wordpress wordpress 3.0.6 vulnerabilities and exploits

(subscribe to this query)

Cross-site scripting (XSS) vulnerability in the BackWPup plugin prior to 3.0.13 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php.

Marketpress Backwpup Plugin Marketpress Backwpup Plugin 3.0 Marketpress Backwpup Plugin 3.0.1 Marketpress Backwpup Plugin 3.0.2 Marketpress Backwpup Plugin 3.0.3 Marketpress Backwpup Plugin 3.0.4 Marketpress Backwpup Plugin 3.0.5 Marketpress Backwpup Plugin 3.0.6 Marketpress Backwpup Plugin 3.0.7 Marketpress Backwpup Plugin 3.0.8 Marketpress Backwpup Plugin 3.0.9 Marketpress Backwpup Plugin 3.0.10

The eu-cookie-law plugin up to and including 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color...

Eu Cookie Law Project Eu Cookie Law

Cross-site scripting (XSS) vulnerability in the Tweet Blender plugin prior to 4.0.2 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the tb_tab_index parameter to wp-admin/options-general.php.

Tweet-blender Tweet-blender Tweet-blender Tweet-blender 2.0.0 Tweet-blender Tweet-blender 2.0.1 Tweet-blender Tweet-blender 2.0.2 Tweet-blender Tweet-blender 2.0.3 Tweet-blender Tweet-blender 2.0.4 Tweet-blender Tweet-blender 2.0.5 Tweet-blender Tweet-blender 2.1.0 Tweet-blender Tweet-blender 2.1.1 Tweet-blender Tweet-blender 2.2.0 Tweet-blender Tweet-blender 2.2.1 Tweet-blender Tweet-blender 2.2.2

Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin prior to 3.3.0 for WordPress allows remote malicious users to inject arbitrary JavaScript via the yr parameter.

Sunnythemes Spiffy Calendar 1.0.0 Sunnythemes Spiffy Calendar 1.0.1 Sunnythemes Spiffy Calendar 1.0.2a Sunnythemes Spiffy Calendar 1.0.3 Sunnythemes Spiffy Calendar 1.1.0 Sunnythemes Spiffy Calendar 1.1.1 Sunnythemes Spiffy Calendar 1.1.2 Sunnythemes Spiffy Calendar 1.1.3 Sunnythemes Spiffy Calendar 1.1.4 Sunnythemes Spiffy Calendar 1.1.5 Sunnythemes Spiffy Calendar 1.1.6 Sunnythemes Spiffy Calendar 1.1.7

includes/theme-functions.php in the OneTone theme up to and including 3.0.6 for WordPress allows unauthenticated options changes.

Mageewp Onetone

includes/theme-functions.php in the OneTone theme up to and including 3.0.6 for WordPress has multiple stored XSS issues.

Mageewp Onetone

The ImageBoss WordPress plugin prior to 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks

Imageboss Imageboss

The Smart SEO Tool WordPress plugin prior to 3.0.6 does not sanitise and escape the search parameter before outputting it back in an attribute when the TDK optimisation setting is enabled, leading to a Reflected Cross-Site Scripting

Wbolt Smart Seo Tool

The Visual Form Builder WordPress plugin prior to 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

Vfbpro Visual Form Builder

The PostX WordPress plugin prior to 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

« PREV 1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook