4609 matches found
WP Content Text Slider on Post 6.8 - Persistent Vulnerability
Document Title: =============== WP Content Text Slider on Post 6.8 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1655 Release Date: ============= 2015-12-07 Vulnerability Laboratory ID VL-ID:...
WordPress Meta Slider Plugin <= 2.1.6 - Full Path Disclosure
This plugin is prone to a full path disclosure vulnerability. Solution Update the plugin...
WordPress Vertical Image Slider 1.0 CSRF / XSS
漏洞影响：Vertical Image Slider 1.0 https://wordpress.org/plugins/wp-vertical-image-slider/漏洞说明：Vertical Image Slider 1.0 对imagetitle和imageurl 变量没有进行过滤导致存在CSRF和XSS漏洞。问题代码：...
wordpress vertical image slider plugin < 1.2 - Cross-Site Scripting & CSRF
The lack of CSRF check and sanitisation could allow attackers to perform Cross-Site Scripting attack against logged in administrator, as well as upload arbitrary files XSS via CSRF: alert"XSS"' alert"XSS"' setTimeout'form1.submit', 1; Upload file via CSRF:...
WordPress Vertical Image Slider Plugin - Multiple Vulnerabilities
This plugin is prone to cross site request forgery for change the values and upload shell and cross site scripting vulnerabilties. Solution Update the plugin...
WordPress Vertical Image Slider 1.0 CSRF / XSS Vulnerabilities
Exploit for php platform in category web applications Exploit Title : Wordpress Vertical image slider CSRF/XSS Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/wp-vertical-image-slider/ Software Link:...
WordPress Vertical Image Slider 1.0 CSRF / XSS
Exploit Title : Wordpress Vertical image slider CSRF/XSS Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/wp-vertical-image-slider/ Software Link: https://downloads.wordpress.org/plugin/wp-vertical-image-slider.zip Date: 2015-08-2 Version: 1.0 Tested O...
WordPress Plugin Slider Revolution 3.0.95 任意文件上传漏洞
下面是对版本号为3.0.3的分析和测试结果。任意文件上传漏洞源于该插件自带的 “插件更新”” 功能，在启用该插件的同时会将一系列的action操作都注册到WordPress的ajax请求里。并且插件在接受更新请求后并没有判断用户权限，导致恶意者可利用该点进行攻击。所涉及文件：/revslideradmin.php //add common scripts there //self::addActionself::ACTIONADMININIT, "onAdminInit"; //ajax response to save slider options...
WordPress Royal Slider Plugin <= 3.2.6 - Cross Site Scripting
This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML in browser in context of the vulnerable website. Solution Update the plugin...
Royal Slider <= 3.2.6 - Authenticated Cross-Site Scripting (XSS)
The vulnerability exists due to insufficient sanitation of user-supplied data in "rstype" HTTP GET parameter when creating / editing a slider. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of...
Royal Slider <= 3.2.6 - Authenticated Cross-Site Scripting (XSS)
The vulnerability exists due to insufficient sanitation of user-supplied data in "rstype" HTTP GET parameter when creating / editing a slider. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of...
WordPress Plugin Slider Revolution <= 4.1.4 任意文件下载漏洞
所涉及文件：/incphp/framework/baseadmin.class.php //if not inside plugin don't continue if$this-isInsidePlugin == true self::addActionself::ACTIONADDSCRIPTS, "addCommonScripts"; self::addActionself::ACTIONADDSCRIPTS, "onAddScripts"; //a must event for any admin. call onActivate function...
Testimonial Slider <= 1.2.1 - Authenticated Stored Cross-Site Scripting (XSS) & CSRF
This vulnerability needs administrator privileges to exploit. Editor and author roles do not have the necessary permissions to create new sliders, contrary to what the original advisory says. However, this vulnerability can be exploited by a malicious actor by combining the XSS with CSRF to...
WordPress Testimonial Slider Plugin <= 1.2.1 - Multiple Vulnerabilities
This plugin is prone to an authenticated stored cross site scripting and cross site request forgery vulnerabilities. Solution Update the plugin...
WordPress Testimonial Slider Plugin <= 1.2.1 - Multiple Vulnerabilities
This plugin is prone to an authenticated stored cross site scripting and cross site request forgery vulnerabilities. Solution Update the plugin...
WordPress Testimonial Slider 1.2.1 Cross Site Scripting
GhostMail Exploit : For Exploiting This Vulnerability Install Testimonial Slider Plugin Then Create New Slider In Slider Name Input Place Your JavaScript Code After Creating Slider JavaScript Code Will Be Executed . Image POC : Vulnerable Code : Slider ID = For Patching : Slider ID = This...
Captain Slider 1.0.6 - Cross-Site Scripting (XSS)
The captain-slider WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WordPress Captain Slider Plugin <= 1.0.6 - Cross Site Scripting (XSS)
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Captain Slider Plugin <= 1.0.6 - Cross Site Scripting (XSS)
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
Thumbnail Carousel Slider < 1.0.1 - Stored Cross-Site Scripting (XSS) & CSRF
The original advisory states that this vulnerability is exploitable with editor and author roles but this is incorrect. Only the administrator role by default can trigger this vulnerability. However, CSRF on the image upload form makes this exploitable by a malicious actor...