49933 matches found
WordPress Frontend Uploader Plugin <= 0.9.2 - XSS
This vulnerability allows the attackers to inject arbitrary web script or HTML. Solution Update the plugin...
WordPress wpCommentTwit Plugin <= 0.5 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Bird Feeder Plugin <= 1.2.3 - Multiple CSRF and XSS
Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution This plugin is closed...
WordPress Google Analytics Plugin <= 5.1.2 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "Manually enter your UA code" field in the General Settings. Solution Update the plugin...
WordPress WhyDoWork AdSense Plugin <= 1.2 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "idcode" parameter. Solution Update the plugin...
WordPress WPDataTables Plugin 1.5.3 - SQL Injection
This WordPress WPDataTables plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...
WordPress Contact Form DB Plugin <= 2.8.15 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "form" or "enc" parameter. Solution Update the plugin...
WordPress WP Support Plus Responsive Ticket System Plugin 2.0 - Multiple Vulnerabilities
There are 4 multiple vulnerabilities in this plugin. 1. SQL injection. 2. Full path disclosure. With this vulnerability full path to the file will be shown to the user after the file has been uploaded. 3. Directory traversal that allows download any file from the server. 4. Broken authentication...
WordPress Acento Theme - Arbitrary File Download
Acento theme's "file" parameter in view-pdf.php is prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Update the theme...
WordPress WP Ban Plugin <= 1.6.3 - BYPASS
Because of this vulnerability, the attackers can bypass the IP blacklist via a crafted X-Forwarded-For header. Solution Update the plugin...
WordPress WP Content Source Control Plugin - Directory Traversal
This WP Content Source Control plugin is prone to a directory-traversal vulnerability via "download.php". It fails to clean up user-supplied input. Using this plugin allows an attacker to obtain an important information which could aid in further attacks. Solution Upgrade the plugin...
WordPress Disqus Plugin 2.7.5 - Admin Stored CSRF and XSS
Disqus plugin is prone to an admin stored CSRF and XSS vulnerabilities. Solution Update the plugin...
WordPress Simple Retail Menus Plugin <= 4.0 - SQL Injection
Because of this vulnerability in includes/mode-edit.php, remote authenticated editors can execute arbitrary SQL commands in an edit action to wp-admin/admin.php via the "targetmenu" parameter. Solution Update the plugin...
WordPress Zedity Plugin <= 2.4.0 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Upgrade the plugin...
WordPress WhyDoWork AdSense Plugin - Multiple Vulnerabilities
WhyDoWork AdSense plugin is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. These vulnerabilities allow an attacker to execute arbitrary script code in the browser, also, steal cookie-based authentication credentials. Solution Update the plugin...
WordPress Meta Slider Plugin <= 2.5 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter to wp-admin/admin.php. Solution Update the plugin...
WordPress WP Consultant Plugin <= 1.0 - XSS
Because of this vulnerability in admin/adminshowdialogs.php, the attackers can inject arbitrary web script or HTML via the "dialogid" parameter. Solution Update the plugin...
WordPress Responsive Preview Plugin <= 1.1 - XSS
Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress WP Football Plugin <=1.1 - Multiple XSS
Because of these multiple vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress WP Plugin Manager Plugin <= 1.6.4.b - XSS
Because of this vulnerability in wp-plugins-net/index.php, the attackers can inject arbitrary web script or HTML via the "filter" parameter. Solution Update the plugin...
WordPress Verification Code for Comments Plugin <= 2.1.0 - Multiple XSS
Because of these vulnerabilities in vcc.js.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Malware Finder Plugin <= 1.1 - XSS
Because of this vulnerability in process.php, the attackers can inject arbitrary web script or HTML via the "query" parameter. Solution Update the plugin...
WordPress Rezgo Online Booking Plugin <= 1.8.1 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress Social Login Plugin <= 2.0.3 - XSS
Because of this vulnerability in services/diagnostics.php, the attackers can inject arbitrary web script or HTML via the "xhrurl" parameter. Solution Update the plugin...
WordPress Efence Plugin <= 1.3.2 - Multiple XSS
Because of these vulnerabilities in callback.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress <= 3.0.1 - Multiple XSS
Because of these vulnerabilities, remote servers can inject arbitrary web script or HTML by providing a crafted error message for a FTP or SSH connection attempt. Solution Update WordPress...
WordPress <= 3.0.0
A WordPress multi-site installation, permanently retains the "site administrators can add users" option once changed which might allow authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an "add" action after a temporary change. Solution Update...
WordPress Newsletter Manager Plugin <= 1.0.2 - XSS
Because of this vulnerability in admin/testmail.php, the attackers can inject arbitrary web script or HTML via the "id" parameter. Solution Update the plugin...
WordPress Newsletter Manager Plugin <= 1.0.1 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
WordPress WP Forum Server Plugin <= 1.7.4 - XSS
Because of this vulnerability in fs-admin/wpf-add-forum.php, the attackers can inject arbitrary web script or HTML via the "groupid" parameter. Solution Update the plugin...
WordPress OptimizePress Theme <= 1.60 - File Upload Vulnerability
Multiple unrestricted file upload vulnerabilities, the attackers can execute arbitrary code by uploading a file with an executable extension, then accessing it. Solution Update the theme...
WordPress Related Posts Plugin <= 1.3.1 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of unspecified users for requests that change settings via unknown vectors. Solution Update the plugin...
WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #2
Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "p" parameter. Solution Update the plugin...
WordPress Calendar Plugin <= 1.3.2 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of users for requests that add a calendar entry via unspecified vectors. Solution Update the plugin...
WordPress Dropdown Menu Widget Plugin <= 1.7.1 - CSRF and XSS
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users for requests that insert cross-site scripting sequences. Solution Update the plugin...
WordPress LeagueManager Plugin 3.8 - SQL Injection
LeagueManager plugin is prone to an SQL injection that exists in the "leagueid" parameter of a function call made by the leaguemanagerexport page. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit...
WordPress Social Media Widget Plugin <= 4.0 - Remote File Inclusion
This plugin contains a Trojan Horse, which allows the attackers to force the upload of arbitrary files. Solution Update the plugin...
WordPress SWFUpload Plugin <= 3.5.1 - XSS
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
WordPress WP Table Reloaded Plugin - Cross Site Scripting
WP Table Reloaded plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...
WordPress <= 3.4.2
The attackers can discover valid session identifiers via a brute-force attack, because this WordPress version does not invalidate a wordpresssec session cookie upon an administrator's logout action. Solution The application should keep track of session identifiers where a user has explicitly logg...
WordPress Mingle Forum Plugin <= 1.0.32 - Multiple SQL Injection #1
Because of these vulnerabilities, the authenticated users can execute arbitrary SQL commands via the "editforumid parameter" in an editsaveforum action, "id" parameter to fs-admin/fs-admin.php or "memberid" parameter in a removemember action. Solution Update the plugin...
WordPress Akismet Plugin - Multiple Cross Site Scripting Vulnerabilities
WordPress Akismet plugin is prone to multiple cross-site scripting vulnerabilities. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...
WordPress DVS Custom Notification Plugin <= 1.0.1 - Multiple CSRF and XSS
Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks orchange application settings. Solution Update the plugin...
WordPress Image News Slider Plugin <= 3.2 - Unspecified vulnerability
Because of this vulnerability, this plugin has unspecified impact and remote attack vectors. Solution Update the plugin...
WordPress Postie Plugin 1.4.3 - Stored XSS
WordPress Postie plugin is prone to a stored XSS vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication credential...
WordPress Automatic Plugin 2.0.3 - SQL Injection
This WordPress Automatic plugin is prone to an SQL injection. This vulnerability works in the csv.php file which does not require valid login credential and it allows an attacker to execute SQL Queries. Solution Upgrade this plugin to version 2.0.4...
WordPress Newsletter Plugin 1.5 - Remote File Disclosure
WordPress Newsletter plugin is prone to a remote file disclosure vulnerability. It allows an attacker to compromise encrypted login credentials for or retrieve the device's administrator password allowing them to directly access the device's configuration control panel. Solution Update the plugin...
WordPress MM Forms Community Plugin 2.2.6 - Arbitrary File Upload
MM Forms Community plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible...
WordPress Count per Day Plugin - Multiple Vulnerabilities
WordPress Count per Day plugin is prone to multiple vulnerabilities such as XSS and user could call a remote script to download arbitrary file from the target system. Solution Update the plugin...