PT-2014-6319

Name of the Vulnerable Software and Affected Versions HDW Player Plugin hdw-player-video-player-video-gallery version 2.4.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in the edit action to...

CVE-2014-5186: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

BannerMan 0.2.4 - XSS in wp-admin/options-general.php via bannerman_background parameter

The BannerMan WordPress plugin was affected by a XSS in wp-admin/options-general.php via bannermanbackground parameter security vulnerability...

Member Approval 131109 - wp-admin/options-general.php Option Manipulation CSRF

The member-approval WordPress plugin was affected by a wp-admin/options-general.php Option Manipulation CSRF security vulnerability...

ThinkIT <= 0.2 - wp-admin/admin.php toitcf_current_id Parameter XSS

The ThinkIT WP Contact Form WordPress plugin was affected by a wp-admin/admin.php toitcfcurrentid Parameter XSS security vulnerability...

Marekkis Watermark 0.9.2 - wp-admin/options-general.php pfad Parameter XSS

The Marekkis Watermark-Plugin WordPress plugin was affected by a wp-admin/options-general.php pfad Parameter XSS security vulnerability...

WordPress 2.0 - 3.0.1 Cross-Site Scripting (XSS) in wp-admin/plugins.php

...

WordPress Artiss Code Embed Plugin <= 2.0.1 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in wp-admin/admin.php suffix parameter. Solution Update the plugin...

Redirection - wp-admin/tools.php id Parameter XSS

The Redirection WordPress plugin was affected by a wp-admin/tools.php id Parameter XSS security vulnerability...

WordPress BSK PDF Manager Plugin <= 1.3 - Cross Site Scripting

This plugin is prone to a cross site scripting in wp-admin/admin.php multiple parameter. Solution Upgrade the plugin...

Ajax Pagination 1.1 - wp-admin/admin-ajax.php loop Parameter Local File Inclusion

Plugin is still affected and has been closed...

Authentication flaw

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2014-6077

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.7 Description The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the...

CVE-2014-4725: Improper Authentication

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4944

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 categoryid or 2 pdfid parameter to wp-admin/admin.php...

PT-2014-6223

Name of the Vulnerable Software and Affected Versions BSK PDF Manager plugin version 1.3.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the categoryid or pdfid parameter to the "wp-admin/admin.php" endpoint. Recommendations For BS...

CVE-2014-4938

SQL injection vulnerability in the WP Rss Poster wp-rss-poster plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php...

PT-2014-6218

Name of the Vulnerable Software and Affected Versions enl-newsletter plugin version 1.0.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in the "enl-add-new" page to "wp-admin/admin.php". Recommendations Fo...

CVE-2014-4939: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ENL Newsletter enl-newsletter plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php...