CVE-2013-1758

CVE-2013-1758 affects the Marekkis Watermark WordPress plugin (version 0.9.2) and enables cross-site scripting via the pfad parameter to wp-admin/options-general.php. The flaw is a reflective XSS in the admin path, allowing remote attackers to inject arbitrary script/HTML. Public sources consiste...

PT-2014-2489

Name of the Vulnerable Software and Affected Versions Marekkis Watermark plugin version 0.9.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the pfad parameter to the "wp-admin/options-general.php" API...

CVE-2013-1758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information...

PT-2014-4618

Name of the Vulnerable Software and Affected Versions Thank You Counter Button plugin version 1.8.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the thanks caption, thanks caption style, or thanks style parameter to "wp-admin/options.php". This can lead...

PT-2014-2476

Name of the Vulnerable Software and Affected Versions CommentLuv plugin versions prior to 2.92.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the ajax nonce parameter to the "wp-admin/admin-ajax.php" API endpoint...

CVE-2013-1409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

PT-2014-2506

Name of the Vulnerable Software and Affected Versions LeagueManager plugin versions prior to 3.8.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the league id parameter in the "leaguemanager-export" page to "wp-admin/admin.php"...

Information disclosure

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2012-6634

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a postid value...

CVE-2010-5295

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

PT-2014-2403

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.3.3 Description The issue allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions. This is achieved by manipulating the post id value in the wp-admin/media-upload.p...

PT-2014-2404

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.3.3 Description The issue allows remote authenticated users to obtain sensitive information by visiting a draft due to improper restriction of excerpt-view access in the...

CVE-2011-5270: Undefined Security Weakness

wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publishposts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role...

CVE-2010-5294: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the requestfilesystemcredentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a 1 FTP or 2 SSH connection attempt...

CVE-2010-5295: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2012-6634: Undefined Security Weakness

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a postid value...

CVE-2012-6635: Undefined Security Weakness

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...