SWFUpload <= 2.2.0.1 - Cross-Site Scripting
medium
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
- CVSS:
- 6.1
- Affected:
- up to *
- Fix:
- No patched version reported
- Disclosed:
- Nov 9, 2012
CVE-2012-3414 on NVD →
DM Albums <= 1.9.2 - Remote File Inclusion
critical
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
- CVSS:
- 9.8
- Affected:
- up to 1.9.2
- Fixed in:
- 1.9.3
- Disclosed:
- Jun 29, 2009
CVE-2009-2396 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database