CVE-2021-24346

The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue...

WordPress 'press-this.php' Security Bypass

According to its version number, the WordPress install hosted on the remote web server is affected by a security bypass vulnerability. A flaw in the 'wp-admin/press-this.php' script improperly checks user permissions when publishing posts. This allows a user with 'Contributor-level' privileges to...

WordPress 3.1.2 released – Security fixes !

WordPress 3.1.2 released – Security fixes ! The WordPress team just released a new version of WordPress 3.1.2 to fix a security issue where contributor-level users were allowed to publish posts. It is a small release, and everyone using WordPress should upgrade to it! From the WordPress site:...

WordPress < 3.0.3 XML-RPC Interface Access Restriction Bypass

According to its version number, the installation of WordPress is prior to 3.0.3. It is, therefore, affected by a security bypass vulnerability. Certain access control restrictions are not properly enforced, which could allow a remote, authenticated user to perform unauthorized actions such as...