47928 matches found
WordPress Cart66 Lite Plugin <= 1.5.3 - SQL Injection
This vulnerability allows authenticated users to execute arbitrary SQL commands via the "q" parameter in a promotionProductSearch action to wp-admin/admin-ajax.php. Solution Update the plugin...
WordPress Sodahead Polls Plugin <= 2.0.3 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress PhotoSmash Plugin <= 1.0.1 - XSS
Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the "action" parameter. Solution Update the plugin...
WordPress TweetScribe Plugin <= 1.1 - CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...
WordPress wpCommentTwit Plugin <= 0.5 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Captcha Plugin <= 4.0.6 - BYPASS
Because of this vulnerability, remote attackers can bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors. Solution Update the plugin...
WordPress InfusionSoft Plugin - Upload Vulnerability
InfusionSoft plugin is prone to vulnerability that allows for arbitrary file upload and remote code execution. Solution Update the plugin...
WordPress Enfold Theme <= 3.0.0 - Unspecified Vulnerability
Because of this vulnerability in the folder framework, this theme has unknown impact and attack vectors. Solution Update the theme...
WordPress NEX-Forms Lite Plugin <= 2.1.0 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "formfields" parameter. Solution Update the plugin...
WordPress WP Ban Plugin <= 1.6.3 - BYPASS
Because of this vulnerability, the attackers can bypass the IP blacklist via a crafted X-Forwarded-For header. Solution Update the plugin...
WordPress <=3.9.1 - Multiple Vulnerabilities #2
wp-includes/pluggable.php rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, that allows the attackers to bypass a CSRF protection mechanism via a brute-force attack. Related records:...
WordPress Zedity Plugin <= 2.4.0 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Upgrade the plugin...
WordPress Delicious Magazine Theme - Remote Code Execution
There is a bug in this theme, that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. Solution Update the theme...
WordPress Vitamin Plugin <= 1.0.9 - Multiple Directory Traversal
Because of these vulnerabilities, the attackers can access arbitrary files in the "path" parameter. Solution Update the plugin...
WordPress FB Gorilla Plugin - SQL Injection
This WordPress FB Gorilla plugin's "gameplay.php" is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress Brute Force Login Protection plugin <= 1.5.3 - Arbitrary IP Removal/Add via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary IP Removal/Add via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Brute Force Login Protection plugin versions = 1.5.3. Solution Deactivate and delete. This plugin has been closed as of April 7, 2022 and is not available for download. This closure is temporary,...
WordPress BSK PDF Manager Plugin - Multiple SQL Injection Vulnerabilities
BSK PDF Manager plugin's "wp-admin/admin.php" is prone to multiple SQL injection vulnerabilities that allow to compromise the application, modify or access data. Also, exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress Picasa Image Plugin <=1.0 - XSS
Because of this vulnerability in picasaupload.php, the attackers can inject arbitrary web script or HTML via the "postid" parameter. Solution Update the plugin...
WordPress Video Posts Webcam Recorder Plugin <= 1.55.4 - XSS
Because of this vulnerability in posts/videowhisper/rlogout.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Verification Code for Comments Plugin <= 2.1.0 - Multiple XSS
Because of these vulnerabilities in vcc.js.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress WP Plugin Manager Plugin <= 1.6.4.b - XSS
Because of this vulnerability in wp-plugins-net/index.php, the attackers can inject arbitrary web script or HTML via the "filter" parameter. Solution Update the plugin...
WordPress WP Ultimate Email Marketer Plugin <= 1.1.0 - XSS
Because of these vulnerabilities in contact/edit.php, the attackers can inject arbitrary web script or HTML via the "contact" or "listname"parameter. Solution Update the plugin...
WordPress Tera Charts Plugin - Remote Path Traversal File Disclosure
Tera Charts plugin's zoomabletreemap.php "fn" parameter is prone to remote path traversal file disclosure vulnerability that allow an attacker to get potentially sensitive information. Other attacks are also possible. Solution Update the plugin...
WordPress <= 3.0.1 - Multiple XSS
Because of these vulnerabilities, remote servers can inject arbitrary web script or HTML by providing a crafted error message for a FTP or SSH connection attempt. Solution Update WordPress...
WordPress <= 3.0.0
A WordPress multi-site installation, permanently retains the "site administrators can add users" option once changed which might allow authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an "add" action after a temporary change. Solution Update...
WordPress Newsletter Manager Plugin <= 1.0.1 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress 2.0.11 - Cross Site Request Forgery
WordPress 2.0.11 version is prone to a cross site request forgery via "/wp-admin/options-discussion.php". It allows an attacker to perform certain unauthorized actions in the context of the affected application. Solution Update WordPress...
WordPress OptimizePress Theme <= 1.60 - File Upload Vulnerability
Multiple unrestricted file upload vulnerabilities, the attackers can execute arbitrary code by uploading a file with an executable extension, then accessing it. Solution Update the theme...
WordPress Spreadsheet Plugin <= 2.0 - Cross Site Scripting
Because of this vulnerability in codebase/spreadsheet.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...
WordPress Maintenance Mode Plugin <= 1.8.7 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that modify this plugin's settings. Solution Update the plugin...
WordPress BackupBuddy Plugin <= 2.2.4 - Sensitive Data Exposure #2
Because of this vulnerability in the importbuddy.php, the plugin does not reliably delete itself after completing a restore operation. In that way the attackers can obtain access via subsequent requests to this script. Solution Update the plugin...
WordPress One Webmaster Plugin <= 8.2.3 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that insert cross site scripting sequences. Solution Update the plugin...
WordPress Facebook Members Plugin <= 5.0.4 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that modify this plugin's settings. Solution Update the plugin...
WordPress WP MailUp Plugin <= 1.3.1 - BYPASS
Because of this vulnerability, the attackers can modify plugin settings and conduct cross-site scripting attacks via unspecified vectors. Solution Update the plugin...
WordPress Ripe HD FLV Player Plugin - SQL Injection
WordPress Ripe HD FLV Player plugin is prone to an SQL injection vulnerability. It allows an attacker to get access to the database, get username, password and disclosure the full path. Solution Update the plugin...
WordPress Connections Plugin <= 0.7.1.5 - Unspecified vulnerability
Because of this vulnerability, this plugin has unknown impact and attack vectors. Solution Update the plugin...
WordPress <= 3.5.0 - Multiple Cross Site Scripting
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress <= 3.4.2
The attackers can discover valid session identifiers via a brute-force attack, because this WordPress version does not invalidate a wordpresssec session cookie upon an administrator's logout action. Solution The application should keep track of session identifiers where a user has explicitly logg...
WordPress Pay With Tweet Plugin <= 1.1 - SQL Injection
Because of this vulnerability, the authenticated users can execute arbitrary SQL commands via the "id" parameter. Solution Update the plugin...
WordPress Mingle Forum Plugin <= 1.0.32 - Multiple SQL Injection #1
Because of these vulnerabilities, the authenticated users can execute arbitrary SQL commands via the "editforumid parameter" in an editsaveforum action, "id" parameter to fs-admin/fs-admin.php or "memberid" parameter in a removemember action. Solution Update the plugin...
WordPress Akismet Plugin - Multiple Cross Site Scripting Vulnerabilities
WordPress Akismet plugin is prone to multiple cross-site scripting vulnerabilities. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...
WordPress DVS Custom Notification Plugin <= 1.0.1 - Multiple CSRF and XSS
Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks orchange application settings. Solution Update the plugin...
WordPress Adminimize Plugin <= 1.7.21 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress <= 3.4.2 - CSRF
Because of this vulnerability in wp-admin/index.php, the attackers can hijack the authentication of administrators for requests. Solution Update WordPress...
WordPress Image News Slider Plugin <= 3.2 - Unspecified vulnerability
Because of this vulnerability, this plugin has unspecified impact and remote attack vectors. Solution Update the plugin...
WordPress 2 Click Social Media Buttons Plugin <= 0.33 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress 2 Click Social Media Buttons Plugin <= 0.33 - XSS
Because of this vulnerability in libs/xing.php, the attackers can inject arbitrary web script or HTML via the "xing-url" parameter. Solution Update the plugin...
WordPress Chenpress Plugin - Arbitrary File Upload
WordPress Chenpress plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Update the plugin...
WordPress <= 3.4.1 - XSS and BYPASS
Because of these vulnerabilities, authenticated users can perform cross-site scripting attacks by leveraging the Administrator or Editor role and composing crafted text and bypass intended access restrictions. Solution Update WordPress...
WordPress Login With Ajax Plugin <= 3.0.4.0 - XSS #2
Because of this vulnerability in login-with-ajax.php, the attackers can inject arbitrary web script or HTML via the "callback" parameter. Solution Update the plugin...