CVE-2014-0165

WordPress core versions affected are 3.7.1 and 3.8.x before 3.8.2, with remote privilege escalation allowing an authenticated user with the Contributor role to publish posts via wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php. The issue is mitigated by upgrading to ...

CVE-2014-0165: Undefined Security Weakness

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the cmstpvadminhead function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cmstpvview parameter to wp-admin/options-general.php...

CVE-2014-2340: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php...

CVE-2013-4240: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add new testimonials via the hms-testimonials-addnew page, 2 add new groups via the...

CVE-2013-1408: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the 1 search or 2 orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote...

CVE-2013-1758

CVE-2013-1758 affects the Marekkis Watermark WordPress plugin (version 0.9.2) and enables cross-site scripting via the pfad parameter to wp-admin/options-general.php. The flaw is a reflective XSS in the admin path, allowing remote attackers to inject arbitrary script/HTML. Public sources consiste...

CVE-2013-1758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information...

CVE-2013-1409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

Information disclosure

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2010-5295

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2010-5295: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2011-5270: Undefined Security Weakness

wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publishposts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role...

CVE-2012-6634: Undefined Security Weakness

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a postid value...

CVE-2010-5294: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the requestfilesystemcredentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a 1 FTP or 2 SSH connection attempt...

CVE-2012-6635: Undefined Security Weakness

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

WordPress <= 3.0.1 - XSS

Because of this vulnerability in wp-admin/plugins.php, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

CVE-2012-6624

The CVE concerns the SoundCloud Is Gold WordPress plugin (v2.1) where a Cross-Site Scripting (XSS) flaw exists in the width parameter of the soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php. This allows remote attackers to inject arbitrary script/HTML in the context of affected...