PT-2015-6938

Name of the Vulnerable Software and Affected Versions Modern Tribe Eventbrite Tickets plugin versions prior to 3.10.2 Description The issue is related to a cross-site scripting XSS vulnerability in the Event Import page. This vulnerability allows remote attackers to inject arbitrary web script or...

PT-2015-6937

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description The issue allows remote administrators to include and execute arbitrary local files. This can be achieved by using a .. dot dot in the tab parameter in the "gdbbpress attachments"...

PT-2015-3630

Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the quiz parameter to the "wp-admin/edit.php" endpoint. This can be exploited by sending malicious input to the...

PT-2015-3629

Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the quiz parameter in the wp-admin/edit.php endpoint. Recommendations For versions prior to...

PT-2015-4264

Name of the Vulnerable Software and Affected Versions Our Team Showcase our-team-enhanced plugin versions prior to 1.3 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct...

CVE-2014-9523: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...

CVE-2014-5185: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quoteform.php page to wp-admin/edit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...

CVE-2008-0193

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...

CVE-2008-0193

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...

CVE-2008-0193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php...