wordpress wordpress 3.1.4 vulnerabilities and exploits

(subscribe to this query)

The Easy Social Icons WordPress plugin prior to 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.

Cybernetikz Easy Social Icons

The Intuitive Custom Post Order WordPress plugin prior to 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an malicious user to trick any user to change the menu order via a CSRF attack

Intuitive Custom Post Order Project Intuitive Custom Post Order

The Intuitive Custom Post Order WordPress plugin prior to 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order

Intuitive Custom Post Order Project Intuitive Custom Post Order

The Restrict Usernames Emails Characters WordPress plugin prior to 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Benaceur-php Restrict Usernames Emails Characters

The Post Snippets WordPress plugin prior to 3.1.4 does not have CSRF check when importing files, allowing malicious user to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Script...

Postsnippets Post Snippets

The Woo Total Sales plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_orders_archive() function in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated malicious users to retrieve sales r...

The "WebSub (FKA. PubSubHubbub)" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack...

Pubsubhubbub Websub

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input...

In the Elementor Website Builder WordPress plugin prior to 3.1.4, the heading widget (includes/widgets/heading.php) accepts a ‘header_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or a...

Elementor Website Builder

In the Elementor Website Builder WordPress plugin prior to 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or abo...

Elementor Website Builder

« PREV 1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook