48036 matches found
WordPress Slimstat Plugin <= 3.9.1 - XSS
This vulnerability is in the Save Filters functionality. It allows the attackers to inject arbitrary web script or HTML via the "fsresource" parameter. Solution Update the plugin...
WordPress Symposium Plugin 14.11 - Shell Upload
Symposium plugin is prone to a shell upload vulnerability. It allows an attacker to execute arbitrary PHP code by making a direct request to the uploaded .php file. Solution Update the plugin...
WordPress Nextend Facebook Connect Plugin 1.4.59 - XSS
Because of a cross-site scripting vulnerability in Nextend Facebook Connect plugin, anyone can change plugin settings. Solution Update the plugin to version 1.5.1...
WordPress Another Classifieds Plugin - SQL Injection
This WordPress GD Star Rating plugin's "keywordphrase" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database when doing a search for classifieds. Solution...
WordPress Another Classifieds Plugin - SQL Injection
This WordPress GD Star Rating plugin's "keywordphrase" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database when doing a search for classifieds. Solution...
WordPress Last.FM Rotation Plugin <= 3.3 - Local File Inclusion
Because of this vulnerability in lastfm-proxy.php, the attackers can read arbitrary files in the "snode" parameter. Solution Update the plugin...
WordPress MailPoet (Wysija NewsLetters) plugin - Unauthenticated File Upload
MailPoet Wysija NewsLetters plugin is prone to an unauthenticated file upload vulnerability. The plugin uses the "admininit" hook that is executed for unauthenticated users when accessing a specific URL. Solution Upgrade the plugin...
WordPress VideoWhisper Video Presentation Plugin <= 3.30 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Conversion Ninja Plugin - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter to lp/index.php. Solution Update the plugin...
WordPress Search Everything Plugin <= 7.0.2 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "s" parameter to index.php. Solution Update the plugin...
WordPress Buddypress Plugin 1.9.1 - Privilege Escalation
Buddypress plugin is prone tu vulnerability that allows an attacker to take control of every group change name, description, avatar and settings. Solution Upgrade the plugin...
WordPress BuddyPress Plugin <= 1.9.1 - XSS
Because of this vulnerability, authenticated users can inject arbitrary web script or HTML via the name field to groups/create/step/group-details. Solution Update the plugin...
WordPress Download Manager Free & Pro Plugin 2.5.8 - Persistent Cross Site Scripting
Download Manager Free & Pro plugin is prone to a persistent XSS vulnerability. The title input field is not sanitized and therefor vulnerable to persistent cross site scripting. Solution Upgrade the plugin...
WordPress Digg Digg Plugin <= 5.3.4 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of users for requests that modify settings via unspecified vectors. Solution Update the plugin...
WordPress <= 3.5.1 - Multiple SSRF
Because of these vulnerabilities, the attackers can send HTTP requests to intranet servers via unspecified vectors. Solution Update WordPress...
WordPress Responsive Logo Slideshow Plugin - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "URL and Image" field. Solution Update the plugin...
WordPress NextGEN Gallery Plugin - Path Disclosure Vulnerability
This NextGEN Gallery plugin is prone to a path-disclosure vulnerability. It allows anr attacker to obtain sensitive information that may lead to further attacks. Solution Update the plugin...
WordPress Organizer Plugin <= 1.2.1 - Multiple XSS
Because of these vulnerabilities in organizer/page/users.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress AJAX Post Search Plugin <= 1.2 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "srchtxt" parameter. Solution Update the plugin...
WordPress Sentinel Plugin <= 1.0.0 - CSRF
Because of this vulnerability in wordpresssentinel.php, the attackers can hijack the authentication of an administrator for requests that trigger snapshots. Solution Update the plugin...
WordPress Sentinel Plugin <= 1.0.0 - Cross Site Scripting
Because of this vulnerability in wordpresssentinel.php, the attackers can inject arbitrary web script or HTML via unknown vectors. Solution Update the plugin...
WordPress White Label CMS Plugin <= 1.5 - XSS
Because of this vulnerability in wlcms-plugin.php, the authenticated administrators can inject arbitrary web script or HTML via the "wlcmsodevelopername" parameter. Solution Update the plugin...
WordPress Mingle Forum Plugin <= 1.0.32 - Multiple SQL Injection #2
Because of these vulnerabilities in fs-admin/fs-admin.php, the authenticated users can execute arbitrary SQL commands via the "usergroup" parameter in an addusertogroup action or "addforumgroupid" parameter in an addforumsubmit action. Solution Update the plugin...
WordPress Zingiri Plugin <= 1.4.3 - Directory Traversal
Because of this vulnerability in forum.php, attackers can read arbitrary files in the "url" parameter to index.php. Solution Update the plugin...
WordPress Better WP Security Plugin <= 3.2.4 - Multiple XSS
Because of this vulnerabilities, the attackers can inject arbitrary web script or HTML via unspecified vectors related to "server variables". Solution Update the plugin...
WordPress All-in-One Event Calendar Plugin 1.4 - Multiple Parameter XSS
WordPress All-in-One Event Calendar plugin's /wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php multiple parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browse...
WordPress <= 0.70 - PHP remote file inclusion
Because of this vulnerability in wp-links/links.all.php, attackers can execute arbitrary PHP code via a URL in the $abspath variable. Solution Update the plugin...
WordPress Featurific For WordPress Plugin 1.6.2 - Cross Site Scripting
WordPress Featurific For WordPress plugin's "snum" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker c...
WordPress Jetpack Plugin - SQL Injection
Jetpack plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress <= 3.1.2 - Unspecified vulnerability #1
Because of this vulnerability, there are unknown impact and attack vectors related to "Various security hardening." in this WordPress version. Solution Update WordPress...
WordPress WPtouch Plugin <= 1.9.20 - XSS
Because of this vulnerability in lib/includes/auth.inc.php, the attackers can inject arbitrary web script or HTML via the "wptouchsettings" parameter to include/adsense-new.php. Solution Update the plugin...
WordPress Custom Pages Plugin 0.5.0.1 - Local File Inclusion
This vulnerability can be exploited to include arbitrary files. Solution Update the plugin...
WordPress <= 3.0.4 - Multiple Security Vulnerabilities
Because of these vulnerabilities, remote authenticated users can read draft posts or private posts via a modified "attachmentid" parameter. Solution Update WordPress...
WordPress Embedded Video Plugin <= 4.1 - XSS
Because of this vulnerability in lembedded-video.php, the attackers can inject arbitrary web script or HTML via the "content" parameter to wp-admin/post.php. Solution Update the plugin...
WordPress NextGEN Gallery Plugin <= 1.5.1 - XSS Vulnerability
This NextGEN Gallery plugin is prone to a cross-site scripting vulnerability. It is really popular plugin for the WordPress content management system, usually found as a blogging platform. The vulnerability manipulates the mode parameter of the xml/media-rss.php script and it results that...
WordPress <= 2.8.2 - Multiple Vulnerabilities #2
Because of these vulnerabilities, the attackers can gain privileges via a direct request to edit-link-category-form.php, admin-footer.php, edit-page-form.php, edit-category-form.php or edit-form-comment.php. Solution Update WordPress...
WordPress MU <= 2.7 - 'HOST' HTTP Header XSS Vulnerability
WordPress MU prior to version 2.7 fails to sanitize the Host header correctly in chooseprimaryblog function and can be hacked. Sites running in based virtual hosting setup are not affected while they are not the default virtual host. Solution Upgrade WordPress...
WordPress <= 2.6.3 - Cross Site Request Forgery
Because of this vulnerability, the attackers can conduct delayed and persistent cross-site request forgery attacks via crafted cookies. Solution Update WordPress...
WordPress WassUp Plugin <= 1.4.3 - Multiple SQL Injection
Because of these vulnerabilities in main.php, the attackers can execute arbitrary SQL commands. Solution Update the plugin...
WordPress PictPress Plugin <= 0.91 - Multiple Directory Traversal
Because of these vulnerabilities in resize.php, the attackers can read arbitrary files in the "size" or "path" parameter. Solution Update the plugin...
WordPress FeedBurner Plugin <= 2.2 - CSRF
Because of this vulnerability, the attackers can change settings and hijack blog feeds via a request to wp-admin/options-general.php. Solution Update the plugin...
WordPress <= 2.2 - SQL Injection
Because of this vulnerability in xmlrpc.php, the authenticated users can execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall. Solution Update WordPress...
WordPress <= 2.1.2 - Security BYPASS
The authenticated users with the contributor role can bypass intended access restrictions and invoke the publishposts functionality. Solution Update the WordPress to the latest available version at least 2.1.3...
WordPress <= 2.0.4 - Denial of Service Attacks
The authenticated users can cause a denial of service attacks, because this WordPress version does not properly store a profile containing a string representation of a serialized object. Solution Update WordPress...
WordPress <= 2.0.3 - Full Path Disclosure
Because of this vulnerabilitity, attackers can obtain the installation path via a direct request to various files for the example, wp-includes directories, wp-content, and wp-admin. Solution Update the WordPress to the latest available version at least 2.0.4...
WordPress <= 2.0.0 - Cross Site Scripting
Because of this vulnerability, attackers can inject arbitrary web script or HTML via scriptable attributes such as onfocus and onblur in the "author's website" field. Solution Update the WordPress to the latest available version at least 2.0.1...
WordPress <= 1.5.1.2 - Multiple XSS vulnerabilities
Because of these vulnerabilities in post.php, attackers can inject arbitrary web script or HTML via the "p" or "comment" parameter. Solution Update the WordPress to the latest available version at least 1.5.1.3...
NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...
NPM: n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
NPM: n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...
NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service
NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...