49993 matches found
WordPress Easy2Map Plugin 1.24 - SQL Injection
This WordPress Easy2Map plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress RobotCPA Plugin - Local File Inclusion
BookX plugin's get parameter "l" is prone to a local file include vulnerability because of failure of validation user-supplied input. It allows an attacker to get potentially sensitive information. The affected file is "f.php". Solution Update the plugin...
WordPress Landing Pages Plugin <= 1.8.4 - SQL Injection
Thisvulnerability allows an authenticated user to execute arbitrary SQL commands in an edit delete-variation action via the "post" parameter to wp-admin/post.php. Solution Upgrade the plugin...
WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities
TheCartPress plugin is prone to multiple vulnerabilities, such as local PHP file inclusion, stored XSS, improper access control and multiple XSS vulnerabilities. Solution Update the plugin...
WordPress Navis DocumentCloud Plugin <= 0.1.0 - XSS
This vulnerability is in js/window.php. It allows an attacker to inject arbitrary web script or HTML via the "wpbase" parameter. Solution Update the plugin...
WordPress <= 4.2.3 - SQL Injection
Because of this vulnerability, an attacker can execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash. Solution Update WordPress...
WordPress DesignFolio Plus Theme 1.2 - Arbitrary File Upload
WordPress DesignFolio Plus theme is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Update the theme...
WordPress EasyCart Plugin <= 3.0.20 - Privilege Escalation
Because of this vulnerability, attackers can do privilege escalation and remote code execution. Solution Update the plugin...
WordPress Spider Facebook Plugin <= 1.0.10 - Multiple XSS
Because of these vulnerabilities, some parameters are shown unsanitized. Solution Upgrade the plugin...
WordPress Photocrati Theme - Cross Site Scripting
Because of this vulnerability in photocrati-gallery/ecomm-sizes.php, the attackers can inject arbitrary web script or HTML via the "prodid" parameter. Solution Update the theme...
WordPress Another WordPress Classifieds Plugin - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the query string to the default URI. Solution Update the plugin...
WordPress Symposium Plugin 14.11 - Shell Upload
Symposium plugin is prone to a shell upload vulnerability. It allows an attacker to execute arbitrary PHP code by making a direct request to the uploaded .php file. Solution Update the plugin...
WordPress All In One WP Security & Firewall Plugin <= 3.8.7 - SQL Injection
Because of this SQL Injection vulnerability, attackers can execute arbitrary SQL commands via unspecified vectors. Solution Upgrade the plugin...
WordPress All In One WP Security & Firewall Plugin <= 3.8.9 - CSRF
Because of this vulnerability, attacker can hijack the authentication of administrators for requests that delete logs of 404 HTTP status codes. Solution Update the plugin...
WordPress Sliding Social Icons Plugin <= 1.61 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution No fix available, because the plugin has...
WordPress Wp Unique Article Header Image Plugin <= 1.0 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution There is no solution, because plugin is...
WordPress SimpleFlickr Plugin <= 3.0.3 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress jRSS Widget Plugin <= 1.2 - SSRF
This vulnerability is in the proxy.php. It allows the attackers to trigger outbound requests and enumerate open ports via the "URL" parameter. Solution Update the plugin...
WordPress Apptha Video Gallery Plugin <= 2.5 - Multiple SQL Injection
Because of these vulnerabilities, the attackers can execute arbitrary SQL commands via the "videoId" parameter in a newvideo page to wp-admin/admin.php, "vid" parameter in a myextract action to wp-admin/admin-ajax.php or "playlistId" parameter in the newplaylist page. Solution Update the plugin...
WordPress CM Download Manager Plugin 2.0.0 - Code Injection
Code injection vulnerability was found in the software and confirmed as an anonymous user. It allows an attacker to gain full control of the application and use all operating system functions. Solution Update to version 2.0.4...
WordPress <= 4.0.0 - Multiple Vulnerabilities #1
There are multiple vulnerabilities in WordPress wp-login.php, such as cross site scripting, denial of service attacks, hash comparison, SSRF, CSRF. Because of these vulnerabilities, attackers can reset passwords by leveraging access to an e-mail account that received a password-reset message...
WordPress <= 4.0.0 - CSRF
Because of this vulnerability in wp-login.php, the attackers can hijack the authentication of arbitrary users for requests that reset passwords. Solution Update WordPress...
WordPress ShortCode Plugin 0.2.3 - Local File Inclusion
This vulnerability can be exploited to include arbitrary files. Solution Upgrade the plugin...
WordPress MailPoet (Wysija NewsLetters) plugin - Unauthenticated File Upload
MailPoet Wysija NewsLetters plugin is prone to an unauthenticated file upload vulnerability. The plugin uses the "admininit" hook that is executed for unauthenticated users when accessing a specific URL. Solution Upgrade the plugin...
WordPress VideoWhisper Live Streaming Integration Plugin <= 4.27.2 - XSS
Because of this vulnerability in ls/vvlogin.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Conversion Ninja Plugin - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter to lp/index.php. Solution Update the plugin...
WordPress Buddypress Plugin 1.9.1 - Privilege Escalation
Buddypress plugin is prone tu vulnerability that allows an attacker to take control of every group change name, description, avatar and settings. Solution Upgrade the plugin...
WordPress Social Sharing Toolkit Plugin <= 2.1.1 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress <= 3.6.0 - Cross Site Scripting #2
Because of this vulnerability, remote authenticated users can conduct cross-site scripting attacks via a crafted file, that is related to the getallowedmimetypes function in wp-includes/functions.php. Solution Update WordPress...
WordPress <= 3.6.0 - Arbitrary Code Execution
Unsafe PHP unserialization in wp-includes/functions.php could cause arbitrary code execution. Solution Update the plugin...
WordPress <= 3.5.1 - Denial of Service Attacks
This WordPress version is prone to denial of service attacks via a crafted value of a certain wp-postpass cookie. Solution Update WordPress...
WordPress Mingle Forum Plugin <= 1.0.34 - Multiple CSRF
Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests. Solution Update the plugin...
WordPress Sentinel Plugin <= 1.0.0 - Cross Site Scripting
Because of this vulnerability in wordpresssentinel.php, the attackers can inject arbitrary web script or HTML via unknown vectors. Solution Update the plugin...
WordPress Zingiri Plugin <= 1.4.3 - Directory Traversal
Because of this vulnerability in forum.php, attackers can read arbitrary files in the "url" parameter to index.php. Solution Update the plugin...
WordPress Better WP Security Plugin <= 3.2.4 - Multiple XSS
Because of this vulnerabilities, the attackers can inject arbitrary web script or HTML via unspecified vectors related to "server variables". Solution Update the plugin...
WordPress Zingiri Web Shop Plugin <= 2.3.9 - Multiple vulnerabilities
This plugin has unknown impact and attack vectors. Solution Update the plugin...
WordPress <= 3.3.1 - BYPASS
This vulnerability allows the authenticated site administrators to bypass intended access restrictions via unspecified vectors. Solution Update WordPress...
WordPress <= 0.70 - PHP remote file inclusion
Because of this vulnerability in wp-links/links.all.php, attackers can execute arbitrary PHP code via a URL in the $abspath variable. Solution Update the plugin...
WordPress Featurific For WordPress Plugin 1.6.2 - Cross Site Scripting
WordPress Featurific For WordPress plugin's "snum" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker c...
WordPress Classipress Theme <= 3.1.4 - Stored XSS
Classipress theme is prone to a stored cross-site scripting vulnerability because of input failure through the POST parameters 'facebookid' and 'twitterid' in a registered user's profile page. It allows an attacker to inject Javascript code. Solution Update the theme...
WordPress WPtouch Plugin - SQL Injection Vulnerability
WPtouch plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress <= 3.1.2 - Multiple vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive data via vectors related to wp-includes/post.php. Solution Update WordPress...
WordPress <= 3.1.2 - SQL Injection
wp-includes/taxonomy.php has unknown impact and attack vectors, that possibly involving SQL injection. Solution Update WordPress...
WordPress Custom Pages Plugin 0.5.0.1 - Local File Inclusion
This vulnerability can be exploited to include arbitrary files. Solution Update the plugin...
WordPress <= 3.0.4 - Multiple Security Vulnerabilities
Because of these vulnerabilities, remote authenticated users can read draft posts or private posts via a modified "attachmentid" parameter. Solution Update WordPress...
WordPress FileManager Plugin <= 1.2 - Arbitrary File Upload
Because of this vulnerability in ajaxfilemanager.php, the attackers can upload and execute arbitrary PHP code via unspecified vectors. Solution Update the plugin...
WordPress <= 2.0.11 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive information via an empty value of the "page" parameter to certain PHP scripts under wp-admin/. Solution Update WordPress...
WordPress <= 2.3.1 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "s" parameter. Solution Update WordPress...
WordPress <= 2.2.1 - XSS
Because of this vulnerability in the wp-admin/includes/upload.php, the attackers can inject arbitrary web script or HTML via the "style" parameter. Solution Update WordPress...