2144 matches found
CVE-2017-2245
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...
CVE-2017-2245
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...
Directory traversal
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...
CVE-2017-2245
Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...
CVE-2017-2245
The WordPress plugin Shortcodes Ultimate is affected by CVE-2017-2245: a directory traversal vulnerability in versions prior to 4.10.0. An authenticated administrator can read arbitrary files via crafted requests. Impact is information disclosure on the server. Remediation: upgrade to version 4.1...
WordPress Shortcodes Ultimate Plugin Directory Traversal Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Shortcodes Ultimate is one of the buttons to add plug-ins. A directory traversal vulnerability exists in WordPress...
WordPress plugin "Shortcodes Ultimate" vulnerable to directory traversal
Overview The WordPress plugin "Shortcodes Ultimate" contains a directory traversal vulnerability CWE-22 in the Examples page. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary local files o...
Shortcodes Ultimate <= 4.9.9 - Authenticated Directory Traversal
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin was affected by an Authenticated Directory Traversal security vulnerability...
WordPress Plugin Global Content Blocks 2.1.5 - Cross-Site Request Forgery
!-- Source: https://sumofpwn.nl/advisory/2016/crosssiterequestforgeryinglobalcontentblockswordpressplugin.html Abstract It was discovered that the Global Content Blocks WordPress Plugin is vulnerable to Cross-Site Request Forgery. Amongst others, this issue can be used to update a content block t...
WordPress Shortcodes Plugin <= 2.05 - Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
WP Canvas - Shortcodes <= 2.05 - Authenticated Stored Cross-Site Scripting (XSS)
The Shortcodes by Angie Makes WordPress plugin was affected by a Shortcodes = 2.05 - Authenticated Stored Cross-Site Scripting XSS security vulnerability...
OptinMonster <= 1.1.4.5 - Execution of Arbitrary Shortcodes
Unauthenticated users are able to execute arbitrary WordPress shortcodes via a simple HTTP GET request. While the command is protected by a nonce, the nonce is leaked on every page load...
WordPress OptinMonster Plugin <= 1.1.4.5 - Execution of Arbitrary Shortcodes
Because of this vulnerability, unauthenticated users can execute arbitrary WordPress shortcodes via a simple HTTP GET request. Solution Update the plugin...
WordPress Calculated Fields Form 1.0.x Session Hijacking
Exploit Title: WordPress Calculated Fields Form =1.0.x - Httponly bypass & admin session hijackig. Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/calculated-fields-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI:...
DSA-3332-2 wordpress - regression update
Bulletin has no description...
WordPress Landing Pages 1.8.4 Cross Site Scripting ( CVE-2015-4065 )
插件: https://downloads.wordpress.org/plugin/landing-pages.1.8.4.zip 漏洞文件位置在 shared/shortcodes/inbound-shortcodes.php Line 761 preview.php?sc=&post=' width="285" scrollbar='true' frameborder="0" id="inbound-shortcodes-preview" 从上述文件可以看到 GET 方式传过来的参数 post 直接输出到 html 中造成了XSS 触发 url 如下...
WordPress Shortcodes Security Patch
WordPress core engine security vulnerabilities aren’t rare, but they are uncommon. Most issues affecting the integrity of sites running on the content management system are introduced by third-party plugins and put those sites at risk for a host of attacks. Today WordPress upgraded to version 4.3...
WordPress Olevmedia Shortcodes Plugin <= 1.1.8 - Cross Site Scripting (XSS)
Because of this vulnerability, authenticated users can inject HTML or JS code via "id" parameter. Solution Update the plugin...
Olevmedia Shortcodes <= 1.1.8 - Authenticated Reflected Cross-Site Scripting (XSS)
The Olevmedia Shortcodes WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...