CVE-2016-10867: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages...

CVE-2015-9294: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in addqueryarg and removequeryarg function instances...

CVE-2015-9293: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature...

CVE-2016-10866: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues...

CVE-2016-10868: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages...

PT-2019-7662

Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 4.2.0 Description The issue concerns multiple XSS problems. Recommendations For versions prior to 4.2.0, update to version 4.2.0 or later to resolve the issue...

CVE-2018-12636

The CVE concerns WordPress iThemes Security (better-wp-security) plugin, prior to version 7.0.3. An authenticated admin can exploit an SQL injection via the itsec-logs page (log-orderby parameter) due to improper handling of the ORDER BY clause, enabling arbitrary SQL execution. Remediation: upgr...

PT-2018-11300

Name of the Vulnerable Software and Affected Versions iThemes Security better-wp-security plugin version 7.0.3 and earlier Description The issue allows SQL Injection via the logs page, specifically targeting attackers with Admin privileges. Recommendations For versions prior to 7.0.3, update to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-5072

Cross-site request forgery CSRF vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2014-5072

CVE-2014-5072 affects the WP Security Audit Log WordPress plugin prior to version 1.2.5. The vulnerability is a cross-site request forgery (CSRF) that could allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. The public records in the connected sources ...

CVE-2014-5072

Cross-site request forgery CSRF vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

PT-2018-4255

Name of the Vulnerable Software and Affected Versions WP Security Audit Log plugin versions prior to 1.2.5 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims. The exact vectors used for the attack are not specified. Recommendations...

CVE-2014-5072: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in WP Security Audit Log plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Information disclosure

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2018-8719

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

CVE-2018-8719

CVE-2018-8719 affects WordPress WP Security Audit Log plugin (v3.1.1). The issue is information disclosure: access to wp-content/uploads/wp-security-audit-log/* is not restricted, enabling potential exposure of sensitive data (e.g., login attempts) and making files indexable by search engines. Ex...

CVE-2018-8719: Insertion of Sensitive Information into Log File

An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. For example, these files are indexed by Google and allows for attackers to possibly find sensitive information...

PT-2018-18597

Name of the Vulnerable Software and Affected Versions WP Security Audit Log plugin version 3.1.1 Description An issue was discovered in the WP Security Audit Log plugin where access to files in the wp-content/uploads/wp-security-audit-log/ directory is not restricted. This allows these files to b...

WP Security Audit Log Plugin <= 3.1.1 - Sensitive Information Disclosure

No protection on the wp-content/uploads/wp-security-audit-log/ which is indexed by google and allows for attackers to possibly find user information bad login attempts PoC Google Dork: inurl:/wp-content/uploads/wp-security-audit-log/...