49938 matches found
WordPress Advanced Access Manager Plugin <= 2.8.2 - Admin User File Read/Write
Because of this vulnerability, attackers can write arbitrary content to arbitrary files. Solution Update the plugin...
WordPress Huge IT Image Gallery Plugin 1.0.1 - Authenticated SQL Injection
An authenticated SQL injection allows an attacker to bypass a web application’s authentication mechanism and retrieve the contents of database. Solution Upgrade the plugin...
WordPress Amazon Affiliate Shop Plugin <= 0.9.6 - Local File Inclusion
This vulnerability is in reviews.php. It allows the attackers to read arbitrary files via a full pathname in the "url" parameter. Solution Update the plugin...
WordPress Oleggo LiveStream Plugin <= 0.2.6 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Wu Rating Plugin <= 1.0 12319 - XSS
Because of this vulnerability in wu-ratepost.php, the attackers can inject arbitrary web script or HTML via the "v" parameter. Solution Update the plugin...
WordPress Flash & HTML5 Video Plugin - Cross Site Request Forgery
This Flash & HTML5 Video plugin is prone to a CSRF vulnerability. It allows an attacker to perform certain actions that lead to further attacks. Solution Update the plugin...
WordPress TinyMCE Color Picker Plugin <= 1.1 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. Solution Update the plugin...
WordPress Ajax Pagination Plugin 1.1 - Local File Inclusion
Ajax Pagination plugin is prone to a file inclusion vulnerability. It is exploitable by an unauthenticated user, who can include any local file ending in “.php” which is accessible to the web user. Solution Upgrade the plugin...
WordPress 2.0.11 - Cross Site Request Forgery
WordPress 2.0.11 version is prone to a cross site request forgery via "/wp-admin/options-discussion.php". It allows an attacker to perform certain unauthorized actions in the context of the affected application. Solution Update WordPress...
WordPress <= 3.8.1 - Multiple vulnerabilities
The wpvalidateauthcookie function in wp-includes/pluggable.php does not properly determine the validity of authentication cookies. In that way the attackers can obtain access via a forged cookie. Solution Update the plugin...
WordPress Tweet Blender Plugin <= 4.0.1 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "tbtabindex" parameter to wp-admin/options-general.php. Solution Update the plugin...
WordPress Social Sharing Toolkit Plugin <= 2.1.1 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress WP Cleanfix Plugin - Cross Site Request Forgery
WP Cleanfix plugin is prone to a cross site request forgery vulnerability. It allows an attacker to perform certain unauthorized actions in the context of the affected application. Solution Update the plugin...
WordPress WP Photo Album Plus Plugin <= 5.0.2 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "commentid" parameter in a wppamanagecomments edit action. Solution Update the plugin...
WordPress Facebook Members Plugin <= 5.0.4 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that modify this plugin's settings. Solution Update the plugin...
WordPress Login With Ajax Plugin <= 3.0 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that modify this plugin's settings. Solution Update the plugin...
WordPress Simple Paypal Shopping Cart Plugin <= 3.5 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that change plugin settings. Solution Update the plugin...
WordPress <= 3.5.1 - Privilege Escalation
Because of this vulnerability, the authenticated users can bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. Solution Update the plugin...
WordPress <= 3.5.1 - Full Path Disclosure
Because of this vulnerability, the attackers can obtain sensitive information via an invalid upload request. Solution Update the plugin...
WordPress ZeroClipboard Plugin <= 1.0.7 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter. Solution Update the plugin...
WordPress TinyMCE Media Plugin <= 3.5.1 - Content Spoofing
A moxieplayer.as does not consider the presence of a character during extraction of the QUERYSTRING. In that way the attackers can pass arbitrary parameters to a Flash application and conduct content-spoofing attacks. Solution Update the plugin...
WordPress <= 3.5.1 - Multiple SSRF
Because of these vulnerabilities, the attackers can send HTTP requests to intranet servers via unspecified vectors. Solution Update WordPress...
WordPress WP MailUp Plugin <= 1.3.2 - XSS
This plugin is prone to cross site scripting attacks by setting the wordpressloggedin cookie. Solution Update the plugin...
WordPress SCORM Cloud Plugin <= 1.0.6 - SQL Injection
Because of this vulnerability in ajax.php, the attackers can execute arbitrary SQL commands via the "active" parameter. Solution Update the plugin...
WordPress White Label CMS Plugin <= 1.5 - XSS
Because of this vulnerability in wlcms-plugin.php, the authenticated administrators can inject arbitrary web script or HTML via the "wlcmsodevelopername" parameter. Solution Update the plugin...
WordPress Whois Search Plugin <= 1.4.2.2 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "domain" parameter. Solution Update the plugin...
WordPress Pretty Link Lite Plugin <= 1.5.5 - XSS
Because of this vulnerability in pretty-bar.php, the attackers can inject arbitrary web script or HTML via the "slug" parameter. Solution Update the plugin...
WordPress Pretty Link Lite Plugin <= 1.5.3 - XSS
Because of this vulnerability in pretty-bar.php, the attackers can inject arbitrary web script or HTML via the "slug" parameter. Solution Update the plugin...
WordPress <= 3.4.2 - CSRF
Because of this vulnerability in wp-admin/index.php, the attackers can hijack the authentication of administrators for requests. Solution Update WordPress...
WordPress <= 3.4.1 - XSS and BYPASS
Because of these vulnerabilities, authenticated users can perform cross-site scripting attacks by leveraging the Administrator or Editor role and composing crafted text and bypass intended access restrictions. Solution Update WordPress...
WordPress Soundcloud Is Gold 2.1 - Cross Site Scripting
WordPress Soundcloud Is Gold plugin's "width" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...
WordPress <= 3.3.1 - CSRF and XSS
There are cross site scripting and cross site request forgery vulnerabilities via SWF Applets. Solution Update WordPress...
WordPress All-in-One Event Calendar Plugin 1.4 - Multiple Parameter XSS
WordPress All-in-One Event Calendar plugin's /wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php multiple parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browse...
WordPress BuddyPress Plugin 1.5.5 - Remote SQL Injection
Buddypress plugin is prone to Remote SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress Slideshow Gallery Plugin 1.1.x - Cross Site Scripting
WordPress Slideshow Gallery plugin's "border" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...
WordPress Pay with Tweet Plugin <= 1.1 - Multiple Vulnerabilities
WordPress Pay with Tweet plugin is prone to a blind SQL injection and XSS vulnerabilities. Solution Update the plugin...
WordPress Grand FlAGallery Plugin 1.57 - Cross Site Scripting
WordPress Grand FlAGallery plugin's "flagshow.php" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker c...
WordPress Featurific For WordPress Plugin 1.6.2 - Cross Site Scripting
WordPress Featurific For WordPress plugin's "snum" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker c...
WordPress Advanced Text Widget Plugin 2.0 - Cross Site Scripting
WordPress Advanced Text Widget plugin's "page" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...
WordPress Morning Coffee Theme 3.5 - Cross Site Scripting
WordPress Morning Coffee theme's "index.php" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...
WordPress ZenLite Theme <= 4.3 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the theme...
WordPress Cover WP Theme 1.6.5 - Cross Site Scripting
WordPress Cover WP theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-base...
WordPress Twitter Feed Plugin <= 0.3.1 - XSS
Because of this vulnerability in magpiedebug.php, the attackers can inject arbitrary web script or HTML via the "url" parameter. Solution Update the plugin...
WordPress NextGEN Gallery Plugin <= 1.5.1 - XSS Vulnerability
This NextGEN Gallery plugin is prone to a cross-site scripting vulnerability. It is really popular plugin for the WordPress content management system, usually found as a blogging platform. The vulnerability manipulates the mode parameter of the xml/media-rss.php script and it results that...
WordPress WP-Cumulus <= 1.20 - Vulnerabilities
There are several vulnerabilities in this WordPress WP-Cumulus: cross-site scripting and full path disclosure vulnerabilities. Solution Update the WordPress...
WordPress Simple Forum Plugin - SQL Injection
Because of this vulnerability in ahah/sf-profile.php, the attackers can execute arbitrary SQL commands via the "u" parameter. Solution Update the plugin...
WordPress Download Manager Plugin <= 0.2 - Arbitrary File Upload
Because of this vulnerability in upload.php, the attackers can execute arbitrary code by uploading a file with an executable extension via the "upfile" parameter. Solution Update the plugin...
WordPress <= 2.5 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update WordPress...
WordPress Sniplets Plugin <= 1.2.2 - Remote File Inclusion
Because of this vulnerability in modules/syntaxhighlight.php, the attackers can execute arbitrary PHP code via a URL in the "libpath" parameter. Solution Update the plugin...
WordPress DMSGuestbook Plugin <= 1.8.0 - Directory Traversal
Because of this vulnerability in wp-admin/admin.php, the authenticated users can read arbitrary files. Solution Update the plugin...