WordPress My Page Order Plugin <= 4.3 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Vulnerable parameters are "pages" and "hdnParentID". Solution Upgrade this plugin...

Sql injection

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an actOrderCategories action to wp-admin/post-new.php...

CVE-2009-4748

The CVE-2009-4748 entry documents a SQL injection in the WordPress plugin My Category Order (versions

WordPress My Category Order Plugin <= 2.8 - SQL Injection Vulnerability

An SQL injection vulnerability found in mycategoryorder.php Line 47-48. The attacker can exploit this vulnerability via a browser using 'parentID' parameter. Solution Fix manually in mycategoryorder.php: Find this line: $parentID = intval$GET'parentID'; Replace to: $parentID = intval$GET'parentID...