Foxypress Vulnerabilities

The FoxyPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.9. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform SQL Injection attacks via a forged request granted they can t...

CVSS:

8.8

Affected:

up to 0.4.9

Fix:

No patched version reported

Disclosed:

Oct 30, 2012

The FoxyPress plugin for WordPress is vulnerable to SQL Injection via several parameters in versions up to, and including, 0.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addit...

CVSS:

8.8

Affected:

up to 0.4.9

Fix:

No patched version reported

Disclosed:

Oct 30, 2012

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the documenthandler.php file in versions up to, and including, 0.4.2.5. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arbitrary files on the...

CVSS:

7.2

Affected:

up to 0.4.2.5

Fixed in:

0.4.2.6

Disclosed:

Oct 30, 2012

The FoxyPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters in versions up to, and including, 0.4.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th...

CVSS:

6.1

Affected:

up to 0.4.2.6

Fixed in:

0.4.2.7

Disclosed:

Oct 30, 2012

The FoxyPress plugin for WordPress is vulnerable to Open Redirects in versions up to, and including, 0.4.2.7. This is due to insufficient validation on the redirect url supplied via the 'url' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can su...

CVSS:

6.1

Affected:

up to 0.4.2.7

Fixed in:

0.4.2.8

Disclosed:

Oct 30, 2012

The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execu...

CVSS:

9.8

Affected:

up to 0.4.2.2

Fixed in:

0.4.2.2

Disclosed:

Jun 12, 2012

CVE-2012-10020 on NVD →