CVE-2014-9334: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 user or 2 password parameter in the bird-feeder page to...

CVE-2014-9338

CVE-2014-9338 concerns the WordPress plugin O2Tweet (versions 0.0.4 and earlier). The connected documents describe multiple CSRF vulnerabilities that allow remote attackers to hijack an administrator’s authentication for requests that trigger cross-site scripting (XSS) via the parameters o2t_user...

PT-2014-8943

Name of the Vulnerable Software and Affected Versions wpCommentTwit plugin version 0.5 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the username or password...

CVE-2014-9337: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 twitterkullanici or 2...

PT-2014-8938

Name of the Vulnerable Software and Affected Versions DandyID Services plugin versions 1.5.9 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the email address ...

PT-2014-8944

Name of the Vulnerable Software and Affected Versions yURL ReTwitt plugin versions 1.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the yurl login or yurl...

PT-2014-8941

Name of the Vulnerable Software and Affected Versions O2Tweet plugin versions 0.0.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the o2t username or o2t tag...

CVE-2014-9368: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the usernametwitterDash parameter in the twitterDash.php page...

PT-2014-8966

Name of the Vulnerable Software and Affected Versions twitterDash plugin versions 2.1 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved...

CVE-2014-9335: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 emailaddress or 2 sidebarTitle paramet...

CVE-2014-9305: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcodeproductstable action to wp-admin/admin-ajax.php...

WordPress Shareaholic Plugin <= 7.6.0 - XSS

This vulnerability is in admin.php. It allows authenticated users to inject arbitrary web script or HTML via the "locationid" parameter that is in a shareaholicaddlocation action to wp-admin/admin-ajax.php. Solution Update the plugin...

CVE-2014-9175: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the tableid parameter in a getwdtable action to wp-admin/admin-ajax.php...

CVE-2014-8801

Directory traversal vulnerability in services/getfile.php in the Paid Memberships Pro plugin before 1.7.15 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the QUERYSTRING in a getfile action to wp-admin/admin-ajax.php...

PT-2014-8737

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro plugin versions prior to 1.7.15 Description The issue allows remote attackers to read arbitrary files via a .. dot dot in the QUERY STRING in a getfile action to "wp-admin/admin-ajax.php". This is a directory traversal...

Sql injection

Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery contus-video-gallery plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow 1 remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php ...

CVE-2014-9100

The CVE-2014-9100 entry concerns the WordPress plugin WhyDoWork AdSense v1.2, which is vulnerable to Cross-site Scripting (XSS) via the idcode parameter on the whydowork_adsense page that redirects to wp-admin/options-general.php. The root cause is unvalidated/reflected input in the idcode parame...

CVE-2014-9100: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydoworkadsense page to wp-admin/options-general.php...

PT-2014-8827

Name of the Vulnerable Software and Affected Versions WhyDoWork AdSense plugin version 1.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the idcode parameter in the "whydowork adsense" page to...

PT-2014-8824

Name of the Vulnerable Software and Affected Versions Apptha WordPress Video Gallery contus-video-gallery plugin version 2.5 Description The issue concerns SQL injection vulnerabilities in the Apptha WordPress Video Gallery plugin. These vulnerabilities allow remote attackers to execute arbitrary...