CVE-2015-9400: Improper Neutralization of Special Elements used in an SQL Command

The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...

PT-2019-7359

Name of the Vulnerable Software and Affected Versions wordpress-meta-robots plugin versions through 2.1 Description The issue concerns a text SQL injection in the wp-admin/post-new.php page of the wordpress-meta-robots plugin for WordPress. Recommendations For wordpress-meta-robots plugin version...

WordPress Photocrati NextGEN Gallery Plugin File Upload Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Photocrati NextGEN Gallery plugin is one of the image management plugin. A security vulnerability exists in the...

CVE-2015-9228: Unrestricted Upload of File with Dangerous Type

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php...

PT-2017-7556

Name of the Vulnerable Software and Affected Versions Photocrati NextGEN Gallery plugin version 2.1.10 Description The issue concerns unrestricted file upload in the Photocrati NextGEN Gallery plugin for WordPress. This is achieved by modifying the file extension, for example, from .jpg to .php,...

WordPress SEO by Yoast 'post-new.php' Plugin HTML Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress SEO by Yoast is one of the search engine optimization plugins. A security vulnerability exists in the...

PT-2015-3538

Name of the Vulnerable Software and Affected Versions WordPress SEO by Yoast plugin versions prior to 2.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the post title parameter to "wp-admin/post-new.php". This is due to...

CVE-2012-6692: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

CVE-2015-4065

Summary (CVE-2015-4065) : The WordPress Landing Pages plugin (versions before 1.8.5) contains an XSS vulnerability in shared/shortcodes/inbound-shortcodes.php. An authenticated remote user can inject arbitrary script/HTML via the post parameter passed to wp-admin/post-new.php, caused by echoing u...

CVE-2015-4065

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...

PT-2015-6406

Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML. The injection can be done v...

CVE-2015-4065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...