48064 matches found
WordPress Google Document Embedder Plugin <= 2.5.18 - XSS
This vulnerability allows an attacker to inject arbitrary web script or HTML via the "profile" parameter in the gde-settings page to wp-admin/options-general.php. Solution Upgrade the plugin...
WordPress Spider Facebook Plugin <= 1.0.10 - Multiple XSS
Because of these vulnerabilities, some parameters are shown unsanitized. Solution Upgrade the plugin...
WordPress Pie Register Plugin 2.0.13 - Privilege Escalation
This vulnerability allows anyone to import CSV file and the plugin import users from this "pie-register\pie-register.php" file. Solution Update to version 2.0.14...
WordPress All In One WP Security & Firewall Plugin <= 3.8.7 - SQL Injection
Because of this SQL Injection vulnerability, attackers can execute arbitrary SQL commands via unspecified vectors. Solution Upgrade the plugin...
WordPress All in One SEO Pack Plugin <= 2.2.5 - Information Management
All in One SEO Pack plugin is prone to an information management vulnerability. The attackers can obtain sensitive information by reading HTML source code, because this plugin does not consider the presence of password protection during generation of the Meta Description field. Solution Update th...
WordPress Shopping Cart Plugin 3.0.4 - Unrestricted File Upload
Shopping Cart plugin is prone to an unrestricted file upload vulnerability. Because of incorrect if statement inside "banneruploaderscript.php", any registered user can upload any file. Solution Upgrade the plugin...
WordPress Our Team Showcase Plugin <= 1.2 - Multiple CSRF and XSS
Because of these cross-site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way, they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...
WordPress Simple Visitor Stat Plugin <= 4.5.2 BYPASS
Because of these vulnerabilities, the attackers can inject arbitrary HTML or web script via the HTTP User-Agent or HTTP Referer header. Solution No fix have been released...
WordPress Relevanssi Plugin <= 3.3.7 - XSS
This vulnerability allows the attackers to inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress Sliding Social Icons Plugin <= 1.61 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution No fix available, because the plugin has...
WordPress Simple Sticky Footer Plugin <= 1.3.2 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...
WordPress Wp Unique Article Header Image Plugin <= 1.0 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution There is no solution, because plugin is...
WordPress HTML5 MP3 Player with Playlist Free Plugin <= 2.6 - Full Path Disclosure
Because of this vulnerability, the attackers can obtain the installation path via a request to html5plus/playlist.php. Solution Upgrade the plugin...
WordPress XCloner Plugin - Multiple Vulnerabilities
XCloner plugin is prone to multiple vulnerabilities, such as: unauthenticated remote access to backup files via easily guessable file names, arbitrary command execution and authenticated remote file access. Also, clear text MySQL password exposure through HTML text box. Solution Upgrade the plugi...
WordPress Spreadsheet Plugin <= 0.62- SQL Injection
This Spreadsheet plugin is prone to an SQL injection vulnerability, that allows the attackers to execute arbitrary SQL commands via the "ssid" parameter. Solution Update the plugin...
WordPress Advanced Access Manager Plugin <= 2.8.2 - Admin User File Read/Write
Because of this vulnerability, attackers can write arbitrary content to arbitrary files. Solution Update the plugin...
WordPress Web-Dorado Photo Gallery Plugin <= 1.1.30 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "callback", "dir", or "extensions" parameters. Solution Update the plugin...
WordPress <= 3.9.1 - XSS
This vulnerability is in the wp-includes/pluggable.php. It allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. Solution Update WordPress...
WordPress Easy Post Types Plugin <= 1.4.3 - XSS
Because of this vulnerability in classes/custom-image/media.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress HTML5 Video Player with Playlist Plugin <= 2.4.0 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress VideoWhisper Live Streaming Integration Plugin <= 4.27.2 - XSS
Because of this vulnerability in ls/vvlogin.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress WP Plugin Manager Plugin <= 1.6.4.b - XSS
Because of this vulnerability in wp-plugins-net/index.php, the attackers can inject arbitrary web script or HTML via the "filter" parameter. Solution Update the plugin...
WordPress Flash & HTML5 Video Plugin - Cross Site Request Forgery
This Flash & HTML5 Video plugin is prone to a CSRF vulnerability. It allows an attacker to perform certain actions that lead to further attacks. Solution Update the plugin...
WordPress Participants Database Plugin 1.5.4.8 - SQL Injection
SQL Injection in Participants Database plugin allows an unauthenticated user to execute arbitrary SQL statements. Solution Update the plugin...
WordPress TinyMCE Color Picker Plugin <= 1.1 - Security Bypass
Because of this vulnerability, the attackers can modify plugin settings via unspecified vectors. Solution Update the plugin...
WordPress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities
WordPress iMember360 plugin is prone to multiple vulnerabilities, such as XSS, arbitrary user deletion, arbitrary code execution and disclosure of database credentials vulnerabilities. Solution Upgrade the plugin...
WordPress WP Forum Server Plugin <= 1.7.4 - XSS
Because of this vulnerability in fs-admin/wpf-add-forum.php, the attackers can inject arbitrary web script or HTML via the "groupid" parameter. Solution Update the plugin...
WordPress S3 Video Plugin <= 0.982 - XSS
Because of this vulnerability in views/video-management/previewvideo.php, the attackers can inject arbitrary web script or HTML via the "base" parameter. Solution Update the plugin...
WordPress <= 3.8.1 - Multiple vulnerabilities
The wpvalidateauthcookie function in wp-includes/pluggable.php does not properly determine the validity of authentication cookies. In that way the attackers can obtain access via a forged cookie. Solution Update the plugin...
WordPress Jetpack Plugin <= 2.9.2 - Security BYPASS
This plugin does not properly restrict access to the XML-RPC service. In that way the attackers can bypass intended restrictions and publish posts via unspecified vectors. Solution Update the plugin...
WordPress prettyPhoto Plugin <= 3.1.4 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via a crafted PATHINTO to the default URI. Solution Update the plugin...
WordPress SAICO Theme 1.0-1.0.2 - Arbitrary File Upload
WordPress SAICO theme is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the theme...
WordPress WP Cleanfix Plugin - Cross Site Request Forgery
WP Cleanfix plugin is prone to a cross site request forgery vulnerability. It allows an attacker to perform certain unauthorized actions in the context of the affected application. Solution Update the plugin...
WordPress Apptha Video Gallery Plugin <= 2.0 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "playid" parameter to index.php. Solution Update the plugin...
WordPress WP Photo Album Plus Plugin <= 5.0.2 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "commentid" parameter in a wppamanagecomments edit action. Solution Update the plugin...
WordPress Login With Ajax Plugin <= 3.0 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that modify this plugin's settings. Solution Update the plugin...
WordPress LeagueManager Plugin 3.8 - SQL Injection
LeagueManager plugin is prone to an SQL injection that exists in the "leagueid" parameter of a function call made by the leaguemanagerexport page. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit...
WordPress <= 3.5.1 - Full Path Disclosure
Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the plugin...
WordPress TinyMCE Media Plugin <= 3.5.1 - Content Spoofing
A moxieplayer.as does not consider the presence of a character during extraction of the QUERYSTRING. In that way the attackers can pass arbitrary parameters to a Flash application and conduct content-spoofing attacks. Solution Update the plugin...
WordPress SWFUpload Plugin <= 3.5.1 - XSS
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
WordPress Pretty Link Lite Plugin <= 1.5.5 - XSS
Because of this vulnerability in pretty-bar.php, the attackers can inject arbitrary web script or HTML via the "slug" parameter. Solution Update the plugin...
WordPress Pretty Link Lite Plugin <= 1.5.3 - XSS
Because of this vulnerability in pretty-bar.php, the attackers can inject arbitrary web script or HTML via the "slug" parameter. Solution Update the plugin...
WordPress Bad Behavior Plugin <= 2.2.4 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Soundcloud Is Gold 2.1 - Cross Site Scripting
WordPress Soundcloud Is Gold plugin's "width" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...
WordPress <= 3.3.1 - CSRF and XSS
There are cross site scripting and cross site request forgery vulnerabilities via SWF Applets. Solution Update WordPress...
WordPress Video Embed & Thumbnail Generator Plugin <= 1.9 - Remote Code Execution
Because of this vulnerability, the attackers can execute arbitrary commands via unspecified vectors. Solution Update the plugin...
WordPress Slideshow Gallery Plugin 1.1.x - Cross Site Scripting
WordPress Slideshow Gallery plugin's "border" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...
WordPress <= 3.1.0 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update WordPress...
WordPress Morning Coffee Theme 3.5 - Cross Site Scripting
WordPress Morning Coffee theme's "index.php" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...
WordPress Cover WP Theme 1.6.5 - Cross Site Scripting
WordPress Cover WP theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-base...