Podcast Discussing WordPress Security, Anti-Surveillance

Dennis Fisher and Mike Mimoso talk about the news from the past week, including the out-of-band Microsoft patch, the compromised Joomla and WordPress plug-in attack campaign and the Detekt anti-surveillance tool.​ Download: digitalunderground172.mp3 Music by Chris Gonsalves...

CVE-2014-5389

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php...

CVE-2003-1598

SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable...

CVE-2003-1598

SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable...

CVE-2014-5204

wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...

MGASA-2014-0328 Updated wordpress packages fix security vulnerabilities

Multiple vulnerabilities in WordPress before 3.9.2, including denial of service and information disclosure issues related to XML entity expansion. The wordpress package has been updated to version 3.9.2 to fix these issues. See the release announcement for more details...

Wordpress Sites Seeing Increased Malware, Brute Force Attacks This Week

A glut of WordPress sites have fallen victim to both malware infections and a series of brute force attacks that have been making the rounds over the past several days, researchers claim. According to Peter Gramantik, a malware researcher at Sucuri, highly obfuscated malware payloads have been...

CVE-2014-4537

CVE-2014-4537 affects WordPress Keyword Strategy Internal Links Plugin (

CVE-2014-4515

The CVE-2014-4515 vulnerability affects the WordPress AnyFont plugin (mce_anyfont/dialog.php) and is caused by a cross-site scripting flaw in the text parameter, impacting version 2.2.3 and earlier. The vulnerability allows remote attackers to inject arbitrary JavaScript/HTML. Public documents de...

Wordpress Annonces Plugin 1.2.0.0 - Remote File Inclusion

No description provided by source. Exploit Title: Annonces Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/annonces Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link: http://wordpress.org/extend/plugins/annonces/download/ Version:...

Wordpress <= 2.3.1 Charset Remote SQL Injection Vulnerability

No description provided by source...

Wordpress VideoWhisper 4.27.3 - Multiple Vulnerabilities

No description provided by source...

Wordpress <= 2.0.6 wp-trackback.php Remote SQL Injection Exploit

No description provided by source. ?php printr' --------------------------------------------------------------------------- Wordpress = 2.0.6 wp-trackback.php ZendHashDelKeyOrIndex / / sql injection admin hash disclosure exploit needs registerglobals=on, 4 = PHP 4.4.3, 5.1.4 by rgod dork: is...

WordPress Super CAPTCHA plugin <= 2.2.4 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Super CAPTCHA plugin = 2.2.4 SQL Injection Vulnerability Date: 2011-08-26 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/super-capcha.2.2.4.zip Version: 2.2.4 tested...

WordPress 3.8.2 cookie forgery vulnerability analysis-vulnerability warning-the black bar safety net

0x00 background See the WordPress 3.8.2 patch analysis HMAC timing attack, the eye opener, the original can also use the time difference to determine the HMAC. But I think this vulnerability is not a simple fix to this problem. To view the official information provided by:“the vulnerability is fr...

CVE-2010-5295

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2012-6633

Cross-site scripting XSS vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field...

MGASA-2013-0285 Updated wordpress and php-phpmailer packages fix security vulnerabilities

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations CVE-2013-4338. WordPress before 3.6.1 does not properly validate URLs before...

CVE-2013-5739

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting XSS attacks via a crafted file, related to the getallowedmimetypes function in wp-includes/functions.php...