wordpress wordpress 2.8 vulnerabilities and exploits

(subscribe to this query)

SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and previous versions for WordPress allows remote malicious users to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.

Andrew Charlton My Category Order Andrew Charlton My Category Order 2.6.1 Andrew Charlton My Category Order 2.6.1a Andrew Charlton My Category Order 2.7 Andrew Charlton My Category Order 2.7.1

1 EDB exploit

Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin prior to 3.7 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the step parameter.

Slickremix Design Approval System Plugin Slickremix Design Approval System Plugin 1.0 Slickremix Design Approval System Plugin 1.1 Slickremix Design Approval System Plugin 1.2 Slickremix Design Approval System Plugin 1.3 Slickremix Design Approval System Plugin 1.4 Slickremix Design Approval System Plugin 1.5 Slickremix Design Approval System Plugin 1.6 Slickremix Design Approval System Plugin 1.7 Slickremix Design Approval System Plugin 1.8 Slickremix Design Approval System Plugin 1.9 Slickremix Design Approval System Plugin 2.0

SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.

Kolja Schleich Leaguemanager Kolja Schleich Leaguemanager 1.0 Kolja Schleich Leaguemanager 1.1 Kolja Schleich Leaguemanager 1.2 Kolja Schleich Leaguemanager 1.2.1 Kolja Schleich Leaguemanager 1.2.2 Kolja Schleich Leaguemanager 1.3 Kolja Schleich Leaguemanager 1.4 Kolja Schleich Leaguemanager 1.4.1 Kolja Schleich Leaguemanager 1.4.2 Kolja Schleich Leaguemanager 1.5 Kolja Schleich Leaguemanager 2.0

1 EDB exploit1 Github repository

Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin prior to 4.5 for WordPress allow remote malicious users to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ssba...

Sharethis Simple Share Buttons Adder Sharethis Simple Share Buttons Adder 1.0 Sharethis Simple Share Buttons Adder 1.1 Sharethis Simple Share Buttons Adder 1.2 Sharethis Simple Share Buttons Adder 1.3 Sharethis Simple Share Buttons Adder 1.4 Sharethis Simple Share Buttons Adder 1.5 Sharethis Simple Share Buttons Adder 1.6 Sharethis Simple Share Buttons Adder 1.7 Sharethis Simple Share Buttons Adder 1.8 Sharethis Simple Share Buttons Adder 1.9 Sharethis Simple Share Buttons Adder 2.0

1 EDB exploit

The Register Plus plugin 3.5.1 and previous versions for WordPress allows remote malicious users to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.

Devbits Register-plus Devbits Register-plus 1.1 Devbits Register-plus 1.2 Devbits Register-plus 2.0 Devbits Register-plus 2.1 Devbits Register-plus 2.2 Devbits Register-plus 2.3 Devbits Register-plus 2.4 Devbits Register-plus 2.5 Devbits Register-plus 2.6 Devbits Register-plus 2.7 Devbits Register-plus 2.8

Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and previous versions for WordPress allow remote malicious users to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) ...

Devbits Register-plus Devbits Register-plus 1.1 Devbits Register-plus 1.2 Devbits Register-plus 2.0 Devbits Register-plus 2.1 Devbits Register-plus 2.2 Devbits Register-plus 2.3 Devbits Register-plus 2.4 Devbits Register-plus 2.5 Devbits Register-plus 2.6 Devbits Register-plus 2.7 Devbits Register-plus 2.8

The Jetpack plugin prior to 1.9 prior to 1.9.4, 2.0.x prior to 2.0.9, 2.1.x prior to 2.1.4, 2.2.x prior to 2.2.7, 2.3.x prior to 2.3.7, 2.4.x prior to 2.4.4, 2.5.x prior to 2.5.2, 2.6.x prior to 2.6.3, 2.7.x prior to 2.7.2, 2.8.x prior to 2.8.2, and 2.9.x prior to 2.9.3 for WordP...

Automattic Jetpack 1.9 Automattic Jetpack 1.9.1 Automattic Jetpack 1.9.2 Automattic Jetpack 2.0 Automattic Jetpack 2.0.1 Automattic Jetpack 2.0.2 Automattic Jetpack 2.0.3 Automattic Jetpack 2.0.4 Automattic Jetpack 2.1 Automattic Jetpack 2.1.1 Automattic Jetpack 2.1.2 Automattic Jetpack 2.2

The shortcode-factory plugin prior to 2.8 for WordPress has Local File Inclusion.

Wpmadeasy Shortcode Factory

The kento-post-view-counter plugin up to and including 2.8 for WordPress has XSS via kento_pvc_geo.

Kentothemes Kento-post-view-counter

The kento-post-view-counter plugin up to and including 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.

Kentothemes Kento-post-view-counter

« PREV 1 2 3 4 5 6 7 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook