CVE-2013-4340: Undefined Security Weakness

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified userID parameter...

CVE-2013-5673

SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the customquery parameter in a testimonialadd action to wp-admin/admin-ajax.php...

CVE-2013-3261: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action...

CVE-2013-3254

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...

CVE-2013-3254

The CVE-2013-3254 entry describes a Cross-site Scripting (XSS) vulnerability in the WP Photo Album Plus WordPress plugin's admin interface. Specifically, wp-admin/admin.php is vulnerable in versions before 5.0.3 via the commentid parameter used in the wppa_manage_comments edit action, allowing re...

CVE-2013-3254: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...

WordPress GRAND FlAGallery Plugin <= 2.71 - XSS

Because of this vulnerability in wp-admin/admin.php, the attackers can inject arbitrary web script or HTML via the "s" parameter in a flag-manage-gallery action. Solution Update the plugin...

CVE-2012-6312

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

CVE-2012-6312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-5387: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-4448: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

Cross site scripting

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2912: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...

CVE-2012-2917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2916: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sabreclassadmin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the activeoption parameter to wp-admin/tools.php...

Sharebar <= 1.2.1 - SQL Injection & Cross-Site Scripting (XSS)

wp-admin/options-general.php status parameter XSS...

CVE-2012-1936: Cross-Site Request Forgery (CSRF)

The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...

CVE-2012-2402

CVE-2012-2402 affects WordPress up to version 3.3.1 (patched in 3.3.2). The flaw is in wp-admin/plugins.php, where remote authenticated site administrators could bypass access restrictions and deactivate network-wide plugins via unspecified vectors. The OpenVAS/Nessus/DSA references confirm this ...

CVE-2012-2402: Undefined Security Weakness

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...