WordPress ClickDesk Plugin <= 3.8.1 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress CopySafe PDF Protection 0.6 Shell Upload

Exploit Title : Wordpress Plugin CopySafe PDF Protection Shell Upload vulnerability Author : Jagriti Sahu Download Link : http://wordpress.org/support/plugin/wp-copysafe-pdf version affected : 0.6 and below Date : 14/07/2014 Discovered at : IndiShell Lab Love to : Surbhi, Mradula and Harry...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

WordPress Better WP Security Plugin - Stored XSS

Better WP Security plugins is prone to a stored XSS vulnerability that allow to steal cookies or gain privileged access to the affected site. Solution Update the plugin to 3.5.4 version...

WordPress <= 3.6.0 - Arbitrary Code Execution

Unsafe PHP unserialization in wp-includes/functions.php could cause arbitrary code execution. Solution Update the plugin...

WordPress Sharebar Plugin <= 1.2.5 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that insert cross-site scripting sequences, add or modify buttons. Solution Update the plugin...

WordPress <= 3.5.1 - Full Path Disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the plugin...

WordPress Ripe HD FLV Player Plugin - SQL Injection

WordPress Ripe HD FLV Player plugin is prone to an SQL injection vulnerability. It allows an attacker to get access to the database, get username, password and disclosure the full path. Solution Update the plugin...

MyBB Xbox Live ID Cross Site Scripting

Exploit Title: Xbox Live ID MyBB Plugin Stored XSS Date: 13/12/2012 Exploit Author: limb0 Vendor Homepage: http://www.leveleando.com Software Link: http://mods.mybb.com/view/profile-xbox-live-id Version: 1.0 Category:Web Security Tested on: Linux...

WordPress Video Lead Form Plugin - Cross Site Scripting

WordPress Video Lead Form plugin's "errMsg" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can stea...

WordPress Mingle Forum Plugin <= 1.0.32 - Multiple SQL Injection #2

Because of these vulnerabilities in fs-admin/fs-admin.php, the authenticated users can execute arbitrary SQL commands via the "usergroup" parameter in an addusertogroup action or "addforumgroupid" parameter in an addforumsubmit action. Solution Update the plugin...

WordPress MF Gig Calendar Plugin - Cross Site Scripting

WordPress MF Gig Calendar plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...

WordPress ThreeWP Email Reflector Plugin - Stored XSS

ThreeWP Email Reflector plugin is prone to a stored XSS vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...

WordPress Church Admin Plugin - Cross Site Scripting

WordPress ChurchAdmin plugin's "id" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress LB Mixed Slideshow Plugin - Arbitrary File Upload

LB Mixed Slideshow plugin's "upload.php" is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are...

WordPress Newsletter Plugin - SQL Injection #1

Because of this vulnerability in stnliframe.php, the attackers can execute arbitrary SQL commands via the "newsletter" parameter. Solution Update the plugin...