1359 matches found
PT-2018-16923
Name of the Vulnerable Software and Affected Versions WPGlobus plugin version 1.9.6 Description The issue concerns a cross-site scripting XSS flaw. It is exploited via the wpglobus optionmore languages parameter to the wp-admin/options.php endpoint. Recommendations For WPGlobus plugin version...
PT-2018-17069
Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the sale conditionscount parameter in the...
PT-2018-17070
Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the wp-admin/admin.php endpoint, specifically via the...
PT-2018-16926
Name of the Vulnerable Software and Affected Versions SrbTransLatin plugin version 1.46 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by sending a specific request to the "wp-admin/options-general.php" endpoint with a lang...
PT-2018-17071
Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the form field5label parameter in the wp-admin/admin.ph...
PT-2018-16925
Name of the Vulnerable Software and Affected Versions SrbTransLatin plugin version 1.46 Description The issue concerns a CSRF vulnerability. It can be exploited via an srbtranslatoptions action to the "/wp-admin/options-general.php" API endpoint. Recommendations For SrbTransLatin plugin version...
CVE-2018-5312
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...
WordPress Simple Download Monitor plugin <=3.5.3 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by wpl0v3r in WordPress Simple Download Monitor plugin versions =3.5.3. Vulnerable to Cross-Site Scripting via the sdmupload parameter in an edit action to wp-admin/post.php. Solution Update the WordPress Simple Download Monitor plugin to...
WordPress ImageInject plugin 1.15 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability found by wpl0v3r in WordPress ImageInject plugin version 1.15. Vulnerable via wp-admin/options-general.php. Solution 1/9/2018 - we were unable to find a patched version of the plugin. Dangerous to use...
WordPress GD Rating System plugin 2.3 - Directory Traversal vulnerability (3)
A third Directory Traversal vulnerability found by d4wner in WordPress GD Rating System plugin version 2.3. Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. Solution 1/9/2018 - we were unable to find a patched version of this plugin...
CVE-2018-5312: Improper Neutralization of Input During Web Page Generation
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...
CVE-2018-5310: Improper Limitation of a Pathname to a Restricted Directory
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI...
CVE-2018-5311: Improper Neutralization of Input During Web Page Generation
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...
PT-2018-16887
Name of the Vulnerable Software and Affected Versions Media from FTP plugin versions prior to 9.85 Description The issue exists in the Media from FTP plugin, where Directory Traversal is possible. This can be achieved via the searchdir parameter to the...
PT-2018-16889
Name of the Vulnerable Software and Affected Versions tabs-responsive plugin version 1.8.0 Description The issue concerns a security problem where an attacker can exploit the post title parameter in the wp-admin/post.php endpoint to execute malicious scripts. Recommendations For tabs-responsive...
CVE-2018-5284
The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...
CVE-2018-5286
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page...
CVE-2018-5293
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page...
CVE-2018-5284
CVE-2018-5284 affects the WordPress plugin ImageInject, version 1.15. The vulnerability is a stored cross-site scripting (XSS) via the flickr_appid parameter on wp-admin/options-general.php. Root cause is input handling insufficient to neutralize script payloads in this parameter. Documented impa...
