47982 matches found
WordPress Lead Octopus Power Plugin - SQL Injection
This WordPress Lead Octopus Power plugin's "id" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress DZS Video Gallery Plugin - Cross Site Scripting and Command Injection Vulnerabilities
Because of these vulnerabilities in DZS Video Gallery plugin, an attacker can execute arbitrary script code in the browser and execute arbitrary OS commands. In that way an attacker can steal cookie-based authentication credentials and launch other attacks. Solution Upgrade the plugin...
WordPress Simple Share Buttons Adder Plugin 4.4 - Multiple Vulnerabilities
Simple Share Buttons Adder plugin is prone to multiple vulnerabilities CSRF and XSS that allow an attacker to convince an admin to visit a link of their choosing. Solution Update to version 4.5...
WordPress Amazon Affiliate Shop Plugin <= 0.9.6 - Local File Inclusion
This vulnerability is in reviews.php. It allows the attackers to read arbitrary files via a full pathname in the "url" parameter. Solution Update the plugin...
WordPress Wu Rating Plugin <= 1.0 12319 - XSS
Because of this vulnerability in wu-ratepost.php, the attackers can inject arbitrary web script or HTML via the "v" parameter. Solution Update the plugin...
WordPress Rezgo Online Booking Plugin <= 1.8.1 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Silverlight Media Player Plugin <= 0.8 - XSS
Because of this vulnerability in uploader.php, the attackers can inject arbitrary web script or HTML via the "postid" parameter. Solution Update the plugin...
WordPress Efence Plugin <= 1.3.2 - Multiple XSS
Because of these vulnerabilities in callback.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress BookX Plugin - Local File Include
BookX plugin's "includes/bookxexport.php" is prone to a local file include vulnerability because of failure of validation user-supplied input. It allows an attacker to get potentially sensitive information. Solution Update the plugin...
WordPress iMember360 Plugin <= 3.9.001 - Disclosure of Database Credentials
Because of this vulnerability, the attackers can obtain database credentials via the "i4wdbinfo" parameter. Solution Update the plugin...
WordPress Search Everything Plugin <= 8.1.0 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of unspecified victims via unknown vectors. Solution Update the plugin...
WordPress TinyMCE Color Picker Plugin <= 1.1 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. Solution Update the plugin...
WordPress TinyMCE Color Picker Plugin <= 1.1 - Security Bypass
Because of this vulnerability, the attackers can modify plugin settings via unspecified vectors. Solution Update the plugin...
WordPress Booking System Plugin - SQL Injection
This WordPress Booking Calendar plugin's "bookingformid" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress Kernel Theme - Remote File Upload
WordPress Kernel theme is prone to a remote file upload vulnerability. Affected file is "upload-handler.php". Solution Upgrade the theme...
WordPress Tweet Blender Plugin <= 4.0.1 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "tbtabindex" parameter to wp-admin/options-general.php. Solution Update the plugin...
WordPress Social Sharing Toolkit Plugin <= 2.1.1 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress Spreadsheet Plugin <= 2.0 - Cross Site Scripting
Because of this vulnerability in codebase/spreadsheet.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...
WordPress Simple Paypal Shopping Cart Plugin <= 3.5 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that change plugin settings. Solution Update the plugin...
WordPress WP Table Reloaded Plugin - Cross Site Scripting
WP Table Reloaded plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...
WordPress Mingle Forum Plugin <= 1.0.34 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress WP MailUp Plugin <= 1.3.2 - XSS
This plugin is prone to cross site scripting attacks by setting the wordpressloggedin cookie. Solution Update the plugin...
WordPress SCORM Cloud Plugin <= 1.0.6 - SQL Injection
Because of this vulnerability in ajax.php, the attackers can execute arbitrary SQL commands via the "active" parameter. Solution Update the plugin...
WordPress Akismet Plugin - Multiple Cross Site Scripting Vulnerabilities
WordPress Akismet plugin is prone to multiple cross-site scripting vulnerabilities. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...
WordPress Whois Search Plugin <= 1.4.2.2 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "domain" parameter. Solution Update the plugin...
WordPress Count per Day Plugin - Multiple Vulnerabilities
WordPress Count per Day plugin is prone to multiple vulnerabilities such as XSS and user could call a remote script to download arbitrary file from the target system. Solution Update the plugin...
WordPress Classipress Theme <= 3.1.4 - Stored XSS
Classipress theme is prone to a stored cross-site scripting vulnerability because of input failure through the POST parameters 'facebookid' and 'twitterid' in a registered user's profile page. It allows an attacker to inject Javascript code. Solution Update the theme...
WordPress ZenLite Theme <= 4.3 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the theme...
WordPress Twitter Feed Plugin <= 0.3.1 - XSS
Because of this vulnerability in magpiedebug.php, the attackers can inject arbitrary web script or HTML via the "url" parameter. Solution Update the plugin...
WordPress CformsII Plugin 11.5 / 13.1 - Multiple Cross-Site Scripting Vulnerabilities
CformsII plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...
WordPress WP Cumulus Plugin <= 1.21 - XSS
Because of this vulnerability in wp-cumulus.php, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress <= 2.8.0 - Multiple vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to wp-settings.php, that reveals the installation path in an error message. Solution Update WordPress...
WordPress Download Manager Plugin <= 0.2 - Arbitrary File Upload
Because of this vulnerability in upload.php, the attackers can execute arbitrary code by uploading a file with an executable extension via the "upfile" parameter. Solution Update the plugin...
WordPress <= 2.5 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update WordPress...
WordPress WP People Plugin <= 1.6.1 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "person" parameter. Solution Update the plugin...
WordPress <= 2.3.2 - Unauthorized Access Vulnerability
Because of this vulnerability, the attackers can edit posts of other blog users via unknown vectors. Solution Update WordPress...
WordPress Migration Plugin <= 1.0 - CSRF
Because of this vulnerability in deanspermalinksmigration.php, the attackers can modify the oldstructure configuration setting. Solution Update the plugin...
WordPress fGallery Plugin <= 2.4.1 - SQL Injection
Because of this vulnerability in fimrss.php, the attackers can execute arbitrary SQL commands via the "album" parameter. Solution Update the plugin...
WordPress <= 2.3.9 - SQL Injection
Because of this vulnerability, the attackers can obtain sensitive information via an invalid "p" parameter. Solution Update WordPress...
WordPress Captcha Plugin <= 2.5 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress BackUpWordPress Plugin <= 0.4.2 - Remote File Inclusion
Because og this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "bkpwppluginpath" parameter. Solution Update the plugin...
WordPress Vistered Little Theme - XSS
Because of this vulnerability in 404.php, the attackers can inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. Solution Update the theme...
WordPress AndyBlue Theme - XSS
Because of this vulnerability in searchform.php, the attackers can inject arbitrary web script or HTML. Solution Update the theme...
WordPress Article Management Plugin <= 3.40 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "wcHeadlines" parameter. Solution Update the WordPress Article Management plugin to the latest available version at least 3.41...
WordPress <= 2.0.2 - Shell Injection
Because of this vulnerability in vars.php, the attackers can spoof their IP address via a PCREMOTEADDR HTTP header and include a remote file. Solution Update the WordPress to the latest available version at least 2.0.3...
WordPress <= 2.0.0 - Cross Site Scripting
Because of this vulnerability, attackers can inject arbitrary web script or HTML via scriptable attributes such as onfocus and onblur in the "author's website" field. Solution Update the WordPress to the latest available version at least 2.0.1...
WordPress <= 1.5.1.2 - Multiple Vulnerabilities #1
Because of these vulnerabilities in wp-login.php, the attackers can change the content of the forgotten password e-mail message via the message variable, that is not initialized before use. Solution Update the WordPress to the latest available version at least 1.5.1.3...
WordPress <= 1.5.1.2 - Multiple Vulnerabilities #2
Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to menu-header.php or a value in the "feed" parameter to wp-atom.php. Solution Update the Wordpress to the latest available version at least 1.5.1.3...
NPM: n8n: Authenticated code execution in the n8n Git node
NPM: n8n: Authenticated code execution in the n8n Git node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...
NPM: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
NPM: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning vulnerability discovered by ? in WordPress Npm axios versions = 0.31.1, 0.33.0...