CVE-2012-2912: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...

CVE-2012-2917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

PT-2012-4358

Name of the Vulnerable Software and Affected Versions LeagueManager plugin version 3.7 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the group parameter in the "show-league" page or the season parameter in the "team"...

PT-2012-4363

Name of the Vulnerable Software and Affected Versions Share and Follow plugin version 1.80.3 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the cnd-key variable in a share-and-follow-menu page to 'wp-admin/admin.php' A...

CVE-2011-0641

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

CVE-2011-0641

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

CVE-2011-0641: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

PT-2011-2519

Name of the Vulnerable Software and Affected Versions StatPressCN plugin version 1.9.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the what1, what2, what3, what4, and what5 parameters in the wp-admin/admin.php file. Recommendations For StatPressCN plug...

CVE-2008-7175: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action...

CVE-2009-2334

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as...

CVE-2009-2334: Improper Authentication

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as...

CVE-2008-0617: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the DMSGuestbook 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 file parameter to wp-admin/admin.php, or the 2 messagefield parameter in the guestbook page, and the 3 title parameter in the...

CVE-2008-0615: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in wp-admin/admin.php in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allows remote authenticated users to read arbitrary files via a .. dot dot in the 1 folder and 2 file parameters...

CVE-2008-0197: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 wpcfemail, 2 wpcfsubject, 3 wpcfquestion, 4 wpcfanswer, 5...

CVE-2007-1732: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third...