156 matches found
WordPress Pondol Form to Mail Plugin <= 1.1 - Cross Site Scripting (XSS)
Because of this vulnerability, the variable itemid appears to send unsanitized data back to the users browser. Vulnerable file is pondol-formmail/pages/admin-mail-info.php. Solution Update the plugin...
WordPress Memphis Document Library Plugin 3.1.5 - Arbitrary File Download
Memphis Document Library plugin is prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the plugin...
WordPress Sender 0.7 Cross Site Scripting
Plugin Name : Sender Effected Version : 0.7 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the payload as below...
WordPress My Link Order Plugin <= 4.3 - Cross Site Scripting (XSS)
Because of this XSS vulnerability, authenticated users can inject HTML or JS code. Vulnerable parameters are "cats" and "hdnCatID". Solution Update the plugin...
WordPress Google Analyticator <= 6.4.9.5 - Multiple XSS
These vulnerabilities allow an attacker to inject arbitrary web script or HTML via the 1. gadownloadsprefix 2. gadownloads 3. gaadsense 4. gaadmindisableDimentionIndex 5. gaoutboundprefix parameter in the google-analyticator page to wp-admin/admin.php. Solution Update the plugin...
WordPress <= 4.2.3 - CSRF
This vulnerability is in wp-admin/post.php. It allows an attacker to hijack the authentication of administrators for requests which lock a post. And then an attacker consequently cause a denial of service via a get-post-lock action. Solution Update the plugin...
WordPress External Video For Everybody Plugin <= 2.0 - XSS
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Wordfence Plugin <= 3.8.6 - Stored XSS
This plugin is prone to lib/IPTraf.php User-Agent header stored cross site scripting vulnerability. Solution Update plugin...
WordPress TinyMCE Plugin <= 3.5 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Subscribe2 Plugin <= 8.0 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Floating Social Media Links Plugin <= 1.4.2 - Remote File Inclusion
This plugin is prone to fsml-admin.js.php wpp parameter remote file inclusion vulnerability. It allows attackers to obtain sensitive information. Solution Update plugin...
WordPress S3 Video Plugin <= 0.97 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update plugin...
WordPress Work The Flow Plugin - Upload Vulnerability
This vulnerability allows an attacker to upload arbitrary PHP code and execute it. Solution Update the plugin...
WordPress Welcart Plugin <= 1.4.17 - Multiple XSS
These vulnerabilities allow the attackers to inject arbitrary web script or HTML via the "uscesreferer" parameter to: includes/edit-form-advanced.php, includes/edit-form-advanced34.php, classes/usceshop.class.php, includes/membereditform.php, includes/orderlist.php, includes/ordereditform.php,...
WordPress Page Builder Plugin <= 2.0.3 - Reflected XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Shareaholic Plugin <= 7.6.0 - XSS
This vulnerability is in admin.php. It allows authenticated users to inject arbitrary web script or HTML via the "locationid" parameter that is in a shareaholicaddlocation action to wp-admin/admin-ajax.php. Solution Update the plugin...
N-Media file uploader vulnerability in handling uploaded files
Overview N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...
WordPress Last.FM Rotation Plugin <= 3.3 - Local File Inclusion
Because of this vulnerability in lastfm-proxy.php, the attackers can read arbitrary files in the "snode" parameter. Solution Update the plugin...