PT-2014-8941

Name of the Vulnerable Software and Affected Versions O2Tweet plugin versions 0.0.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the o2t username or o2t tag...

CVE-2014-9335: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 emailaddress or 2 sidebarTitle paramet...

PT-2014-8966

Name of the Vulnerable Software and Affected Versions twitterDash plugin versions 2.1 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved...

PT-2014-8938

Name of the Vulnerable Software and Affected Versions DandyID Services plugin versions 1.5.9 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the email address ...

CVE-2014-9100

The CVE-2014-9100 entry concerns the WordPress plugin WhyDoWork AdSense v1.2, which is vulnerable to Cross-site Scripting (XSS) via the idcode parameter on the whydowork_adsense page that redirects to wp-admin/options-general.php. The root cause is unvalidated/reflected input in the idcode parame...

CVE-2014-9100: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydoworkadsense page to wp-admin/options-general.php...

CVE-2014-9099: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydoworkadsense page in wp-admin/options-general.php...

PT-2014-8827

Name of the Vulnerable Software and Affected Versions WhyDoWork AdSense plugin version 1.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the idcode parameter in the "whydowork adsense" page to...

PT-2014-4780

Name of the Vulnerable Software and Affected Versions Twitget plugin versions prior to 3.3.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to "wp-admin/options-general.php". This is du...

PT-2014-5010

Name of the Vulnerable Software and Affected Versions Twitget plugin versions prior to 3.3.3 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors. This can be demonstrated by the twitget consumer key parameter to...

CVE-2014-2995: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitgetconsumerkey parameter to...

CVE-2014-2559: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php...

PT-2014-7146

Name of the Vulnerable Software and Affected Versions Login Widget With Shortcode login-sidebar-widget plugin versions prior to 3.2.1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site...

CVE-2014-6312: Improper Neutralization of Input During Web Page Generation

Cross-site request forgery CSRF vulnerability in the Login Widget With Shortcode login-sidebar-widget plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the customstyleafo paramete...

Cross site scripting

Cross-site scripting XSS vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngo...

PT-2014-6446

Name of the Vulnerable Software and Affected Versions Content Audit plugin versions prior to 1.6.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the "Audited content types" option in the content-audit page, which is accessed throug...

CVE-2014-5389: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php...

BannerMan 0.2.4 - XSS in wp-admin/options-general.php via bannerman_background parameter

The BannerMan WordPress plugin was affected by a XSS in wp-admin/options-general.php via bannermanbackground parameter security vulnerability...

Marekkis Watermark 0.9.2 - wp-admin/options-general.php pfad Parameter XSS

The Marekkis Watermark-Plugin WordPress plugin was affected by a wp-admin/options-general.php pfad Parameter XSS security vulnerability...

Backend Localization 1.6.1 - options-general.php kau-boys_backend_localization_language Parameter XSS

The Backend Localization WordPress plugin was affected by an options-general.php kau-boysbackendlocalizationlanguage Parameter XSS security vulnerability...