14633 matches found
Holding Pattern Theme <= 0.6 - Arbitrary File Upload
An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation. Disclosure timeline: 2015-01-14 Vendor Alerted via email. 2015-01-14 Fix Requested via email. 2015-01-14...
Our Team Showcase 1.2 - CSRF & XSS
The Our Team Showcase WordPress plugin was affected by a CSRF & XSS security vulnerability...
W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery (CSRF)
The plugin does not validate the 'wpnonce' anti-CSRF token. This issue can be used to perform many actions. The most significant action with the biggest impact is the ability to redirect users to malicious websites. Functionality exists where specific user agent strings can be configured to be...
Simple Visitor Stat <= 1.0 - Multiple XSS
Plugin is still affected and has been closed...
DukaPress <= 2.5.3 - Unauthenticated Path Traversal
The DukaPress WordPress plugin was affected by an Unauthenticated Path Traversal security vulnerability...
WP Support Plus Responsive Ticket System < 4.2 - Multiple Issues
The WP Support Plus Responsive Ticket System WordPress plugin was affected by a Multiple Issues security vulnerability...
BulletProof Security <= .51 - Multiple Vulnerabilities (XSS & SSRF)
The BulletProof Security WordPress plugin was affected by a Multiple Vulnerabilities XSS & SSRF security vulnerability...
Cforms < 10.5 - XSS
The cforms WordPress plugin was affected by a XSS security vulnerability...
Advanced Access Manager 2.8.2 - Admin User File Read/Write
The Advanced Access Manager WordPress plugin was affected by an Admin User File Read/Write security vulnerability...
All-in-One Event Calendar Plugin 1.4 & 1.5 Multiple XSS
The All-in-One Event Calendar WordPress plugin was affected by security vulnerability...
Login Widget With Shortcode 3.1.1 - CSRF/XSS
The Login Widget With Shortcode WordPress plugin was affected by a CSRF/XSS security vulnerability...
Improved User Search in Backend < 1.2.6 - CSRF & XSS
The Improved user search in backend WordPress plugin was affected by a CSRF & XSS security vulnerability...
All Video Gallery 1.1 - config.php Multiple Parameter SQL Injection
The all-video-gallery WordPress plugin was affected by a config.php Multiple Parameter SQL Injection security vulnerability...
WP-Ban < 1.64 BlackList Bypass
The WP-Ban WordPress plugin was affected by security vulnerability...
WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting (XSS)
The WooCommerce WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...
WP Content Source Control <= 3.0.0 - Path Traversal
The WP Source Control WordPress plugin was affected by a Path Traversal security vulnerability...
DejaVu 2.4 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download
The dejavu WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...
Bulteno - Remote File Upload
The bulteno-theme WordPress theme was affected by a Remote File Upload security vulnerability...
Toolbox 1.4 - flyer.php mls Parameter SQL Injection
The toolbox WordPress theme was affected by a flyer.php mls Parameter SQL Injection security vulnerability...
wp-football 1.1 - Multiple Cross-Site Scripting (XSS)
The wp-football WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
Verification Code for Comments 2.1.0 - vcc.js.php Multiple Parameter Reflected XSS
The verification-code-for-comments WordPress plugin was affected by a vcc.js.php Multiple Parameter Reflected XSS security vulnerability...
Yahoo Updates < 1.0 - XSS vulnerabilities in yupdates_application.php
The yahoo-updates-for-wordpress WordPress plugin was affected by a XSS vulnerabilities in yupdatesapplication.php security vulnerability...
Cross RSS 1.7 - proxy.php rss Parameter Local File Inclusion
The cross-rss WordPress plugin was affected by a proxy.php rss Parameter Local File Inclusion security vulnerability...
mTouch Quiz 3.0.6 - question.php quiz Parameter SQL Injection
The mTouch Quiz WordPress plugin was affected by a question.php quiz Parameter SQL Injection security vulnerability...
WPtouch 1.9.19.4 - Cross-Site Scripting (XSS)
The WPtouch WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Bradesco - falha.php URI Reflected XSS
The bradesco-gateway WordPress plugin was affected by a falha.php URI Reflected XSS security vulnerability...
qTranslate 2.5.34 - Setting Manipulation CSRF
The qtranslate WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
Related Posts 2.7.1 - Cross-Site Request Forgery
The related-posts WordPress plugin was affected by a Cross-Site Request Forgery security vulnerability...
WP-DownloadManager 1.60 - Script Insertion CSRF
The wp-download-manager WordPress plugin was affected by a Script Insertion CSRF security vulnerability...
scorerender <= 0.3.4 - XSS in ZeroClipboard
The scorerender WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
buckets <= 0.1.9.2 - XSS in ZeroClipboard
The Buckets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
coupon-code-plugin <= 2.1 - XSS in ZeroClipboard
The coupon-code-plugin WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
cleeng <= 2.3.2 - XSS in ZeroClipboard
The cleeng WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
bp-code-snippets <= 2.0 - XSS in ZeroClipboard
The bp-code-snippets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Gallery - "load" Remote File Inclusion
The wordpress-gallery WordPress plugin was affected by a "load" Remote File Inclusion security vulnerability...
Category Grid View Gallery 2.3.1 - CatGridPost.php ID Parameter XSS
The category-grid-view-gallery WordPress plugin was affected by a CatGridPost.php ID Parameter XSS security vulnerability...
GRAND Flash Album Gallery 0.55 - admin/news.php want2Read Parameter Traversal Arbitrary File Access
The Album and Image Gallery with Lightbox – Flagallery Photo Portfolio WordPress plugin was affected by an admin/news.php want2Read Parameter Traversal Arbitrary File Access security vulnerability...
WP Symposium <= 11.11.26 - Remote File Upload Code Execution
The wp-symposium WordPress plugin was affected by a Remote File Upload Code Execution security vulnerability...
Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)
The BuddyPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
VideoWhisper Live Streaming Integration <= 4.25.3 - Cross-Site Scripting (XSS)
The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Google Document Embedder 2.4.6 - pdf.php file Parameter Arbitrary File Disclosure
The Google Doc Embedder WordPress plugin was affected by a pdf.php file Parameter Arbitrary File Disclosure security vulnerability...
WordPress 2.0 - 3.0.1 Multiple Cross-Site Scripting (XSS) in request_filesystem_credentials()
...
WordPress <= 3.0.5 wp-admin/press-this.php Privilege Escalation
...
Wordpress 2.5 - Cookie Integrity Protection
...
Newsletter Manager < 1.0.2 - Authenticated Reflected Cross Site Scripting
The Newsletter Manager WordPress plugin was affected by a Cross Site Scripting security vulnerability...
PictPress <= 0.91 - Remote File Disclosure
The pictpress WordPress plugin was affected by a Remote File Disclosure security vulnerability...
Wordpress <= 1.5.1.3 - Remote Code Execution
...
NextCellent Gallery < 1.9.18 - Multiple Stored XSS
The NextCellent Gallery – NextGEN Legacy WordPress plugin was affected by a Multiple Stored XSS security vulnerability...
Featured Comments 1.2.1 - wp-admin/admin-ajax.php Comment Status Manipulation CSRF
The Featured Comments WordPress plugin was affected by a wp-admin/admin-ajax.php Comment Status Manipulation CSRF security vulnerability...