plugin

Spotlightyour Vulnerabilities

2 known security issues reported for the Spotlightyour WordPress plugin. Most recent disclosed May 25, 2014.

2 medium

Running Spotlightyour on your site? Check whether your installed version is affected.

Scan your site free

Spotlight <= 4.7 - Cross-Site Scripting

medium

Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plugin 4.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the paymentType parameter.

CVSS:
6.1
Affected:
up to 4.7
Fix:
No patched version reported
Disclosed:
May 25, 2014

CVE-2014-4552 on NVD →

SWFUpload <= 2.2.0.1 - Cross-Site Scripting

medium

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

CVSS:
6.1
Affected:
up to 4.4
Fixed in:
4.4
Disclosed:
Nov 9, 2012

CVE-2012-3414 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database