CVE-2015-2791

CVE-2015-2791 affects the WordPress WPML plugin prior to 3.1.9. The vulnerability is in the plugin’s menu sync function and allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php. The evidence base also notes bro...

WordPress WPML Plugin <= 3.1.8 - SQL Injection #1

Because of the "menu sync" function, remote attackers can delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php. Related records:...

WordPress WPML plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WPML is one of the multi-language plug-ins. A SQL injection vulnerability exists in versions of the WordPress WPML...

CVE-2015-2315

Cross-site scripting XSS vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminderpopup action to the default URI...

CVE-2015-2314

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed...

Sql injection

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed...

Cross site scripting

Cross-site scripting XSS vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminderpopup action to the default URI...

CVE-2015-2315

Cross-site scripting XSS vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminderpopup action to the default URI...

CVE-2015-2314

The CVE-2015-2314 issue affects the WordPress WPML plugin, specifically versions earlier than 3.1.9. The vulnerability is an SQL injection caused by improper filtering of the lang parameter in the HTTP Referer header during the wp-link-ajax comments/feed action, allowing remote attackers to execu...

CVE-2015-2315

The WPML WordPress plugin is affected by an XSS vulnerability in versions prior to 3.1.9, allowing remote attackers to inject arbitrary script via the target parameter in a reminder_popup action to the default URI. Exploitation details indicate the issue arises from the reminder_popup flow and is...

CVE-2015-2314

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed...

WordPress WPML Plugin <= 3.1.8 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via the "target" parameter in a reminderpopup action to the default URI. Solution Update the plugin...

WordPress WPML Plugin < 3.1.9.1 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

WordPress Plugin WPML 3.1.9 - Multiple Vulnerabilities

WordPress Plugin WPML 3.1.9 - Multiple Vulnerabilities OVERVIEW ========== WPML is the industry standard for creating multi-lingual WordPress sites. Three vulnerabilities were found in the plug-in. The most serious of them, an SQL injection problem, allows anyone to read the contents of the...

WordPress WPML Plugin <= 3.1.9.1 - Multiple Vulnerabilities

WPML is prone to SQL injection, page or post menu deletion and reflected cross-site scripting vulnerabilities. Solution Update the plugin...

WordPress Plugin WPML 3.1.9 - Multiple Vulnerabilities

OVERVIEW ========== WPML is the industry standard for creating multi-lingual WordPress sites. Three vulnerabilities were found in the plug-in. The most serious of them, an SQL injection problem, allows anyone to read the contents of the WordPress database, including user details and password...

WordPress WPML Multiple Vulnerabilities

WordPress WPML plugin versions prior to 3.1.9.1 suffer from remote SQL injection, cross site scripting, and page/post/menu deletion vulnerabilities. OVERVIEW ========== WPML is the industry standard for creating multi-lingual WordPress sites. Three vulnerabilities were found in the plug-in. The...

WordPress WPML Missing Authentication

One more vulnerability reported on March 02 and fixed in version 3.1.9: 4. Unauthenticated administrative functions An unauthenticated attacker may under certain conditions bypass WPML's nonce check and perform administrative functions. The administrative ajax functions are protected with nonces ...

Wpml < 3.1.9 - XSS

The wpml WordPress plugin was affected by a XSS security vulnerability...

WordPress WPML XSS / Deletion / SQL Injection

OVERVIEW ========== WPML is the industry standard for creating multi-lingual WordPress sites. Three vulnerabilities were found in the plug-in. The most serious of them, an SQL injection problem, allows anyone to read the contents of the WordPress database, including user details and password...