CVE-2012-4448

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

PT-2012-5406

Name of the Vulnerable Software and Affected Versions WordPress version 3.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard incoming links edit action. This occurs in t...

CVE-2012-4448: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboardincominglinks edit action...

CVE-2012-4422

wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveragi...

PT-2012-5392

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.4.2 Description The issue allows remote authenticated users to make unintended plugin changes by leveraging the Administrator role, due to insufficient privilege checks in the multisite feature. This occurs becaus...

Cross site scripting

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2912

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...

CVE-2012-2912: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...

CVE-2012-2917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...

CVE-2012-2916: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sabreclassadmin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the activeoption parameter to wp-admin/tools.php...

PT-2012-4362

Name of the Vulnerable Software and Affected Versions SABRE plugin versions prior to 2.1 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the active option parameter to...

PT-2012-4358

Name of the Vulnerable Software and Affected Versions LeagueManager plugin version 3.7 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the group parameter in the "show-league" page or the season parameter in the "team"...

PT-2012-4363

Name of the Vulnerable Software and Affected Versions Share and Follow plugin version 1.80.3 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the cnd-key variable in a share-and-follow-menu page to 'wp-admin/admin.php' A...

Sharebar <= 1.2.1 - SQL Injection & Cross-Site Scripting (XSS)

wp-admin/options-general.php status parameter XSS...

CVE-2012-1936: Cross-Site Request Forgery (CSRF)

The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...

CVE-2012-2402

CVE-2012-2402 affects WordPress up to version 3.3.1 (patched in 3.3.2). The flaw is in wp-admin/plugins.php, where remote authenticated site administrators could bypass access restrictions and deactivate network-wide plugins via unspecified vectors. The OpenVAS/Nessus/DSA references confirm this ...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

CVE-2012-2402: Undefined Security Weakness

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

CVE-2011-4899: Undefined Security Weakness

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static...

CVE-2012-0782: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dbhost, 2 dbname, or 3 uname parameter. NOTE: the vendor disputes the significance of...