PT-2019-5224 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions 3.7 through 5.3.0 Description: The issue is related to an authentication error in the class-wp-rest-posts-controller function of the WordPress content management system, allowing users to mark posts as sticky via the REST...

WordPress Related Posts Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related Posts is a plugin for adding related content. WordPress Related Posts plugin version 1.8.2 before the cross-site scripting...

Wordpress Event Tickets 4.10.7.1 Plugin - CSV Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Event Tickets = 4.10.7.1 - CSV Injection Google Dork: inurl:"\wp-content\plugins\event-tickets" Exploit Author: MTK http://mtk911.cf/ Vendor Homepage: https://tri.be/ Software Link:...

CVE-2015-9361

The Related Posts plugin before 1.8.2 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9361

The CVE-2015-9361 entry concerns the WordPress Related Posts plugin (before 1.8.2). The vulnerability is a cross-site scripting (XSS) flaw triggered via add_query_arg() and remove_query_arg(), allowing injected client-side scripts. Affected component: Related Posts plugin for WordPress; root caus...

WordPress posts-in-page plugin path traversal vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. posts-in-page is a plugin for embedding posts in pages. A path traversal vulnerability exists in the WordPress posts-in-page plugin. T...

CVE-2017-18585

The posts-in-page plugin before 1.3.0 for WordPress has icaddposts template='../ directory traversal...

CVE-2017-18585

CVE-2017-18585 affects the WordPress plugin posts-in-page prior to version 1.3.0. The root cause is a directory traversal vulnerability in the ic_add_posts template, permitting access to locations outside the intended directory. The CVSS v3 base score is 8.1 (HIGH) with NETWORK attack vector and ...

CVE-2016-10913

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

Cross site scripting

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

CVE-2016-10913

The CVE-2016-10913 entry concerns the WordPress plugin wp-latest-posts, specifically versions before 3.7.5. The connected documents confirm a cross-site scripting (XSS) vulnerability in this plugin. The provided sources do not specify the exact root cause, affected file/function, exploitation det...

CVE-2016-10913

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

CVE-2016-10883

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users...

Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Multiple Issues

Unauthenticated option changes vulnerability that could allow an attacker to redirect all pages and posts of the blog to a malicious website, as well as an authenticated options export/deletion vulnerability...

Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion

The adminInit function of the admin/includes/class.actions.snippets.php file, registered as an admininit hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog PoC...

Cryptolocking WordPress Plugin Locks Up Blog Posts

A malicious WordPress plugin ironically called WP Security has been spotted in the wild encrypting blog posts and rendering the content unreadable. It’s capable of targeting individual posts — an unusual behavior, according to researchers. According to analysis from Sucuri, the plugin obtains a...

CVE-2016-10790

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

Code injection

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

Mail.ru: [auto.mail.ru] IDOR на редактирование поста любого юзера.

IDOR allowed to edit arbitrary posts in auto.mail.ru auto.mail.ru belongs to Extended scope IDOR на редактирование произвольного поста на сайте auto.mail.ru...

WordPress Yuzo Related Posts Plugin Cross-Site Scripting

A Cross-Site Scripting vulnerability exists in WordPress Yuzo Related Posts plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...