WordPress mTouch Quiz Plugin <= 3.0.6 - Multiple XSS

Because of these vulnerabilities in question.php, the attackers can inject arbitrary web script or HTML via the "quiz" parameter to wp-admin/edit.php. Solution Update the plugin...

WordPress JS Multi Hotel Plugin <= 2.2.1 - XSS

Because of this vulnerability in includes/refreshDate.php, the attackers can inject arbitrary web script or HTML via the "roomid" parameter. Solution Update the plugin...

WordPress Frontend Uploader Plugin <= 0.9.2 - XSS

This vulnerability allows the attackers to inject arbitrary web script or HTML. Solution Update the plugin...

WordPress PWG Random Plugin <= 1.11 - Multiple CSRG and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...

WordPress Bird Feeder Plugin <= 1.2.3 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...

WordPress Digital Zoom Studio Plugin - XSS

Multiple cross-site scripting XSS vulnerabilities are in deploy/designer/preview.php. Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "swfloc" or "designrand" parameter. Solution Update the plugin...

WordPress WPDataTables Plugin 1.5.3 - SQL Injection

This WordPress WPDataTables plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress <= 4.0.0 - XSS #3

Because of this vulnerability in the "media-playlists" function, the attackers can inject arbitrary web script or HTML via unspecified vectors. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-0-0-xss...

WordPress Contact Form DB Plugin <= 2.8.15 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "form" or "enc" parameter. Solution Update the plugin...

WordPress Titan Framework Plugin <= 1.5 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "t" parameter to iframe-googlefont-preview.php or the "text" parameter to iframe-font-preview.php. Solution Update the plugin...

WordPress Content Audit Plugin <= 1.6.0 - SQL Injection

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php. Solution Update the plugin...

WordPress WP Content Source Control Plugin - Directory Traversal

This WP Content Source Control plugin is prone to a directory-traversal vulnerability via "download.php". It fails to clean up user-supplied input. Using this plugin allows an attacker to obtain an important information which could aid in further attacks. Solution Upgrade the plugin...

WordPress <=3.9.1 - Multiple Vulnerabilities #2

wp-includes/pluggable.php rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, that allows the attackers to bypass a CSRF protection mechanism via a brute-force attack. Related records:...

WordPress SI CAPTCHA Plugin <= 2.7.4 - XSS

Because of this vulnerability in captcha-secureimage/test/index.php, the attackers can inject arbitrary web script or HTML via the PATHINFO. Solution Update the plugin...

WordPress StripShow Plugin <= 2.5.2 - SQL Injection

Because of this vulnerability in the stripshow-storylines page, remote authenticated administrators can execute arbitrary SQL commands in an edit action to wp-admin/admin.php via the "story" parameter. Solution Update the plugin...

WordPress Quartz Plugin <= 1.01.1 - SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands in an edit action in the quartz/quoteform.php page to wp-admin/edit.php via the "quote" parameter. Solution Update the plugin...

WordPress ZooEffect Plugin <= 1.08 - Reflected XSS

This plugin is prone to a HTTP referer reflected cross site scripting vulnerability. Solution Update the plugin...

WordPress Nuance Theme - Shell Upload Exploit

WordPress Nuance theme is prone to a shell upload exploit via the valums uploader. Solution Update the theme...

WordPress WhyDoWork AdSense Plugin - Multiple Vulnerabilities

WhyDoWork AdSense plugin is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. These vulnerabilities allow an attacker to execute arbitrary script code in the browser, also, steal cookie-based authentication credentials. Solution Update the plugin...

WordPress Vitamin Plugin <= 1.0.9 - Multiple Directory Traversal

Because of these vulnerabilities, the attackers can access arbitrary files in the "path" parameter. Solution Update the plugin...

WordPress FB Gorilla Plugin - SQL Injection

This WordPress FB Gorilla plugin's "gameplay.php" is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress Gallery Objects Plugin 0.4 - SQL Injection

This WordPress Gallery Objects plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Meta Slider Plugin <= 2.5 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter to wp-admin/admin.php. Solution Update the plugin...

WordPress WP FaceThumb Plugin <= 1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "ajaxurl" parameter to index.php. Solution Update the plugin...

WordPress OMFG Mobile Pro Plugin <= 1.1.26 - XSS

Because of this vulnerability in shortcode-generator/preview-shortcode-external.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress WP Football Plugin <=1.1 - Multiple XSS

Because of these multiple vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress WP Consultant Plugin <= 1.0 - XSS

Because of this vulnerability in admin/adminshowdialogs.php, the attackers can inject arbitrary web script or HTML via the "dialogid" parameter. Solution Update the plugin...

WordPress Responsive Preview Plugin <= 1.1 - XSS

Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress CBI Referral Manager Plugin <= 1.2.1 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "searchString" parameter. Solution Update the plugin...

WordPress BIC Media Widget Plugin <= 1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "param" parameter. Solution Update the plugin...

WordPress Malware Finder Plugin <= 1.1 - XSS

Because of this vulnerability in process.php, the attackers can inject arbitrary web script or HTML via the "query" parameter. Solution Update the plugin...

WordPress Social Login Plugin <= 2.0.3 - XSS

Because of this vulnerability in services/diagnostics.php, the attackers can inject arbitrary web script or HTML via the "xhrurl" parameter. Solution Update the plugin...

WordPress Oleggo LiveStream Plugin <= 0.2.6 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress WebEngage Plugin <= 2.0.0 - XSS

Because of this vulnerability in resize.php, the attackers to inject arbitrary web script or HTML via the "height" parameter or renderer.php or callback.php. Solution Update the plugin...

WordPress Contact Bank Plugin <= 2.0.19 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the Label field, related to form layout configuration. Solution Update the plugin...

WordPress TinyMCE Color Picker Plugin <= 1.1 - Security Bypass

Because of this vulnerability, the attackers can modify plugin settings via unspecified vectors. Solution Update the plugin...

WordPress NextCellent Gallery Plugin <= 1.19.17 - XSS

Because of this vulnerability in admin/manage-images.php, authenticated users can inject arbitrary web script or HTML via the "Alt & Title Text" field. Solution Update the plugin...

WordPress Ajax Pagination Plugin 1.1 - Local File Inclusion

Ajax Pagination plugin is prone to a file inclusion vulnerability. It is exploitable by an unauthenticated user, who can include any local file ending in “.php” which is accessible to the web user. Solution Upgrade the plugin...

WordPress <= 3.3.2 - Multiple Vulnerabilities

Because of these vulnerabilities, the attackers can obtain sensitive information or bypass intended media-attachment restrictions via a "postid" value. Solution Update the plugin...

WordPress Newsletter Manager Plugin <= 1.0.2 - XSS

Because of this vulnerability in admin/testmail.php, the attackers can inject arbitrary web script or HTML via the "id" parameter. Solution Update the plugin...

WordPress Recommend To a Friend Plugin <= 2.0.2 - XSS

Because of this vulnerability in inc/rafform.php, the attackers can inject arbitrary web script or HTML via the "currenturl" parameter. Solution Update the plugin...

WordPress Blue Wrench Video Widget Plugin - Cross Site Request Forgery

WordPress Blue Wrench Video Widget plugin is prone to a cross-site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Upgrade the plugin...

WordPress Spreadsheet Plugin <= 2.0 - Cross Site Scripting

Because of this vulnerability in codebase/spreadsheet.php, the attackers can inject arbitrary web script or HTML via the "page" parameter. Solution Update the plugin...

WordPress Comment Attachment Plugin <= 1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "Attachment field title." Solution Update the plugin...

WordPress Related Posts Plugin <= 1.3.1 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of unspecified users for requests that change settings via unknown vectors. Solution Update the plugin...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #2

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "p" parameter. Solution Update the plugin...

WordPress WP PostViews Plugin <= 1.62 - CSRF

Because of this vulnerability in the options admin page, the attackers can hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. Solution Update the plugin...

WordPress Calendar Plugin <= 1.3.2 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of users for requests that add a calendar entry via unspecified vectors. Solution Update the plugin...

WordPress Dropdown Menu Widget Plugin <= 1.7.1 - CSRF and XSS

Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that insert cross-site scripting sequences. Solution Update the plugin...

WordPress Social Media Widget Plugin <= 4.0 - Remote File Inclusion

This plugin contains a Trojan Horse, which allows the attackers to force the upload of arbitrary files. Solution Update the plugin...