scripting (XSS) vulnerability in the GD bbPress Attachments WordPress plugin. Affects versions prior to 2.3, vulnerable code resides in forms/panels.php where the tab parameter of gdbbpress_attachments (on wp-admin/edit.php) is not properly filtered,...

CVE-2015-5482

The CVE refers to the WordPress plugin GD bbPress Attachments, affected versions prior to 2.3. The vulnerability is a directory traversal in the gdbbpress_attachments page (tab parameter) that allows remote administrators to include and execute local files via wp-admin/edit.php. Impact is arbitra...

CVE-2015-5481

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...