586 matches found
WordPress WooCommerce Stock Manager Plugin <= 1.0.7 - Authenticated Product Settings Change Vulnerability
In the function function stockmanagersaveoneproductstockdata, doesn't check for user capabilities so any logged in user can change the settings. Solution Update the plugin...
Wordpress Download Manager plugin cross-site request forgery vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress Download Manager plugin. An attacker can exploit the...
WordPress SP Projects and Document Manager Plugin SQL Injection
An SQL injection vulnerability exists in the WordPress SP Projects and Document Manager Plugin. It allows an authenticated remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data...
WordPress User Meta Manager Plugin 3.4.6 - Information Disclosure
Because of this vulnerability, any user, who is registered, can perform many AJAX requests and in that way get all contents of "usermeta" DB table. Solution Upgrade to version 3.4.8...
WordPress User Meta Manager Plugin 3.4.6 - Privilege Escalation
Because of this vulnerability, a registered user can modify the meta information. Solution Update the plugin...
WordPress Job Manager Plugin <= 0.7.24 - Cross Site Scripting (XSS)
This plugin is prone to a cross site scripting vulnerability, because authenticated administrators can inject HTML or JS code. Vulnerable parameter is "jobman-rating". Solution Update the plugin...
CVE-2015-2321
Cross-site scripting XSS vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field...
CVE-2015-2321
The CVE-2015-2321 entry applies to the WordPress Job Manager plugin (Job Manager Plugin for WordPress) version
WordPress Job Manager Plugin 0.7.22 - Persistent XSS
Job Manager plugin is prone to a persistent XSS vulnerability, because email field was not sanitized. It allows an attacler to steal cookies or perform phishing attacks. Other attacks are also possible. Solution Update the plugin...
WordPress Smart Manager Plugin <= 3.9.6 - SQL Injection
Because of this vulnerability, unauthenticated remote attackers can execute arbitrary SQL commands. Solution Update the plugin...
N-Media File Uploader <= 3.7 - Arbitrary File Upload
The Frontend File Manager Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...
WordPress Events Manager Plugin <= 5.3.8 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
WordPress Plugin SP Project & Document Manager 2.5.3 - Blind SQL Injection
Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection Google Dork: inurl:wp-content/plugins/sp-client-document-manager Date: 2015-03-04 Exploit Author: catsecurity Vendor Homepage: http://smartypantsplugins.com Software Link:...
Open redirect
Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter...
WordPress Ad-Manager 1.1.2 Open Redirect
CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Vulnerability Product: WordPress Ad-Manager Plugin Vendor: CodeCanyon Vulnerable Versions: 1.1.2 Tested Version: 1.1.2 Advisory Publication:...
WordPress Download Manager Plugin - Arbitrary File Download
Because of this vulnerability, the attackers can read arbitrary files in the "fname" parameter to views/filedownload.php or filedownload.php. Solution Update the plugin...
CVE-2014-4517
The CVE-2014-4517 entry concerns the WordPress plugin CBI Referral Manager (versions up to 1.2.1). The vulnerability is a Cross‑Site Scripting (XSS) flaw in getNetworkSites.php, exploitable via the searchString parameter, enabling remote attackers to inject arbitrary script/HTML. This is supporte...
WordPress Ad Manager Plugin <=1.1.2 - Open Redirect
This vulnerability is in the track-click.php. It allows the attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the "out" parameter. Solution Update the plugin...
WordPress Premium Gallery Manager Plugin - Unauthenticated Configuration Access
WordPress Premium Gallery Manager plugin is prone to a unauthenticated configuration access vulnerability. It allows an attacker to change the default configuration without proper authentication. Other attacks are also possible. Solution Upgrade the plugin...
IndiaNIC FAQs Manager 1.0 - CAPTCHA Value Disclosure
The faqs-manager WordPress plugin was affected by a CAPTCHA Value Disclosure security vulnerability...