12 matches found
CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
EUVD-2019-3529
Malware in sbrugna...
CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
Design/Logic Flaw
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
CVE-2019-11869
The Yuzo Related Posts plugin for WordPress (versions prior to 5.12.94 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is a logic flaw where the plugin incorrectly assumes that the is_admin() function verifies the identity of the requester; in reality, it only checks if the request...
PT-2019-12530
Name of the Vulnerable Software and Affected Versions Yuzo Related Posts plugin version 5.12.94 Description The issue arises from the plugin mistakenly assuming that the is admin function verifies the request origin as an admin user, when in fact it only checks if the request is for an admin page...
VulnCheck KEV: CVE-2019-11869
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
CVE-2019-11869: Improper Neutralization of Input During Web Page Generation
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can inject a payload into the plugin settings, suc...
Users Urged to Uninstall WordPress Yuzo Plugin After Flaw Exploited
UPDATE Users of the popular Yuzo Related Posts plugin are being urged to uninstall the plugin after a flaw was discovered being exploited in the wild – putting tens of thousands of websites at risk. Yuzo Related Posts, which enables WordPress websites to display “related posts” segments, is...
WordPress Yuzo Related Posts plugin <=5.12.91 - Broken authentication
Broken authentication and session management allows unauthenticated call any action or update any option on WordPress Yuzo Related Posts plugin versions =5.12.91. Solution 10 April 2019 - this plugin was closed and is no longer available for download...