DEBIAN-CVE-2017-14726

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

CVE-2017-14726: Improper Neutralization of Input During Web Page Generation

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor...

PT-2017-13655

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue allows for a cross-site scripting attack via shortcodes in the TinyMCE visual editor. Recommendations For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue...

wordpress -- multiple issues

wordpress developers report: Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Before versi...

Cross-site Scripting (XSS)

automattic/jetpack is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape the $header parameter in the modules/shortcodes/wufoo.php file, allowing a malicious user to inject and execute arbitrary JavaScript...

WordPress Shortcodes Ultimate Plugin Authenticated Directory Traversal (CVE-2017-2245)

A directory traversal vulnerability exists in WordPress Shortcodes Ultimate Plugin. An authenticated user with admin privileges could exploit this vulnerability by sending specially crafted requests. Successful exploitation may result in an information disclosure...

CVE-2017-2245

Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2017-2245

Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2017-2245

The WordPress plugin Shortcodes Ultimate is affected by CVE-2017-2245: a directory traversal vulnerability in versions prior to 4.10.0. An authenticated administrator can read arbitrary files via crafted requests. Impact is information disclosure on the server. Remediation: upgrade to version 4.1...

CVE-2017-2245

Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2017-2245: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Shortcodes Ultimate prior to version 4.10.0 allows remote attackers to read arbitrary files via unspecified vectors...

WordPress Shortcodes Ultimate Plugin Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Shortcodes Ultimate is one of the buttons to add plug-ins. A directory traversal vulnerability exists in WordPress...

WordPress plugin "Shortcodes Ultimate" vulnerable to directory traversal

Overview The WordPress plugin "Shortcodes Ultimate" contains a directory traversal vulnerability CWE-22 in the Examples page. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary local files o...

Shortcodes Ultimate <= 4.9.9 - Authenticated Directory Traversal

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin was affected by an Authenticated Directory Traversal security vulnerability...

WordPress Plugin Global Content Blocks 2.1.5 - Cross-Site Request Forgery

!-- Source: https://sumofpwn.nl/advisory/2016/crosssiterequestforgeryinglobalcontentblockswordpressplugin.html Abstract It was discovered that the Global Content Blocks WordPress Plugin is vulnerable to Cross-Site Request Forgery. Amongst others, this issue can be used to update a content block t...

WordPress Shortcodes Plugin <= 2.05 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...

WP Canvas - Shortcodes <= 2.05 - Authenticated Stored Cross-Site Scripting (XSS)

The Shortcodes by Angie Makes WordPress plugin was affected by a Shortcodes = 2.05 - Authenticated Stored Cross-Site Scripting XSS security vulnerability...

OptinMonster <= 1.1.4.5 - Execution of Arbitrary Shortcodes

Unauthenticated users are able to execute arbitrary WordPress shortcodes via a simple HTTP GET request. While the command is protected by a nonce, the nonce is leaked on every page load...

WordPress OptinMonster Plugin <= 1.1.4.5 - Execution of Arbitrary Shortcodes

Because of this vulnerability, unauthenticated users can execute arbitrary WordPress shortcodes via a simple HTTP GET request. Solution Update the plugin...