14652 matches found
Image Metadata Cruncher - Multiple Cross-Site Scripting (XSS)
The image-metadata-cruncher WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
Facebook (spider-facebook) <= 1.0.10 - Cross-Site Scripting (XSS)
The WDSocialWidgets WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Wordpress Video Gallery <= 2.7 - SQL Injection
The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability. PoC http://example.com/wp-admin/admin-ajax.php?action=rss=video=SQLi...
EasyCart <= 3.0.15 - Unrestricted File Upload
In versions = 3.0.8 this can be exploited by authenticating as any WordPress user, and in versions 3.0.9 - 3.0.15 can be exploited by passing a valid password hash being used by any admin in the EasyCart user system...
Banner Effect Header <= 1.2.7 - Cross-Site Scripting (XSS)
The Banner Effect Header WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Pie Register <= 2.0.13 - Privilege escalation
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by a Privilege escalation security vulnerability...
Cart66 Pro <= 1.5.3 - Authenticated Arbitrary File Disclosure
Ability to change settings with a registered non-admin user allows us to trigger an Arbitrary File Disclosure vulnerability with any path of our choosing. One limitation with this vulnerability is that the target user in the PoC, ‘test’ needs to have an account on the Cart66 installation...
Tweetscribe <= 1.1 - Multiple CSRF
Plugin is still affected and has been closed...
Lightbox Photo Gallery 1.0 - CSRF/XSS
The lightbox-photo-gallery WordPress plugin was affected by a CSRF/XSS security vulnerability...
Simple Visitor Stat <= 1.0 - Multiple XSS
Plugin is still affected and has been closed...
Google Document Embedder <= 2.5.16 - SQL Injection
The Google Doc Embedder WordPress plugin was affected by a SQL Injection security vulnerability...
Paid Memberships Pro 1.7.14.2 - Path Traversal
The Paid Memberships Pro WordPress plugin was affected by a Path Traversal security vulnerability...
BulletProof Security <= .51 - Multiple Vulnerabilities (XSS & SSRF)
The BulletProof Security WordPress plugin was affected by a Multiple Vulnerabilities XSS & SSRF security vulnerability...
CP Multi View Event Calendar <= 1.0.1 - SQL Injection
The Calendar Event Multi View WordPress plugin was affected by a SQL Injection security vulnerability...
BulletProof Security <= .50.8 - Script Insertion
The BulletProof Security WordPress plugin was affected by a Script Insertion security vulnerability...
All In One WP Security plugin 3.8.2 - 2xSQL Injections
The All In One WP Security & Firewall WordPress plugin was affected by a 2xSQL Injections security vulnerability...
Wordfence 5.2.4 - IPTraf.php URI Request Stored XSS
The Wordfence Security – Firewall & Malware Scan WordPress plugin was affected by an IPTraf.php URI Request Stored XSS security vulnerability...
Last.fm Rotation 1.0 - lastfm-proxy.php snode Parameter Remote Path Traversal File Access
The lastfm-rotation WordPress plugin was affected by a lastfm-proxy.php snode Parameter Remote Path Traversal File Access security vulnerability...
DejaVu 2.4 - dl-skin.php _mysite_download_skin Parameter Absolute Path Traversal Remote File Download
The dejavu WordPress theme was affected by a dl-skin.php mysitedownloadskin Parameter Absolute Path Traversal Remote File Download security vulnerability...
Validated < 1.0.2 - Cross-Site Scripting (XSS)
The Validated WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
wp-football 1.1 - Multiple Cross-Site Scripting (XSS)
The wp-football WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
Easy Banners 1.4 - Cross-Site Scripting (XSS)
The easy-banners WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
Cross RSS 1.7 - proxy.php rss Parameter Local File Inclusion
The cross-rss WordPress plugin was affected by a proxy.php rss Parameter Local File Inclusion security vulnerability...
Member Approval 131109 - wp-admin/options-general.php Option Manipulation CSRF
The member-approval WordPress plugin was affected by a wp-admin/options-general.php Option Manipulation CSRF security vulnerability...
HK Exif Tags 1.11 - hk_exif_tags.php hk_exif_tags_images_process Function EXIF Tags H&ling Stored XSS
The HK Exif Tags WordPress plugin was affected by a hkexiftags.php hkexiftagsimagesprocess Function EXIF Tags H Stored XSS security vulnerability...
Redirection - view/admin/log_item.php Non-existent Posts Referer HTTP Header XSS
The Redirection WordPress plugin was affected by a view/admin/logitem.php Non-existent Posts Referer HTTP Header XSS security vulnerability...
Social Sharing Toolkit 2.1.1 - Setting Manipulation CSRF
The Social Sharing Toolkit WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
Booking System <= 1.2 - SQL Injection
The Pinpoint Booking System – 1 WordPress Booking Plugin WordPress plugin was affected by a SQL Injection security vulnerability...
Bradesco - falha.php URI Reflected XSS
The bradesco-gateway WordPress plugin was affected by a falha.php URI Reflected XSS security vulnerability...
Yoast SEO < 1.4.7 - Reset Settings Feature Access Restriction Bypass
The Yoast SEO WordPress plugin was affected by a Reset Settings Feature Access Restriction Bypass security vulnerability...
qTranslate 2.5.34 - Setting Manipulation CSRF
The qtranslate WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...
AntiVirus 1.0 - PHP Backdoor Detection Bypass
The AntiVirus WordPress plugin was affected by a PHP Backdoor Detection Bypass security vulnerability...
Social Media Widget 4.0 - social-widget.php MITM Weakness Arbitrary Code Injection
The Social Media Widget WordPress plugin was affected by a social-widget.php MITM Weakness Arbitrary Code Injection security vulnerability...
buckets <= 0.1.9.2 - XSS in ZeroClipboard
The Buckets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
cleeng <= 2.3.2 - XSS in ZeroClipboard
The cleeng WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
bp-code-snippets <= 2.0 - XSS in ZeroClipboard
The bp-code-snippets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...
Gallery - "load" Remote File Inclusion
The wordpress-gallery WordPress plugin was affected by a "load" Remote File Inclusion security vulnerability...
Audio Player - player.swf playerID Parameter XSS
The audio-player WordPress plugin was affected by a player.swf playerID Parameter XSS security vulnerability...
WP Symposium <= 11.11.26 - Remote File Upload Code Execution
The wp-symposium WordPress plugin was affected by a Remote File Upload Code Execution security vulnerability...
Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)
The BuddyPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
LeagueManager 3.8 - SQL Injection
The LeagueManager WordPress plugin was affected by a SQL Injection security vulnerability...
RBX Gallery 2.1 - uploader.php File Upload PHP Code Execution
The rbxgallery WordPress plugin was affected by an uploader.php File Upload PHP Code Execution security vulnerability...
VideoWhisper Live Streaming Integration <= 4.25.3 - Cross-Site Scripting (XSS)
The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
WordPress 1.5 template-functions-post.php Multiple Field XSS
...
WordPress 2.0 - 3.0.1 Multiple Cross-Site Scripting (XSS) in request_filesystem_credentials()
...
PictPress <= 0.91 - Remote File Disclosure
The pictpress WordPress plugin was affected by a Remote File Disclosure security vulnerability...
Wordpress 2.5 - Cookie Integrity Protection
...
Sahifa 2.4.0 - Multiple Full Path Disclosure
The sahifa WordPress theme was affected by a Multiple Full Path Disclosure security vulnerability...