CVE-2018-6195: Improperly Controlled Modification of Object Prototype Attributes

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

PT-2018-17399

Name of the Vulnerable Software and Affected Versions wp-splashing-images versions prior to 2.1.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the search parameter to "wp-admin/upload.php". Recommendations For versions prior to 2.1.1,...