PT-2015-5390

Name of the Vulnerable Software and Affected Versions Image Metadata Cruncher plugin for WordPress affected versions not specified Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This can be...

CVE-2015-1879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php...

CVE-2015-1614: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 imagemetadatacruncheralt or 2...

CVE-2015-1494: Improper Neutralization of Input During Web Page Generation

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

PT-2015-5329

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.0.3 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via a mfbfw parameter in an update action to "wp-admin/admin-post.php". This has been exploited in the wil...

CVE-2015-1436: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the 1 easingslidermanagecustomizations or 2 easingslidereditsliders page to wp-admin/admin.php...

PT-2015-5287

Name of the Vulnerable Software and Affected Versions Easing Slider plugin versions prior to 2.2.0.7 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML. The attack vector involves the edit...

CVE-2015-1582: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

PT-2015-5368

Name of the Vulnerable Software and Affected Versions Mobile Domain plugin version 1.5.2 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct cross-site scripting XSS attacks. Th...

PT-2015-5366

Name of the Vulnerable Software and Affected Versions Elegant Themes Divi theme for WordPress affected versions not specified Description A directory traversal issue exists in the Elegant Themes Divi theme for WordPress, allowing remote attackers to read arbitrary files. This is achieved by...

CVE-2015-1579: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

PT-2015-5369

Name of the Vulnerable Software and Affected Versions Spider Facebook plugin versions prior to 1.0.11 Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters. Specifically, the appid parameter in a registration task to the default URI is...

CVE-2015-1384

Cross-site scripting XSS vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannereffectdivid parameter in the BannerEffectOptions page to wp-admin/options-general.php...

PT-2015-5257

Name of the Vulnerable Software and Affected Versions Banner Effect Header plugin versions prior to 1.2.8 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the banner effect divid parameter in the BannerEffectOptions page to...

CVE-2015-1385

Cross-site scripting XSS vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmincategoryfeeds.php page to...

PT-2015-5262

Name of the Vulnerable Software and Affected Versions Photo Gallery plugin versions prior to 1.2.11 for WordPress Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the asc or desc parameter in a create gallery request in the "galleries...

CVE-2015-1204

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

PT-2015-5162

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2 Description A cross-site scripting XSS issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fsresource...

CVE-2015-1204: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

WordPress Photo Gallery Plugin <= 1.2.7 - SQL Injection

Because of this vulnerability, attackers to execute arbitrary SQL commands via the "orderby parameter" in a GalleryBox action to wp-admin/admin-ajax.php. Solution Update the plugin...