CVSS: 5.3EPSS: 0%CPEs: 55EXPL: 0CVE-2011-5128 – Adminimize < 1.7.22 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-5128
Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, or (3) inc-options/im_export_options.php, or the (4) post or (5) post_ID parameters to adminimize.php, different vectors than CVE-2011-4926. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS)en el plugin anterior a v1.7.22 para WordPress permite a atacantes remotos inyectar script web o HTML a través del parámetro 'page' a (1) inc-options/deinstall_options.php, (2) inc-options/theme_options.php, o (3) inc-options/im_export_options.php, o el(4) post o (5) parámetro post_ID a adminimize.php, vectores diferentes que CVE-2011-4926. • http://plugins.trac.wordpress.org/changeset?reponame=&new=467338%40adminimize&old=466900%40adminimize#file5 http://wordpress.org/extend/plugins/adminimize/changelog • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 4CVE-2012-3434 – Count Per Day <= 3.1.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-3434
Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) datemin, or (3) datemax parameter. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en userperspan.php en el módulo (Count Per Day) anterior a v3.2 para Wordpress permite a atacantes remotos inyectar código web o HTML arbitrario a través de (1) una página, (2) el parámetro (datemin) o (3) el parámetro (datemax). • http://plugins.trac.wordpress.org/changeset/571926/count-per-day http://secunia.com/advisories/49692 http://www.darksecurity.de/advisories/2012/SSCHADV2012-015.txt http://www.openwall.com/lists/oss-security/2012/07/24/4 http://www.openwall.com/lists/oss-security/2012/07/27/2 http://www.osvdb.org/83491 http://www.tomsdimension.de/wp-plugins/count-per-day • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2012-4327 – Image News Slider <= 3.2 - Unspecified Vulnerability
https://notcve.org/view.php?id=CVE-2012-4327
Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors. Una vulnerabilidad no especificada en el plugin Image News slider para WordPress antes de v3.3 tiene un impacto no especificado y vectores de ataque a distancia. • http://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-image-news-slider&old=529740&new_path=%2Fwp-image-news-slider&new=529740 http://secunia.com/advisories/48747 http://wordpress.org/extend/plugins/wp-image-news-slider/other_notes http://www.securityfocus.com/bid/52977 https://exchange.xforce.ibmcloud.com/vulnerabilities/74788 •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2012-3383 – WordPress Core < 3.4.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-3383
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text. La función map_meta_cap en el archivo wp-includes/capabilities.php de WordPress versiones 3.4.x anteriores a 3.4.2, cuando la funcionalidad multisite está habilitada, no asigna apropiadamente la capacidad unfiltered_html, que permite a los usuarios remotos autenticados omitir las restricciones de acceso previstas y conducir ataques de tipo cross-site scripting (XSS) mediante el aprovechamiento del rol de administrador o editor y componiendo texto especialmente diseñado. • http://codex.wordpress.org/Version_3.4.1 http://codex.wordpress.org/Version_3.4.2 http://core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file23 http://core.trac.wordpress.org/changeset?reponame=&new=21153%40branches%2F3.4&old=21076%40trunk#file16 http://openwall.com/lists/oss-security/2012/09/12/17 http://www.openwall.com/lists/oss-security/2012/07/02/1 http://www.openwall.com/lists/oss-security/2012/07 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 2CVE-2012-3814 – Font Uploader <= 1.3 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-3814
Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts. Vulnerabilidad de subida de ficheros sin restricción en font-upload.php en el complemento Font Uploaderv1.2.4 para WordPress, permite a atacantes remotos ejecutar código PHP de su elección a través de la subida de un fichero PHP con extensión .php.ttf y accediendo a él a través de petición directa en font-uploader/fonts. Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.3 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts. • https://www.exploit-db.com/exploits/18994 http://osvdb.org/82657 http://secunia.com/advisories/49327 http://www.exploit-db.com/exploits/18994 • CWE-264: Permissions, Privileges, and Access Controls CWE-434: Unrestricted Upload of File with Dangerous Type •