CVE-2014-4939: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ENL Newsletter enl-newsletter plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php...

PT-2014-6160

Name of the Vulnerable Software and Affected Versions Meta Slider plugin version 2.5 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the id parameter to "wp-admin/admin.php". Recommendations For Meta Slider plugin version 2.5, avoid usin...

CVE-2014-4846: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Meta Slider ml-slider plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php...

CVE-2014-4854: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuclogo parameter in a save action to wp-admin/admin.php...

PT-2014-6168

Name of the Vulnerable Software and Affected Versions WP Construction Mode plugin version 1.8 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the wuc logo parameter in a save action to "wp-admin/admin.php". Recommendations For WP...

PT-2014-5682

Name of the Vulnerable Software and Affected Versions JW Player plugin versions prior to 2.1.4 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to "wp-admin/admin.php"...

CVE-2014-4030: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php...

PT-2014-2766

Name of the Vulnerable Software and Affected Versions HMS Testimonials plugin versions prior to 2.0.11 Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding new testimonials via the "hms-testimonials-addnew" page, addin...

CVE-2013-4240: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add new testimonials via the hms-testimonials-addnew page, 2 add new groups via the...

PT-2014-2475

Name of the Vulnerable Software and Affected Versions Wysija Newsletters plugin versions prior to 2.2.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the search or orderby parameter to "wp-admin/admin.php". This can be leveraged using CSRF ...

CVE-2013-1408: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the 1 search or 2 orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote...

PT-2014-2506

Name of the Vulnerable Software and Affected Versions LeagueManager plugin versions prior to 3.8.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the league id parameter in the "leaguemanager-export" page to "wp-admin/admin.php"...

CVE-2012-6623

Cross-site scripting XSS vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php...

PT-2014-2392

Name of the Vulnerable Software and Affected Versions ForumPress WP Forum Server plugin versions prior to 1.7.5 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an 'addforum...

CVE-2013-6797

Cross-site request forgery CSRF vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bwurl parameter in the bw-videos pag...

CVE-2013-6797

CVE-2013-6797 is a CSRF vulnerability in the WordPress plugin Blue Wrench Video Widget (bluewrench-video-widget.php) prior to version 2.0.0 . The issue allows remote attackers to hijack an administrator’s session by crafting requests that embed arbitrary URLs via the bw_url parameter on the bw-vi...

PT-2013-6114

Name of the Vulnerable Software and Affected Versions Blue Wrench Video Widget plugin versions prior to 2.0.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw url parameter ...

CVE-2013-6797: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bwurl parameter in the bw-videos pag...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...

CVE-2013-5977

Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...