3373 matches found
CVE-2016-6897
CVE-2016-6897 describes a CSRF vulnerability in WordPress up to version 4.5.x affecting the wp_ajax_update_plugin handler in wp-admin/includes/ajax-actions.php. The issue arises from a late check_ajax_referer call, enabling remote attackers to hijack subscribers’ authentication for /dev/random re...
CVE-2017-5492
Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...
CVE-2017-5487
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...
WordPress <= 4.7 - Post via Email Checks mail.example.com by Default
...
ZX_CSV Upload 1 – Authenticated SQL Injection
Type user access: admin user. $GET‘id’ is not escaped. URL is accessible for every registered user. 1 – Login with admin user. 2 - Send request post:...
Sql injection
Zotpress plugin for WordPress SQLi in zpgetaccount...
Trello: Subdomain Take over & username enemuration
Bug 1 ====== The ip of domain is not pointing to wpengine.com,Attacker can signup there and takeover subdomain by using this ip check the error message by visiting domain ip it say's that: This domain is successfully pointed at WP Engine, but is not configured for an account on our platform. If y...
WordPress Vertical Gallery plugin arbitrary file upload vulnerability
No description provided by source...
WordPress Zero Spam <= 2.1.1 - Unauthenticated Blind SQL Injection
The WordPress Zero Spam WordPress plugin was affected by an Unauthenticated Blind SQL Injection security vulnerability. HTTP request header: Client-IP: '+select0fromselectsleep10v+'...
SecNews: Querying private posts and changing post meta
Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...
WordPress Plugin Lazy Content Slider 3.4 - Cross-Site Request Forgery (Add Catetory)
Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider Category: Webapps Tested on: Win Version: 3.4 Date: 2016/07/08 PoC: The vulnerable page is...
CVE-2016-5838
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie...
CVE-2016-5837
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors...
CVE-2016-5835
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...
CVE-2016-5833
Cross-site scripting XSS vulnerability in the columntitle function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834...
Stream <= 3.0.5 - Unauthenticated Events Export
The Stream WordPress plugin allows unauthenticated users to export CSV or JSON of recent events. The code only checks to see if the proper GET variables are passed to a valid backend WordPress handler and will happily export logged entries. Reported to maintainers on 5/25/2016 and new version...
CVE-2016-2221
Open redirect vulnerability in the wpvalidateredirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an...
CVE-2015-8834
Cross-site scripting XSS vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an...
CVE-2016-2221
Open redirect vulnerability in the wpvalidateredirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an...