WordPress <= 2.2.3 wp-admin/edit.php backup Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/27123/info WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the brows...

CVE-2014-4030

Cross-site request forgery CSRF vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php...

PT-2014-5682

Name of the Vulnerable Software and Affected Versions JW Player plugin versions prior to 2.1.4 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to "wp-admin/admin.php"...

CVE-2014-4030: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php...

CVE-2014-4163

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

CVE-2014-4163: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

PT-2014-5714

Name of the Vulnerable Software and Affected Versions Featured Comments plugin version 1.2.1 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the buried or featured status of a comment. This is achieved via a reque...

CVE-2014-3850: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

PT-2014-5551

Name of the Vulnerable Software and Affected Versions Member Approval plugin 131109 for WordPress Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable...

PT-2014-2553

Name of the Vulnerable Software and Affected Versions Mail On Update plugin versions prior to 5.2.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the...

CVE-2013-2107: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

CVE-2014-3210: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dopbs-backend-forms.php in the Booking System Booking Calendar plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the bookingformid parameter to wp-admin/admin-ajax.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 scope parameter to index.php; 2 username, 3 dbemphone, 4 useremail, or 5...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

PT-2014-4779

Name of the Vulnerable Software and Affected Versions File Gallery plugin versions prior to 1.7.9.2 Description The issue allows remote administrators to execute arbitrary PHP code due to improper string escaping in the setting fields. This can be achieved by injecting a backslash quote in the...

CVE-2014-0165

WordPress core versions affected are 3.7.1 and 3.8.x before 3.8.2, with remote privilege escalation allowing an authenticated user with the Contributor role to publish posts via wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php. The issue is mitigated by upgrading to ...

CVE-2014-0165: Undefined Security Weakness

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

PT-2014-3510

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.2 WordPress versions 3.8.x prior to 3.8.2 Description The issue allows remote authenticated users to publish posts by leveraging the Contributor role. This is related to the files wp-admin/includes/post.php and...

Cross site scripting

Cross-site scripting XSS vulnerability in the cmstpvadminhead function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cmstpvview parameter to wp-admin/options-general.php...

CVE-2012-1834

Cross-site scripting XSS vulnerability in the cmstpvadminhead function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cmstpvview parameter to wp-admin/options-general.php...