Wp Cumulus Vulnerabilities

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.23

Fixed in:

1.23

Disclosed:

May 15, 2015

The WP-Cumulus plugin for WordPress is vulnerable to Cross-Site Scripting via the 'xmlpath' parameter in versions up to, and including, 1.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthorized attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 1.22

Fixed in:

1.23

Disclosed:

Nov 20, 2011

The WP-Cumulus plugin for WordPress is vulnerable to Cross-Site Scripting via the 'xmlpath' parameter in versions up to, and including, 1.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthorized attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.23

Fixed in:

1.23

Disclosed:

Nov 20, 2011

Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulne...

CVSS:

6.1

Affected:

up to 1.22

Fixed in:

1.23

Disclosed:

Dec 2, 2009

CVE-2009-4168 on NVD →

[en] Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS)...

Affected:

up to 1.23

Fixed in:

1.23

Disclosed:

Dec 2, 2009

CVE-2009-4168 on NVD →

[en] Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected:

up to 1.22

Fixed in:

1.22

Disclosed:

Dec 2, 2009

CVE-2009-4169 on NVD →

[en] WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

Affected:

up to 1.23

Fixed in:

1.23

Disclosed:

Dec 2, 2009

CVE-2009-4170 on NVD →

WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

CVSS:

5.3

Affected:

up to 1.20

Fixed in:

1.23

Disclosed:

Nov 25, 2009

CVE-2009-4170 on NVD →

Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

7.1

Affected:

up to 1.22

Fixed in:

1.22

Disclosed:

Sep 27, 2009

CVE-2009-4169 on NVD →

The wp-cumulus WordPress plugin was affected by a Cross Site Scripting Vulnerabily security vulnerability.

Affected:

up to 1.23

Fixed in:

1.23