CVE-2014-4847: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercodeRBannerurlbanner1 parameter in an update action to wp-admin/options.php...

PT-2014-6075

Name of the Vulnerable Software and Affected Versions Easy Banners plugin version 1.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the name parameter to "wp-admin/options-general.php". This enables attackers to execute malicious...

PT-2014-6076

Name of the Vulnerable Software and Affected Versions Custom Banners plugin version 1.2.2.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the custom banners registered name parameter to "wp-admin/options.php"...

CVE-2014-4723: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php...

CVE-2014-4724: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the custombannersregisteredname parameter to wp-admin/options.php...

WordPress Tweet Old Post plugin <= 3.2.5 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Tweet Old Post plugin = 3.2.5 SQL Injection Vulnerability Date: 2011-09-05 Author: sherl0ck sherl0ck at alligatorteam dot org Software Link: http://downloads.wordpress.org/plugin/tweet-old-post.zip Version: 3.2.5 tested --------------- P...

WordPress <= 2.2.3 wp-admin/edit.php backup Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/27123/info WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the brows...

CVE-2014-4030

Cross-site request forgery CSRF vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php...

PT-2014-5682

Name of the Vulnerable Software and Affected Versions JW Player plugin versions prior to 2.1.4 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to "wp-admin/admin.php"...

CVE-2014-4030: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php...

CVE-2014-4163

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

PT-2014-5714

Name of the Vulnerable Software and Affected Versions Featured Comments plugin version 1.2.1 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the buried or featured status of a comment. This is achieved via a reque...

CVE-2014-4163: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

PT-2014-5551

Name of the Vulnerable Software and Affected Versions Member Approval plugin 131109 for WordPress Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable...

CVE-2014-3850: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Member Approval plugin 131109 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings to their default and disable registration approval via a request to...

PT-2014-2553

Name of the Vulnerable Software and Affected Versions Mail On Update plugin versions prior to 5.2.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the...

CVE-2013-2107: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdatemailto parameter in the mail-on-update pag...

CVE-2014-3210: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dopbs-backend-forms.php in the Booking System Booking Calendar plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the bookingformid parameter to wp-admin/admin-ajax.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 scope parameter to index.php; 2 username, 3 dbemphone, 4 useremail, or 5...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...