WordPress plugin Add Post URL 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Add Post URL plugin 2.1.0 and earlier versions are vulnerable to cross-site request forgery, which...

Add Post URL <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping " document.getElementById"test".submit; XSS will be...

WordPress Add Post URL plugin <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability

Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Add Post URL plugin versions = 2.1.0. Solution Deactivate and delete. This plugin has been closed as of May 27, 2022 and is not available for download. This closure is temporary, pending a full...

CVE-2021-39411

creationtimestamp| type| source ---|---|--- 2021-11-05 17:26:52+00:00| seen| https://t.me/cibsecurity/31894 2025-10-16 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m3dnrkmxbe2q...

CVE-2010-10017

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/wmdownloaderm3u.rb 2025-08-30 18:34:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxn7ltmwgy2m 2025-10-23...

WordPress Facebook <= 1.0.13 - Authenticated SQL Injection

http://www.defensecode.com/advisories/DC-2017-04-011WordPressFacebookPluginAdvisory.pdf Vulnerable POST URL: http://vulnerablesite.com/wp-admin/admin.php?page=SpiderFacebookmanage Vulnerable POST Body: searcheventsbytitle=&pagenumber=1&serchornot=&ascordesc=1&orderby=type AND SELECT FROM...

Calendar by WD <= 1.5.51 - Authenticated SQL injection

http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...

CVE-2013-4878

creationtimestamp| type| source ---|---|--- 2013-06-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/25986 2025-09-19 21:02:30+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lz7r6smitl2g...

CVE-2011-1670

Cross-site scripting XSS vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to posturl/edit...

InTerra Blog Machine 1.84 - subject HTML Injection

InTerra Blog Machine 1.84 - subject HTML Injection source: https://www.securityfocus.com/bid/47104/info InTerra Blog Machine is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code ...

CVE-2001-0613

Omnicron Technologies OmniHTTPD Professional 2.08 and earlier allows a remote attacker to create a denial of service via a long POST URL request...