490 matches found
WordPress Add Post URL plugin <= 2.1.0 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability
Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Add Post URL plugin versions = 2.1.0. Solution Deactivate and delete. This plugin has been closed as of May 27, 2022 and is not available for download. This closure is temporary, pending a full...
CVE-2021-24746
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled which is the default setting, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-39411
creationtimestamp| type| source ---|---|--- 2021-11-05 17:26:52+00:00| seen| https://t.me/cibsecurity/31894 2025-10-16 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m3dnrkmxbe2q...
CVE-2010-10017
creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/wmdownloaderm3u.rb 2025-08-30 18:34:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lxn7ltmwgy2m 2025-10-23...
Calendar by WD <= 1.5.51 - Authenticated SQL injection
http://www.defensecode.com/advisories/DC-2017-01-017WordPressSpiderEventCalendarPluginAdvisory.pdf Vulnerable POST URL: http://www.vulnerablesite.com/wpadmin/admin.php?page=SpiderCalendar&task=showmanageevent&calendarid=1 Vulnerable POST Body:...
WordPress Facebook <= 1.0.13 - Authenticated SQL Injection
http://www.defensecode.com/advisories/DC-2017-04-011WordPressFacebookPluginAdvisory.pdf Vulnerable POST URL: http://vulnerablesite.com/wp-admin/admin.php?page=SpiderFacebookmanage Vulnerable POST Body: searcheventsbytitle=&pagenumber=1&serchornot=&ascordesc=1&orderby=type AND SELECT FROM...
CVE-2013-4878
creationtimestamp| type| source ---|---|--- 2013-06-05 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/25986 2025-09-19 21:02:30+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lz7r6smitl2g...
CVE-2011-1670
Cross-site scripting XSS vulnerability in actions/add.php in InTerra Blog Machine 1.84, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the subject parameter to posturl/edit...
InTerra Blog Machine 1.84 - subject HTML Injection
InTerra Blog Machine 1.84 - subject HTML Injection source: https://www.securityfocus.com/bid/47104/info InTerra Blog Machine is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code ...
