CVE-2015-9361: Improper Neutralization of Input During Web Page Generation

The Related Posts plugin before 1.8.2 for WordPress has XSS via addqueryarg and removequeryarg...

WordPress posts-in-page plugin path traversal vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. posts-in-page is a plugin for embedding posts in pages. A path traversal vulnerability exists in the WordPress posts-in-page plugin. T...

CVE-2017-18585

The posts-in-page plugin before 1.3.0 for WordPress has icaddposts template='../ directory traversal...

CVE-2017-18585

CVE-2017-18585 affects the WordPress plugin posts-in-page prior to version 1.3.0. The root cause is a directory traversal vulnerability in the ic_add_posts template, permitting access to locations outside the intended directory. The CVSS v3 base score is 8.1 (HIGH) with NETWORK attack vector and ...

CVE-2017-18585: Improper Limitation of a Pathname to a Restricted Directory

The posts-in-page plugin before 1.3.0 for WordPress has icaddposts template='../ directory traversal...

CVE-2016-10913

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

Cross site scripting

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

CVE-2016-10913

The CVE-2016-10913 entry concerns the WordPress plugin wp-latest-posts, specifically versions before 3.7.5. The connected documents confirm a cross-site scripting (XSS) vulnerability in this plugin. The provided sources do not specify the exact root cause, affected file/function, exploitation det...

CVE-2016-10913

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

CVE-2016-10913: Improper Neutralization of Input During Web Page Generation

The wp-latest-posts plugin before 3.7.5 for WordPress has XSS...

CVE-2016-10883

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users...

CVE-2016-10883: Cross-Site Request Forgery (CSRF)

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users...

Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Multiple Issues

Unauthenticated option changes vulnerability that could allow an attacker to redirect all pages and posts of the blog to a malicious website, as well as an authenticated options export/deletion vulnerability...

Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion

The adminInit function of the admin/includes/class.actions.snippets.php file, registered as an admininit hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog PoC...

Cryptolocking WordPress Plugin Locks Up Blog Posts

A malicious WordPress plugin ironically called WP Security has been spotted in the wild encrypting blog posts and rendering the content unreadable. It’s capable of targeting individual posts — an unusual behavior, according to researchers. According to analysis from Sucuri, the plugin obtains a...

CVE-2016-10790

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

Code injection

cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...

Mail.ru: [auto.mail.ru] IDOR на редактирование поста любого юзера.

IDOR allowed to edit arbitrary posts in auto.mail.ru auto.mail.ru belongs to Extended scope IDOR на редактирование произвольного поста на сайте auto.mail.ru...

WordPress Yuzo Related Posts Plugin Cross-Site Scripting

A Cross-Site Scripting vulnerability exists in WordPress Yuzo Related Posts plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

Inside the MSRC – Anatomy of a SSIRP incident

This is the second in a series of blog posts that shares how the MSRC responds to elevated threats to customers through the Software and Services Incident Response Plan SSIRP. In ourlast blog post, we looked at the history of the Microsoft Security Response Center and SSIRP, and how Microsoft tak...