52802 matches found
WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities
TheCartPress plugin is prone to multiple vulnerabilities, such as local PHP file inclusion, stored XSS, improper access control and multiple XSS vulnerabilities. Solution Update the plugin...
WordPress <= 4.1.1 - XSS
Because of this vulnerability, an attacker can execute same-origin JavaScript functions via the "target" parameter, as demonstrated by executing a certain click function, related to init.as and fireEvent.as. Solution Update WordPress...
WordPress Welcart Plugin <= 1.4.17 - Multiple XSS
These vulnerabilities allow the attackers to inject arbitrary web script or HTML via the "uscesreferer" parameter to: includes/edit-form-advanced.php, includes/edit-form-advanced34.php, classes/usceshop.class.php, includes/membereditform.php, includes/orderlist.php, includes/ordereditform.php,...
WordPress Photocrati Theme - Cross Site Scripting
Because of this vulnerability in photocrati-gallery/ecomm-sizes.php, the attackers can inject arbitrary web script or HTML via the "prodid" parameter. Solution Update the theme...
WordPress Captcha Plugin <= 4.0.6 - BYPASS
Because of this vulnerability, remote attackers can bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors. Solution Update the plugin...
WordPress HTML5 MP3 Player with Playlist Free Plugin <= 2.6 - Full Path Disclosure
Because of this vulnerability, the attackers can obtain the installation path via a request to html5plus/playlist.php. Solution Upgrade the plugin...
WordPress Download Manager Plugin 2.7.2 - Privilege Escalation
Download Manager plugin is prone tu vulnerability that allows an attacker to take control of every group change name, description, avatar and settings. In this case, every registered user can update every WordPress options using basicsettings function. Solution Update to version 2.7.3...
WordPress Another Classifieds Plugin - SQL Injection
This WordPress GD Star Rating plugin's "keywordphrase" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database when doing a search for classifieds. Solution...
WordPress XCloner Plugin <= 3.1.1 - Remote Database Download & Local File Permissions
The attackers can obtain sensitive information via a direct request to a backup file in administrators/backups/, because the plugin stores database backup files with predictable names under the web root with insufficient access control. Solution Update the plugin...
WordPress Pods Plugin <= 2.4 - Multiple CSRF
Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks via the "toggled" parameter in the pods-components page to wp-admin/admin.php, reset pod settings and data via the "podsreset" parameter in the...
WordPress Mulitple Themes - Arbitrary File Download
Multiple WordPress themes are prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Upgrade themes...
WordPress <= 3.9.1 - Unsafe Serialization
wp-includes/class-wp-customize-widgets.php in the widget implementation in allow the attackers to execute arbitrary code via crafted serialized data. Solution Update WordPress...
WordPress Malware Finder Plugin <= 1.1 - XSS
Because of this vulnerability in process.php, the attackers can inject arbitrary web script or HTML via the "query" parameter. Solution Update the plugin...
WordPress Silverlight Media Player Plugin <= 0.8 - XSS
Because of this vulnerability in uploader.php, the attackers can inject arbitrary web script or HTML via the "postid" parameter. Solution Update the plugin...
WordPress Participants Database Plugin 1.5.4.8 - SQL Injection
SQL Injection in Participants Database plugin allows an unauthenticated user to execute arbitrary SQL statements. Solution Update the plugin...
WordPress Tera Charts Plugin - Remote Path Traversal File Disclosure
Tera Charts plugin's zoomabletreemap.php "fn" parameter is prone to remote path traversal file disclosure vulnerability that allow an attacker to get potentially sensitive information. Other attacks are also possible. Solution Update the plugin...
WordPress Bib2html Plugin <= 0.9.3 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress TinyMCE Color Picker Plugin <= 1.1 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors. Solution Update the plugin...
WordPress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities
WordPress iMember360 plugin is prone to multiple vulnerabilities, such as XSS, arbitrary user deletion, arbitrary code execution and disclosure of database credentials vulnerabilities. Solution Upgrade the plugin...
WordPress Advanced Dewplayer Plugin - Script Directory Traversal
Advanced Dewplayer plugin is prone to a directory traversal vulnerability because of failure of cleaning up user-supplied input. An attacker can obtain sensitive information that could aid in further attacks. Solution Upgrade the plugin...
WordPress <= 3.8.1 - Privilege Escalation
Because of this vulnerability, authenticated users can publish posts. Solution Update the plugin...
WordPress Landing Pages Plugin <=1.2.3 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "post" parameter to index.php. Solution Update the plugin...
WordPress Hms Testimonials Plugin 2.0.10 - Multiple Vulnerabilities
Hms Testimonials plugin is prone to multiple vulnerabilities, such as cross-site scripting and cross-site request forgery vulnerabilities. Solution Update the plugin...
WordPress Login With Ajax Plugin <= 3.0 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that modify this plugin's settings. Solution Update the plugin...
WordPress Facebook Members Plugin <= 5.0.4 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that modify this plugin's settings. Solution Update the plugin...
WordPress Symposium Plugin <= 13.03 - XSS
Because of this vulnerability in invite.php in, the attackers can inject arbitrary web script or HTML via the "u" parameter. Solution Update the plugin...
WordPress NextGEN Gallery Plugin - Path Disclosure Vulnerability
This NextGEN Gallery plugin is prone to a path-disclosure vulnerability. It allows anr attacker to obtain sensitive information that may lead to further attacks. Solution Update the plugin...
WordPress WP Table Reloaded Plugin - Cross Site Scripting
WP Table Reloaded plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...
WordPress FCChat Widget Plugin 2.2.x - Arbitrary File Upload
FCChat Widget plugin's "Upload.php" is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also...
WordPress Login With Ajax Plugin <= 3.0.4.0 - XSS #2
Because of this vulnerability in login-with-ajax.php, the attackers can inject arbitrary web script or HTML via the "callback" parameter. Solution Update the plugin...
WordPress Kish Guest Posting Plugin 1.0 - Arbitrary File Upload
Kish Guest Posting plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible...
WordPress Pay with Tweet Plugin <= 1.1 - Multiple Vulnerabilities
WordPress Pay with Tweet plugin is prone to a blind SQL injection and XSS vulnerabilities. Solution Update the plugin...
WordPress TheCartPress Plugin 1.6 - Cross Site Scripting
WordPress TheCartPress plugin's "OptionsPostsList.php" is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...
WordPress Featurific For WordPress Plugin 1.6.2 - Cross Site Scripting
WordPress Featurific For WordPress plugin's "snum" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker c...
WordPress Jetpack Plugin - SQL Injection
Jetpack plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress RedLine Theme 1.65 - Cross Site Scripting
WordPress RedLine theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...
WordPress ZenLite Theme <= 4.3 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the theme...
WordPress Symposium Plugin <= 11.12.07 - XSS
Because of this vulnerability in uploadify/getprofileavatar.php, the attackers can inject arbitrary web script or HTML via the "uid" parameter. Solution Update the plugin...
WordPress <= 3.1.2 - Multiple Unspecified Remote vulnerabilities
Because of these vulnerabilities, the attackers can determine usernames of non-authors via canonical redirects. Solution Update WordPress...
WordPress Custom Pages Plugin 0.5.0.1 - Local File Inclusion
This vulnerability can be exploited to include arbitrary files. Solution Update the plugin...
WordPress Register Plus Plugin <= 3.5.1 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to dashwidget.php and register-plus.php. Solution Update the plugin...
WordPress WP-Cumulus <= 1.20 - Vulnerabilities
There are several vulnerabilities in this WordPress WP-Cumulus: cross-site scripting and full path disclosure vulnerabilities. Solution Update the WordPress...
WordPress <= 2.6.9 - Open Redirection
Because of this vulnerability in wp-admin/upgrade.php, the attackers can redirect users to arbitrary web sites and conduct phishing attacks via a URL in the "backto" parameter. Solution Update WordPress...
WordPress <= 1.3.1 - Remote Code Execution
Because of this vulnerability, the authenticated users with manageoptions and uploadfiles capabilities can execute arbitrary code by uploading a PHP script. Solution Update WordPress...
WordPress <= 2.6.1 - SQL Truncation Vulnerability #1
Because of this vulnerability, the attackers can leverage exposures in products that rely on these functions for security-relevant functionality. Solution Update WordPress...
WordPress Download Manager Plugin <= 0.2 - Arbitrary File Upload
Because of this vulnerability in upload.php, the attackers can execute arbitrary code by uploading a file with an executable extension via the "upfile" parameter. Solution Update the plugin...
WordPress <= 2.3.2 - Multiple XSS vulnerabilities
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...
WordPress <= 2.0.11 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive information via an empty value of the "page" parameter to certain PHP scripts under wp-admin/. Solution Update WordPress...
WordPress BackUpWordPress Plugin <= 0.4.2 - Remote File Inclusion
Because og this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "bkpwppluginpath" parameter. Solution Update the plugin...