Alpine Photo Tile For Instagram Vulnerabilities

[en] The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.

Affected:

up to 1.2.7.6

Fixed in:

1.2.7.6

Disclosed:

Sep 26, 2019

CVE-2015-9432 on NVD →

The Alpine Photo Tile for Instagram plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘client_id’ parameter in versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVSS:

6.1

Affected:

up to 1.2.10

Fixed in:

1.2.10

Disclosed:

Mar 1, 2017

The Alpine Photo Tile for Instagram plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘client_id’ parameter in versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

Affected:

up to 1.2.10

Fixed in:

1.2.10

Disclosed:

Mar 1, 2017

The Alpine PhotoTile for Instagram plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the client_id parameter in versions up to, and including, 1.2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

CVSS:

6.1

Affected:

up to 1.2.7.6

Fixed in:

1.2.7.6

Disclosed:

Aug 20, 2015

CVE-2015-9432 on NVD →

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.2.7.6

Fixed in:

1.2.7.6

Disclosed:

Aug 20, 2015

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

May 14, 2015

The Alpine PhotoTile For Instagram plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to 1.2.9 due to insufficient input sanitization and output escaping on the 'general_lightbox_params' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute i...

CVSS:

6.1

Affected:

up to 1.2.9

Fixed in:

1.2.9

Disclosed:

Aug 1, 2014

Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

CVSS:

6.1

Affected:

up to 1.2.7.5

Fixed in:

1.2.7.5

Disclosed:

Aug 1, 2014

CVE-2013-6837 on NVD →

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.2.6.6

Fixed in:

1.2.6.6

Disclosed:

Aug 1, 2014

The Alpine PhotoTile For Instagram plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to 1.2.9 due to insufficient input sanitization and output escaping on the 'general_lightbox_params' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute i...

Affected:

up to 1.2.9

Fixed in:

1.2.9

Disclosed:

Aug 1, 2014

[en] Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

Affected:

up to 1.2.7.5

Fixed in:

1.2.7.5

Disclosed:

Dec 19, 2013

CVE-2013-6837 on NVD →

The jQuery prettyPhoto library bundled with many plugins was found to be vulnerable to DOM Cross-Site Scripting (XSS).

Affected:

up to 1.2.7.5

Fixed in:

1.2.7.5

The alpine-photo-tile-for-instagram WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.2.7.7

Fix:

No patched version reported

The alpine-photo-tile-for-instagram WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.2.6

Fix:

No patched version reported