CVE-2012-1936: Cross-Site Request Forgery (CSRF)

The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

CVE-2012-2402

CVE-2012-2402 affects WordPress up to version 3.3.1 (patched in 3.3.2). The flaw is in wp-admin/plugins.php, where remote authenticated site administrators could bypass access restrictions and deactivate network-wide plugins via unspecified vectors. The OpenVAS/Nessus/DSA references confirm this ...

CVE-2012-2402: Undefined Security Weakness

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

PT-2012-2868 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress versions 3.3.1 and earlier Description: The issue allows remote attackers to inject arbitrary web script or HTML via the dbhost, dbname, or uname parameters in the wp-admin/setup-config.php file. The vendor disputes the significance...

CVE-2011-4899: Undefined Security Weakness

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static...

CVE-2011-4898: Exposure of Sensitive Information to an Unauthorized Actor

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

CVE-2012-0782: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dbhost, 2 dbname, or 3 uname parameter. NOTE: the vendor disputes the significance of...

WordPress <= 3.3.1 - Multiple XSS

Because of these vulnerabilities in wp-admin/setup-config.php, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

PT-2011-4708

Name of the Vulnerable Software and Affected Versions WordPress versions 2.9.2 through 3.0.4 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by files such as wp-admin/includes/user.php, which reveals the...

CVE-2011-3818

WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files...

Code injection

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read 1 draft posts or 2 private posts via a modified attachmentid parameter...

PT-2011-2570

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.0.5 Description The issue allows remote authenticated users to read draft or private posts by modifying the attachment id parameter in the media uploader. This is due to a flaw in the wp-admin/async-upload.php fil...

CVE-2011-0701: Exposure of Sensitive Information to an Unauthorized Actor

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read 1 draft posts or 2 private posts via a modified attachmentid parameter...

CVE-2011-0641

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

CVE-2011-0641

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

PT-2011-2519

Name of the Vulnerable Software and Affected Versions StatPressCN plugin version 1.9.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the what1, what2, what3, what4, and what5 parameters in the wp-admin/admin.php file. Recommendations For StatPressCN plug...

CVE-2011-0641: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 what1, 2 what2, 3 what3, 4 what4, and 5 what5 parameters. NOTE: the provenance of this information is...

PT-2010-5395

Name of the Vulnerable Software and Affected Versions Embedded Video plugin version 4.1 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the content parameter to the "/wp-admin/post.php" API endpoin...

CVE-2010-4277: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php...