EUVD-2018-21601

Malware in sbrugna...

WordPress Fluid Responsive Slideshow Plugin <= 2.2.6 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery vulnerabilities. The CSRF bug can lead to a server-side compromise. Solution Update the plugin...

Uber: Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin

newsroom.uber.com uses a WordPress plugin called Stream to log user activity. In some cases the logged events aren't sanitized properly and can contain HTML tags and JavaScript. An unauthenticated user can produce such a log message to inject JavaScript in the admin panel. When an administrator...

Uber: Stored XSS in drive.uber.com WordPress admin panel

There is another bug in the All In One Event Calendar plugin used on drive.uber.com. An attacker can inject arbitrary JavaScript in the administrative Dashboard of WordPress. The script would be evaluated under administrator privileges as only logged-in administrators can view the Dashboard. Such...