CVE-2015-9418

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...

Cross site request forgery (csrf)

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...

CVE-2015-9418

CVE-2015-9418 affects the WordPress Watu Pro plugin prior to 4.9.0.8. The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an attacker to delete quizzes. Root cause: insufficient CSRF protection in the plugin’s quiz-management actions. Impact is limited to the ability to delete qu...

CVE-2015-9418

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...

WordPress Watu Pro Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Watu Pro is an online quiz and exam plugin used in it. A cross-site request forgery vulnerability exists in versions of the WordPress...

WordPress Watu Quiz plugin <= 3.1.2.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found in WordPress Watu Quiz plugin version = 3.1.2.5. Solution Update the WordPress Watu Quiz plugin to the latest available version at least 3.1.2.6...

Watu Quizz <= 3.1.2.5 - Reflected XSS via question-form.html.php

The Watu Quiz WordPress plugin was affected by a Reflected XSS via question-form.html.php security vulnerability. PoC /wp-admin/admin.php?page=watuquestion=1=edit=1"...

Watu Quizz <= 3.1.2.5 - Reflected XSS via question-form.html.php

The Watu Quiz WordPress plugin was affected by a Reflected XSS via question-form.html.php security vulnerability. /wp-admin/admin.php?page=watuquestion&question=1&action=edit&quiz=1"...

PT-2015-3446 · WordPress · Watu Quiz Plugin

Name of the Vulnerable Software and Affected Versions: Watu Quiz Plugin versions up to 2.6.7 Description: A critical issue affects the watu exams function of the controllers/exam.php file in the Exam Handler component. The manipulation of the quiz argument leads to SQL injection. The attack can b...

Watu PRO 4.8.8.4 - CSRF

Assuming there is a quiz with ID 1, the following link will delete it when visited by a logged-in admin:http://localhost/wp-admin/admin.php?page=watuproexams&action=delete&quiz=1...

Watu PRO Play 1.9.2.1 Cross Site Scripting

Details ================ Software: Watu PRO Play Version: 1.9.2.1 Homepage: http://calendarscripts.info/watupro/modules.htmlplay Advisory report: https://security.dxw.com/advisories/stored-xss-in-watu-pro-play-allows-unauthenticated-attacker-to-do-almost-anything-an-admin-can/ CVE: Awaiting...

Watu PRO 4.8.8.4 Cross Site Request Forgery

Details ================ Software: Watu PRO Version: 4.8.8.4 Homepage: http://calendarscripts.info/watupro/ Advisory report: https://security.dxw.com/advisories/csrf-in-watu-pro-allows-unauthenticated-attackers-to-delete-quizzes/ CVE: Awaiting assignment CVSS: 4.3 Medium; AV:N/AC:M/Au:N/C:N/I:P/A...

Watu PRO 4.8.8.4 Cross Site Scripting

Details ================ Software: Watu PRO Version: 4.8.8.4 Homepage: http://calendarscripts.info/watupro/ Advisory report: https://security.dxw.com/advisories/stored-xss-in-watu-pro-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/ CVE: Awaiting assignment CVSS: 5.8 Medium;...

WordPress Watu PRO Plugin <= 4.8.8.4 - Cross-Site Request Forgery

This plugin is prone to a cross site request forgery vulnerabiliy. It allows the attackers to convince an admin to visit a link of their choosing is able to delete quizzes. Solution Update the plugin...