49938 matches found
WordPress SP Client Document Manager Plugin 2.4.1 - SQL Injection
This WordPress SP Client Document Manager plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress XCloner Plugin <= 3.1.1 - Remote Database Download & Local File Permissions
The attackers can obtain sensitive information via a direct request to a backup file in administrators/backups/, because the plugin stores database backup files with predictable names under the web root with insufficient access control. Solution Update the plugin...
WordPress Enfold Theme <= 3.0.0 - Unspecified Vulnerability
Because of this vulnerability in the folder framework, this theme has unknown impact and attack vectors. Solution Update the theme...
WordPress NEX-Forms Lite Plugin <= 2.1.0 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "formfields" parameter. Solution Update the plugin...
WordPress Titan Framework Plugin <= 1.5 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "t" parameter to iframe-googlefont-preview.php or the "text" parameter to iframe-font-preview.php. Solution Update the plugin...
WordPress Web-Dorado Photo Gallery Plugin <= 1.1.30 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "callback", "dir", or "extensions" parameters. Solution Update the plugin...
WordPress Epic Theme - Arbitrary File Download
Epic theme's "download.php" is prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the theme...
WordPress <= 3.9.1 - XSS
This vulnerability is in the wp-includes/pluggable.php. It allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. Solution Update WordPress...
WordPress Disqus Plugin 2.7.5 - Admin Stored CSRF and XSS
Disqus plugin is prone to an admin stored CSRF and XSS vulnerabilities. Solution Update the plugin...
WordPress GB Gallery Slideshow Plugin - SQL Injection
This WordPress GB Gallery Slideshow plugin's "wp-admin/admin-ajax.php" is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress StripShow Plugin <= 2.5.2 - SQL Injection
Because of this vulnerability in the stripshow-storylines page, remote authenticated administrators can execute arbitrary SQL commands in an edit action to wp-admin/admin.php via the "story" parameter. Solution Update the plugin...
WordPress GRAND FlAGallery Plugin - SQL Injection
This plugin is prone to an SQL injection vulnerability in compactmusicplayer/gallery.php playlist parameter. Solution Upgrade the plugin...
WordPress Lead Octopus Power Plugin - SQL Injection
This WordPress Lead Octopus Power plugin's "id" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress Brute Force Login Protection plugin <= 1.5.3 - Arbitrary IP Removal/Add via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary IP Removal/Add via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Brute Force Login Protection plugin versions = 1.5.3. Solution Deactivate and delete. This plugin has been closed as of April 7, 2022 and is not available for download. This closure is temporary,...
WordPress Gallery Objects Plugin 0.4 - SQL Injection
This WordPress Gallery Objects plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
WordPress Simple Share Buttons Adder Plugin 4.4 - Multiple Vulnerabilities
Simple Share Buttons Adder plugin is prone to multiple vulnerabilities CSRF and XSS that allow an attacker to convince an admin to visit a link of their choosing. Solution Update to version 4.5...
WordPress Easy Post Types Plugin <= 1.4.3 - XSS
Because of this vulnerability in classes/custom-image/media.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress HTML5 Video Player with Playlist Plugin <= 2.4.0 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Video Posts Webcam Recorder Plugin <= 1.55.4 - XSS
Because of this vulnerability in posts/videowhisper/rlogout.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress VideoWhisper Video Presentation Plugin <= 3.30 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Tera Charts Plugin - Remote Path Traversal File Disclosure
Tera Charts plugin's zoomabletreemap.php "fn" parameter is prone to remote path traversal file disclosure vulnerability that allow an attacker to get potentially sensitive information. Other attacks are also possible. Solution Update the plugin...
WordPress iMember360 Plugin <= 3.9.001 - Disclosure of Database Credentials
Because of this vulnerability, the attackers can obtain database credentials via the "i4wdbinfo" parameter. Solution Update the plugin...
WordPress TinyMCE Color Picker Plugin <= 1.1 - Security Bypass
Because of this vulnerability, the attackers can modify plugin settings via unspecified vectors. Solution Update the plugin...
WordPress <= 3.3.2 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can obtain sensitive information or bypass intended media-attachment restrictions via a "postid" value. Solution Update the plugin...
WordPress WP Forum Server Plugin <= 1.7.4 - XSS
Because of this vulnerability in fs-admin/wpf-add-forum.php, the attackers can inject arbitrary web script or HTML via the "groupid" parameter. Solution Update the plugin...
WordPress Spreadsheet Plugin <= 2.0 - Cross Site Scripting
Because of this vulnerability in codebase/spreadsheet.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...
WordPress WP Cleanfix Plugin - Cross Site Request Forgery
WP Cleanfix plugin is prone to a cross site request forgery vulnerability. It allows an attacker to perform certain unauthorized actions in the context of the affected application. Solution Update the plugin...
WordPress Apptha Video Gallery Plugin <= 2.0 - SQL Injection
Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "playid" parameter to index.php. Solution Update the plugin...
WordPress WP PostViews Plugin <= 1.62 - CSRF
Because of this vulnerability in the options admin page, the attackers can hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. Solution Update the plugin...
WordPress Digg Digg Plugin <= 5.3.4 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of users for requests that modify settings via unspecified vectors. Solution Update the plugin...
WordPress Maintenance Mode Plugin <= 1.8.7 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that modify this plugin's settings. Solution Update the plugin...
WordPress BackupBuddy Plugin <= 2.2.4 - Sensitive Data Exposure #2
Because of this vulnerability in the importbuddy.php, the plugin does not reliably delete itself after completing a restore operation. In that way the attackers can obtain access via subsequent requests to this script. Solution Update the plugin...
WordPress LeagueManager Plugin 3.8 - SQL Injection
LeagueManager plugin is prone to an SQL injection that exists in the "leagueid" parameter of a function call made by the leaguemanagerexport page. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit...
WordPress <= 3.5.1 - Multiple SSRF
Because of these vulnerabilities, the attackers can send HTTP requests to intranet servers via unspecified vectors. Solution Update WordPress...
WordPress SWFUpload Plugin <= 3.5.1 - XSS
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
WordPress WP Table Reloaded Plugin - Cross Site Scripting
WP Table Reloaded plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...
WordPress Mingle Forum Plugin <= 1.0.34 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Pay With Tweet Plugin <= 1.1 - SQL Injection
Because of this vulnerability, the authenticated users can execute arbitrary SQL commands via the "id" parameter. Solution Update the plugin...
WordPress 2 Click Social Media Buttons Plugin <= 0.33 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update the plugin...
WordPress Chenpress Plugin - Arbitrary File Upload
WordPress Chenpress plugin is prone to an arbitrary file upload vulnerability. It allows an attacker to upload arbitrary files to the affected computer. Solution Update the plugin...
WordPress FCChat Widget Plugin 2.2.x - Arbitrary File Upload
FCChat Widget plugin's "Upload.php" is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also...
WordPress WP FaceThumb Plugin 0.1 - Cross Site Scripting
WordPress WP-FaceThumb plugin's "paginationwpfacethum" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attack...
WordPress All-in-One Event Calendar Plugin 1.4 - Multiple Parameter XSS
WordPress All-in-One Event Calendar plugin's /wp-content/plugins/all-in-one-event-calendar/app/view/agenda-widget.php multiple parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browse...
WordPress Recent Comments Plugin <= 2.0.6 - XSS
Because of this vulnerability in the core.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...
WordPress Slideshow Gallery Plugin 1.1.x - Cross Site Scripting
WordPress Slideshow Gallery plugin's "border" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can...
WordPress Kish Guest Posting Plugin 1.0 - Arbitrary File Upload
Kish Guest Posting plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible...
WordPress TheCartPress Plugin 1.6 - Cross Site Scripting
WordPress TheCartPress plugin's "OptionsPostsList.php" is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...
WordPress <= 3.1.0 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via unspecified vectors. Solution Update WordPress...
WordPress WP-PostRatings plugin <= 1.61 - SQL Injecion (SQLi) vulnerability
Because of this vulnerability in wp-postratings.php, the authenticated users can execute arbitrary SQL commands via the id attribute of the rating shortcode when creating a post. Solution Update the plugin to the latest available version at least 1.62...
WordPress Atahualpa Theme 3.6.7 - Cross Site Scripting
WordPress Atahualpa theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-bas...