CVE-2012-4421

The createpost function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing...

WordPress <= 3.4.2 - CSRF

Because of this vulnerability in wp-admin/index.php, the attackers can hijack the authentication of administrators for requests. Solution Update WordPress...

Fedora 17 : wordpress-3.3.2-2.fc17 (2012-6494)

Uploading files related security issues were addressed by the upstream upgrade. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

WordPress 1 Flash Gallery 1.5.6 File Upload

File upload vulnerability in WordPress 1 Flash Gallery plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

Wordpress DP Thumbnail 1.0 File Upload

File upload vulnerability in Wordpress DP Thumbnail plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

wordpress <3.3.1 wp-comments-post.php跨站脚本漏洞

No description provided by source...

CVE-2011-4899

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static...

Wordpress Kish Guest Posting Plugin 1.0 Arbitrary File Upload

Exploit for php platform in category web applications ?php / -------------------------------------------------------------------------------- Wordpress Kish Guest Posting Plugin 1.0 uploadify.php Unrestricted File Upload...

CVE-2012-0898

CVE-2012-0898 affects the WordPress myEASYbackup plugin (

XSS and IAA vulnerabilities in Register Plus Redux for WordPress

Hello 3APA3A! I want to warn you about multiple new vulnerabilities in plugin Register Plus Redux for WordPress. Last version of the plugin was checked. This is second advisory concerning new vulnerabilities in Register Plus Redux. These are Cross-Site Scripting and Insufficient Anti-automation...

Wordpress Zingiri Web Shop Plugin 2.2.0 Remote File Inclusion

Exploit for php platform in category web applications Exploit Title: Zingiri Web Shop Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/zingiri-web-shop Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

CVE-2011-3126

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects...

CVE-2011-3128

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php...

CVE-2011-3126

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects...

WPSCAN - WordPress Security & vulnerability Scanner

WPSCAN - WordPress Security & vulnerability Scanner WPScan is a vulnerability scanner which checks the security of WordPress installations using a black box approach. Details Username enumeration from author querystring and location header Weak password cracking multithreaded Version enumeration...

WPSCAN - WordPress Security & vulnerability Scanner

WPSCAN - WordPress Security & vulnerability Scanner WPScan is a vulnerability scanner which checks the security of WordPress installations using a black box approach. Details Username enumeration from author querystring and location header Weak password cracking multithreaded Version enumeration...

CVE-2010-4536

Multiple cross-site scripting XSS vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the & ampersand character, 2 the case of an attribute name, 3 a padded entity, and 4 an entity that is not in...

WordPress Plugin SEO Tools 3.0 - 'file' Directory Traversal

source: https://www.securityfocus.com/bid/44710/info The SEO Tools plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in...