49993 matches found
WordPress <=3.9.1 - Multiple Vulnerabilities #1
wp-includes/pluggable.php does not use delimiters during concatenation of action values and uid values in CSRF tokens, that allows the attackers to bypass a CSRF protection mechanism via a brute-force attack. Related records:...
WordPress DZS Video Gallery Plugin - Cross Site Scripting and Command Injection Vulnerabilities
Because of these vulnerabilities in DZS Video Gallery plugin, an attacker can execute arbitrary script code in the browser and execute arbitrary OS commands. In that way an attacker can steal cookie-based authentication credentials and launch other attacks. Solution Upgrade the plugin...
WordPress Silverlight Media Player Plugin <= 0.8 - XSS
Because of this vulnerability in uploader.php, the attackers can inject arbitrary web script or HTML via the "postid" parameter. Solution Update the plugin...
WordPress Participants Database Plugin 1.5.4.8 - SQL Injection
SQL Injection in Participants Database plugin allows an unauthenticated user to execute arbitrary SQL statements. Solution Update the plugin...
WordPress BookX Plugin - Local File Include
BookX plugin's "includes/bookxexport.php" is prone to a local file include vulnerability because of failure of validation user-supplied input. It allows an attacker to get potentially sensitive information. Solution Update the plugin...
WordPress Search Everything Plugin <= 8.1.0 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of unspecified victims via unknown vectors. Solution Update the plugin...
WordPress Search Everything Plugin <= 7.0.2 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "s" parameter to index.php. Solution Update the plugin...
WordPress Download Manager Free & Pro Plugin 2.5.8 - Persistent Cross Site Scripting
Download Manager Free & Pro plugin is prone to a persistent XSS vulnerability. The title input field is not sanitized and therefor vulnerable to persistent cross site scripting. Solution Upgrade the plugin...
WordPress SAICO Theme 1.0-1.0.2 - Arbitrary File Upload
WordPress SAICO theme is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Upgrade the theme...
WordPress Lazy SEO Plugin 1.1.9 - Shell Upload
This Lazy SEO plugin is prone to a shell upload vulnerability, in which the administrator or author could upload shell script, in the other words, default settings. Solution Update the plugin...
WordPress <= 3.6.0 - Cross Site Scripting #1
Because of this vulnerability, remote authenticated users can conduct cross-site scripting attacks. Solution Update WordPress...
WordPress <= 3.6.0 - Cross Site Scripting #2
Because of this vulnerability, remote authenticated users can conduct cross-site scripting attacks via a crafted file, that is related to the getallowedmimetypes function in wp-includes/functions.php. Solution Update WordPress...
WordPress WP MailUp Plugin <= 1.3.1 - BYPASS
Because of this vulnerability, the attackers can modify plugin settings and conduct cross-site scripting attacks via unspecified vectors. Solution Update the plugin...
WordPress <= 3.5.1 - Full Path Disclosure
Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the plugin...
WordPress <= 3.5.1 - Privilege Escalation
Because of this vulnerability, the authenticated users can bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. Solution Update the plugin...
WordPress ZeroClipboard Plugin <= 1.0.7 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter. Solution Update the plugin...
WordPress Responsive Logo Slideshow Plugin - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "URL and Image" field. Solution Update the plugin...
WordPress NextGEN Gallery Plugin - Path Disclosure Vulnerability
This NextGEN Gallery plugin is prone to a path-disclosure vulnerability. It allows anr attacker to obtain sensitive information that may lead to further attacks. Solution Update the plugin...
WordPress Sentinel Plugin <= 1.0.0 - CSRF
Because of this vulnerability in wordpresssentinel.php, the attackers can hijack the authentication of an administrator for requests that trigger snapshots. Solution Update the plugin...
WordPress SCORM Cloud Plugin <= 1.0.6 - SQL Injection
Because of this vulnerability in ajax.php, the attackers can execute arbitrary SQL commands via the "active" parameter. Solution Update the plugin...
WordPress Mingle Forum Plugin <= 1.0.32 - Multiple SQL Injection #2
Because of these vulnerabilities in fs-admin/fs-admin.php, the authenticated users can execute arbitrary SQL commands via the "usergroup" parameter in an addusertogroup action or "addforumgroupid" parameter in an addforumsubmit action. Solution Update the plugin...
WordPress Bad Behavior Plugin <= 2.2.4 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress 2 Click Social Media Buttons Plugin <= 0.33 - XSS
Because of this vulnerability in libs/xing.php, the attackers can inject arbitrary web script or HTML via the "xing-url" parameter. Solution Update the plugin...
WordPress MM Forms Community Plugin 2.2.6 - Arbitrary File Upload
MM Forms Community plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible...
WordPress Login With Ajax Plugin <= 3.0.4.0 - XSS #2
Because of this vulnerability in login-with-ajax.php, the attackers can inject arbitrary web script or HTML via the "callback" parameter. Solution Update the plugin...
WordPress <= 3.3.1 - XSS #2
The attackers can conduct cross-site scripting attacks via unspecified vectors, because of wp-includes/formatting.php in attempts to enable clickable links inside attributes. Solution Update WordPress...
WordPress s2Member Pro Plugin
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "s2memberproauthnetcheckoutcoupon" parameter. Solution Update the plugin...
WordPress Video Embed & Thumbnail Generator Plugin <= 1.9 - Remote Code Execution
Because of this vulnerability, the attackers can execute arbitrary commands via unspecified vectors. Solution Update the plugin...
WordPress Redirection Plugin <= 2.2.9 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist. Solution Update the plugin...
WordPress Jetpack Plugin - SQL Injection
Jetpack plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress Pixiv Custom Theme 2.1.5 - Cross Site Scripting
WordPress Pixiv Custom theme's "cpage" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...
WordPress AdRotate Plugin <= 3.6.5 - SQL Injection
AdRotate plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress Register Plus Plugin <= 3.5.1 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to dashwidget.php and register-plus.php. Solution Update the plugin...
WordPress Embedded Video Plugin <= 4.1 - XSS
Because of this vulnerability in lembedded-video.php, the attackers can inject arbitrary web script or HTML via the "content" parameter to wp-admin/post.php. Solution Update the plugin...
WordPress <= 2.7.1 - Information Disclosure
Because of this vulnerability, the attackers can obtain sensitive information by reading the HTML source. Solution Update WordPress...
WordPress FireStats Plugin <= 1.6.1 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via unspecified vectors. Solution Update the plugin...
WordPress <= 2.3.2 - Multiple XSS vulnerabilities
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...
WordPress Footnotes Plugin <= 2.2 - Multiple XSS vulnerabilities
Because of these vulnerabilities in adminpanel.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress <= 2.0.9 - Multiple XSS
Because of these vulnerabilitie, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...
WordPress Captcha Plugin <= 2.5 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress BackUpWordPress Plugin <= 0.4.2 - Remote File Inclusion
Because og this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "bkpwppluginpath" parameter. Solution Update the plugin...
WordPress FeedBurner Plugin <= 2.2 - CSRF
Because of this vulnerability, the attackers can change settings and hijack blog feeds via a request to wp-admin/options-general.php. Solution Update the plugin...
WordPress <= 2.2.3 - XSS
The attackers can conduct cross-site scripting XSS attacks via modified data to post.php or page.php with a nofilter field. Solution Update WordPress...
WordPress Unnamed Theme <= 1.217 - XSS
Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the theme...
WordPress <= 2.1.2 - Security BYPASS
The authenticated users with the contributor role can bypass intended access restrictions and invoke the publishposts functionality. Solution Update the WordPress to the latest available version at least 2.1.3...
WordPress <= 2.0.5 - Multiple vulnerabilities #1
Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request for wp-content/themes/default/index.php, links.php, sidebar.php, livejournal.php, hello.php, mt.php, page.php, rss.php, search.php, searchform.php, 404.php, wp-db-backup.php, akismet.php,...
NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...
NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service
NPM: Axios: Excessive recursion in formDataToJSON can cause denial of service vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.33.0...
NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete
NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/path — arbitrary host file read/write/delete vulnerability discovered by ? in WordPress Npm obsidian-local-rest-api versions 4.1.3...
NPM: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
NPM: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...