validated plugin project validated plugin vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and previous versions for WordPress allows remote malicious users to inject arbitrary web script or HTML via the slug parameter.

Validated Plugin Project Validated Plugin

In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.

User Photo Project User Photo 0.9.4

1 EDB exploit

An editid GET parameter of the Cashtomer WordPress plugin up to and including 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

Cashtomer Project Cashtomer

A c GET parameter of the Comment Highlighter WordPress plugin up to and including 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

Comment Highlighter Project Comment Highlighter

A proid GET parameter of the WordPress???Alipay|???Tenpay|??PayPal???? WordPress plugin up to and including 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.

Alipay Project Alipay

An id GET parameter of the Easy Testimonial Manager WordPress plugin up to and including 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection

Easy Testimonial Manager Project Easy Testimonial Manager

The Orders functionality in the WordPress Page Contact plugin up to and including 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as cont...

Wpagecontact Project Wpagecontact

The Edit Role functionality in the Display Users WordPress plugin up to and including 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

Wp-display-users Project Wp-display-users

The Edit domain functionality in the WP Domain Redirect WordPress plugin up to and including 1.0 has an `editid` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

Wp-domain-redirect Project Wp-domain-redirect

The Custom Popup Builder WordPress plugin prior to 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog

Custom Popup Builder Project Custom Popup Builder

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook