WordPress GiveWP 2.9.7 Cross Site Scripting

Exploit Title: GiveWP 2.9.7 Reflected Cross-Site Scripting Date: 3/23/2021 Exploit Author: Austin Bentley Vendor Homepage: https://givewp.com/ Software Link: https://wordpress.org/plugins/give/ Version: 2.9.7 Tested on: Windows 7 CVE: CVE-2021-24213 Exploitation requirements: Admin must visit...

CVE-2015-9395

The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action...

CVE-2019-15649

The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload...

CVE-2017-18579

The corner-ad plugin before 1.0.8 for WordPress has XSS...

nationalpost.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-628572 Description| Value ---|--- Affected Website:| nationalpost.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Wordpress Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

gsd.harvard.edu Improper Access Control vulnerability

Open Bug Bounty ID: OBB-627422 Description| Value ---|--- Affected Website:| gsd.harvard.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Wordpress Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2017-1002014

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...

CVE-2015-5733

Cross-site scripting XSS vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title...

slideoptinprox - XSS

The slideoptinprox WordPress plugin was affected by a XSS security vulnerability...

paypal-digital-goods-monetization-powered-by-cleeng <= 2.2.13 - XSS in ZeroClipboard

The paypal-digital-goods-monetization-powered-by-cleeng WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

Carousel Slideshow - Unspecified Vulnerabilities

The wp-carouselslideshow WordPress plugin was affected by an Unspecified Vulnerabilities security vulnerability...

RokBox <= 2.13 - rokbox.php Direct Request Path Disclosure

The wprokbox WordPress plugin was affected by a rokbox.php Direct Request Path Disclosure security vulnerability...

Fedora Update for wordpress FEDORA-2010-19296

Check for the Version of wordpress OpenVAS Vulnerability Test Fedora Update for wordpress FEDORA-2010-19296 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

CVE-2008-4769

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-2146

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2008-2068

Cross-site scripting XSS vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-1622

Cross-site scripting XSS vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATHINFO in the administration interface, related to loose...

CVE-2007-1230

Multiple cross-site scripting XSS vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via 1 the Referer HTTP header or 2 the URI, a different vulnerability than CVE-2007-1049...

CVE-2007-0106

Cross-site scripting XSS vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when...