494 matches found
CVE-2022-1913: Cross-Site Request Forgery (CSRF)
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping...
Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping " document.getElementById"test".submit; XSS will be...
WordPress Add Post URL plugin <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability
Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Add Post URL plugin versions = 2.1.0. Solution Deactivate and delete. This plugin has been closed as of May 27, 2022 and is not available for download. This closure is temporary, pending a full...
CVE-2021-24746
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-39411
creationtimestamp| type| source ---|---|--- 2021-11-05 17:26:52+00:00| seen| https://t.me/cibsecurity/31894 2025-10-16 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m3dnrkmxbe2q...
CVE-2010-10017
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/wmdownloaderm3u.rb 2025-08-30 18:34:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxn7ltmwgy2m 2025-10-23...
WordPress Facebook <= 1.0.13 - Authenticated SQL Injection
http://www.defensecode.com/advisories/DC-2017-04-011WordPressFacebookPluginAdvisory.pdf Vulnerable POST URL: http://vulnerablesite.com/wp-admin/admin.php?page=SpiderFacebookmanage Vulnerable POST Body: searcheventsbytitle=&pagenumber=1&serchornot=&ascordesc=1&orderby=type AND SELECT FROM...
Calendar by WD <= 1.5.51 - Authenticated SQL injection
http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...
CVE-2013-4878
creationtimestamp| type| source ---|---|--- 2013-06-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/25986 2025-09-19 21:02:30+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lz7r6smitl2g...
CVE-2011-1670
Cross-site scripting XSS vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to posturl/edit...
PT-2011-3281
Name of the Vulnerable Software and Affected Versions InTerra Blog Machine versions 1.84 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the subject parameter to the "post url/edit" endpoint. This could potentially lead t...
InTerra Blog Machine 1.84 - subject HTML Injection
InTerra Blog Machine 1.84 - subject HTML Injection source: https://www.securityfocus.com/bid/47104/info InTerra Blog Machine is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code ...
CVE-2001-0613: Undefined Security Weakness
Omnicron Technologies OmniHTTPD Professional 2.08 and earlier allows a remote attacker to create a denial of service via a long POST URL request...
